2d7648ed165dcb916b47056e59508a87ae3f4bf509e2666c8ff5a7879b3524fe

Analysis

max time kernel
150s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 20:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_dd2ac8f0c51527ba3f5f23a221b7ba83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 4.5MB
Sample260812-zg4vxaej7v
SHA256 2d7648ed165dcb916b47056e59508a87ae3f4bf509e2666c8ff5a7879b3524fe
MD5 dd2ac8f0c51527ba3f5f23a221b7ba83
SHA1 b7ac45f368b275aa084e54f1ec2a5ddb913ef572
SHA512 a80c132945d1131f6a3e014804f57309effa3d6fed2196e73d18c7e06a15de003d829251286122290ca9319013e22030a397db480819177470ac7a9b2433b3ad
SSDEEP 49152:aVN3cz2x8WLYIRgelDh9YNFSZK5kAibHj4CgHsoJnHLYNAbHjpZK5kAECgH:1zkhs5kAibMCgHEAba5kAECgH
TLSH
T17726B017F711C25CC816AC308AE2CBD2B375BC411B29D6CB3199BA599F971F00ABB6D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c63b-7.dat	INDICATOR_SUSPICIOUS_References_SecTools

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	6080	EdgeUpdateBroker.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Security Update.exe	MicrosoftEdgeUpdateCore.exe

Executes dropped EXE 3 IoCs

pid	Process
6080	EdgeUpdateBroker.exe
3156	MicrosoftEdgeUpdateCore.exe
4748	Windows Security Update.exe

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4268	tasklist.exe
7164	tasklist.exe
5884	tasklist.exe
1320	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4748 set thread context of 2748	4748	Windows Security Update.exe	107

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3668	powershell.exe
1552	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5708	2026-08-12_dd2ac8f0c51527ba3f5f23a221b7ba83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
5708	2026-08-12_dd2ac8f0c51527ba3f5f23a221b7ba83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
3668	powershell.exe
3668	powershell.exe
1552	powershell.exe
1552	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4268	tasklist.exe
Token: SeDebugPrivilege	7164	tasklist.exe
Token: SeDebugPrivilege	3668	powershell.exe
Token: SeIncreaseQuotaPrivilege	3668	powershell.exe
Token: SeSecurityPrivilege	3668	powershell.exe
Token: SeTakeOwnershipPrivilege	3668	powershell.exe
Token: SeLoadDriverPrivilege	3668	powershell.exe
Token: SeSystemProfilePrivilege	3668	powershell.exe
Token: SeSystemtimePrivilege	3668	powershell.exe
Token: SeProfSingleProcessPrivilege	3668	powershell.exe
Token: SeIncBasePriorityPrivilege	3668	powershell.exe
Token: SeCreatePagefilePrivilege	3668	powershell.exe
Token: SeBackupPrivilege	3668	powershell.exe
Token: SeRestorePrivilege	3668	powershell.exe
Token: SeShutdownPrivilege	3668	powershell.exe
Token: SeDebugPrivilege	3668	powershell.exe
Token: SeSystemEnvironmentPrivilege	3668	powershell.exe
Token: SeRemoteShutdownPrivilege	3668	powershell.exe
Token: SeUndockPrivilege	3668	powershell.exe
Token: SeManageVolumePrivilege	3668	powershell.exe
Token: 33	3668	powershell.exe
Token: 34	3668	powershell.exe
Token: 35	3668	powershell.exe
Token: 36	3668	powershell.exe
Token: SeIncreaseQuotaPrivilege	3668	powershell.exe
Token: SeSecurityPrivilege	3668	powershell.exe
Token: SeTakeOwnershipPrivilege	3668	powershell.exe
Token: SeLoadDriverPrivilege	3668	powershell.exe
Token: SeSystemProfilePrivilege	3668	powershell.exe
Token: SeSystemtimePrivilege	3668	powershell.exe
Token: SeProfSingleProcessPrivilege	3668	powershell.exe
Token: SeIncBasePriorityPrivilege	3668	powershell.exe
Token: SeCreatePagefilePrivilege	3668	powershell.exe
Token: SeBackupPrivilege	3668	powershell.exe
Token: SeRestorePrivilege	3668	powershell.exe
Token: SeShutdownPrivilege	3668	powershell.exe
Token: SeDebugPrivilege	3668	powershell.exe
Token: SeSystemEnvironmentPrivilege	3668	powershell.exe
Token: SeRemoteShutdownPrivilege	3668	powershell.exe
Token: SeUndockPrivilege	3668	powershell.exe
Token: SeManageVolumePrivilege	3668	powershell.exe
Token: 33	3668	powershell.exe
Token: 34	3668	powershell.exe
Token: 35	3668	powershell.exe
Token: 36	3668	powershell.exe
Token: SeDebugPrivilege	5884	tasklist.exe
Token: SeDebugPrivilege	1320	tasklist.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeIncreaseQuotaPrivilege	1552	powershell.exe
Token: SeSecurityPrivilege	1552	powershell.exe
Token: SeTakeOwnershipPrivilege	1552	powershell.exe
Token: SeLoadDriverPrivilege	1552	powershell.exe
Token: SeSystemProfilePrivilege	1552	powershell.exe
Token: SeSystemtimePrivilege	1552	powershell.exe
Token: SeProfSingleProcessPrivilege	1552	powershell.exe
Token: SeIncBasePriorityPrivilege	1552	powershell.exe
Token: SeCreatePagefilePrivilege	1552	powershell.exe
Token: SeBackupPrivilege	1552	powershell.exe
Token: SeRestorePrivilege	1552	powershell.exe
Token: SeShutdownPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeSystemEnvironmentPrivilege	1552	powershell.exe
Token: SeRemoteShutdownPrivilege	1552	powershell.exe
Token: SeUndockPrivilege	1552	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5708 wrote to memory of 6080	5708	2026-08-12_dd2ac8f0c51527ba3f5f23a221b7ba83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	91
PID 6080 wrote to memory of 3156	6080	EdgeUpdateBroker.exe	92
PID 3156 wrote to memory of 4268	3156	MicrosoftEdgeUpdateCore.exe	93
PID 3156 wrote to memory of 7164	3156	MicrosoftEdgeUpdateCore.exe	96
PID 3156 wrote to memory of 3668	3156	MicrosoftEdgeUpdateCore.exe	98
PID 3156 wrote to memory of 4748	3156	MicrosoftEdgeUpdateCore.exe	100
PID 4748 wrote to memory of 5884	4748	Windows Security Update.exe	101
PID 4748 wrote to memory of 1320	4748	Windows Security Update.exe	103
PID 4748 wrote to memory of 1552	4748	Windows Security Update.exe	105
PID 4748 wrote to memory of 2748	4748	Windows Security Update.exe	107
PID 4748 wrote to memory of 2748	4748	Windows Security Update.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-12_dd2ac8f0c51527ba3f5f23a221b7ba83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_dd2ac8f0c51527ba3f5f23a221b7ba83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\EdgeUpdateBroker.exe
  C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\EdgeUpdateBroker.exe
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdateCore.exe
    C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdateCore.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Windows\system32\tasklist.exe
      tasklist.exe
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4268
  - - C:\Windows\system32\tasklist.exe
      tasklist.exe
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:7164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$items=@((Get-CimInstance Win32_ComputerSystem | ForEach-Object { $_.Manufacturer; $_.Model }),(Get-CimInstance Win32_BIOS | ForEach-Object { $_.Manufacturer; $_.SMBIOSBIOSVersion })); $items -join ' '"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3668
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Security Update.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Security Update.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4748
    - - C:\Windows\system32\tasklist.exe
        
        tasklist.exe
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:5884
    - - C:\Windows\system32\tasklist.exe
        
        tasklist.exe
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$items=@((Get-CimInstance Win32_ComputerSystem | ForEach-Object { $_.Manufacturer; $_.Model }),(Get-CimInstance Win32_BIOS | ForEach-Object { $_.Manufacturer; $_.SMBIOSBIOSVersion })); $items -join ' '"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
    - - C:\Windows\System32\msiexec.exe
        
        C:\Windows\System32\msiexec.exe
        5⤵
        
        PID:2748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EdgeUpdateBroker.exe

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\EdgeUpdateBroker.exe
Size 233KB
SHA256 1df0f110076fcebd44cba965df078608c4e6c5f97f2d40772a67409049caeac6
MD5 a4b245af9d28918d44b8ac18630329c4
SHA1 fc5f233698aae7257d30cef167518d3634ddebe1
SHA512 774e8fc7d1ef4166e9b3427b6a2ef19a515d2296ebc9aee3ee6b4c718b41e2419370286ee23c8ffd4426368713b0715e27239ba06316e87e2a9694f3575069d9
SSDEEP 3072:nAmDwNYbQmVQiMmYAN6Cyzx4D4U+sfo3ikXglxgYNxUTnUUWbAeJP5L5gdj:FkBzx4EU+sheY6YN8nUUaJP5L5gdj
TLSH
T12534193BA7A34CF5C59B81789B8BD6F16431FC150324ED1E0695C7323F1B9680FA99A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdateCore.exe
Size 23.9MB
SHA256 7e3347aa346f7a969bef253ae72eab9c288059420de14d526f99ac08943666dc
MD5 bce363713b389ddbecd41a0a387f1dcc
SHA1 6229a38b1e4c4d7dfba6d4c6071d6cabc7cdada8
SHA512 7c0289e9a797e1b0b3abbb3bb63d20f66a2ea7765372d0b4f17d0c45d6cfc6e7d5e5a571048581075d69f6b9b06185066313fe2ec1f4c03101695bb3d1e193f0
SSDEEP 49152:yxIQfsATD/AM6SU3819VajngZGDYqvDFH5YhQ6X959IAvvZ5x8WG9KXYX1D3LV75:yxLUGrznKwbL1qqxYf
TLSH
T18E470221FA6A1CD6F066E23486B2A4567B7A7CB01B25C3DB5A502B791F3DFC04DB1321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7d5423fab0bc688fe408ae455cf60ad90cd6398b0ebb0c5a535b34f8e429bcb9
MD5 dfea0acb42134448419e78d8a8221a92
SHA1 96596f18f5c130782bf5dd87402489f20b804151
SHA512 52c8f889df7c8183d579ed08e8e0cf86bd7b36589206473fd3b5d949e7bcc2525f2e6d1a6951d114b63bfa4e403e90d9244101644d7ded63c0465c5ea3bede7b
TLSH
T1A7217633F3DC8214C899013A10DDAC1036B687CB40DECF9B6B85E159A42F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0neg5e2a.uet.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0neg5e2a.uet.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2748-33-0x0000000140000000-0x000000014414E000-memory.dmp

Download

memory/3668-12-0x0000029B72000000-0x0000029B72022000-memory.dmp

Download

memory/3668-17-0x0000029B720C0000-0x0000029B720DE000-memory.dmp

Download

memory/3668-18-0x0000029B72300000-0x0000029B723B2000-memory.dmp

Download

memory/3668-19-0x0000029B720E0000-0x0000029B720EA000-memory.dmp

Download

memory/3668-20-0x0000029B72640000-0x0000029B7266A000-memory.dmp

Download

memory/3668-21-0x0000029B72640000-0x0000029B72664000-memory.dmp

Download

memory/6080-11-0x00007FF60FFD0000-0x00007FF610012000-memory.dmp

Download