Analysis
- max time kernel
12s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/08/2026, 06:14
General
- Target 2026-08-16_e67ea778205b3ed3c16e4075a2f87abe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
- Size 39.2MB
- Sample260816-gzthsael21
- SHA256 2f80fe2ad6703023ab364f621c4495e24c201a041b935a8c9fd605e15ee6254e
Malware Config
Signatures
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Drops file in Drivers directory 1 IoCs
- Disables service(s) 3 TTPs
- Executes dropped EXE 1 IoCs
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in System32 directory 5 IoCs
- Drops file in Program Files directory 1 IoCs
- Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 8 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Runs net.exe
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_e67ea778205b3ed3c16e4075a2f87abe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_e67ea778205b3ed3c16e4075a2f87abe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\UpdatAuto.exeC:\Windows\system32\UpdatAuto.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\system32\drivers\2026-08-16_e67ea778205b3ed3c16e4075a2f87abe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar~1.Doc" /o ""2⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop sharedaccess2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop sharedaccess3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop wuauserv2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop wscsvc2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\net.exenet stop wscsvc3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop srservice2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop srservice3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net start TlntSvr2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\net.exenet start TlntSvr3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start TlntSvr4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net user helpassistant 1234562⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet user helpassistant 1234563⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user helpassistant 1234564⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net localgroup administrators helpassistant /add2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet localgroup administrators helpassistant /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators helpassistant /add4⤵
-
-
-
-
C:\Windows\SysWOW64\sc.exesc config srservice start= disabled2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc config wscsvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc config srservice start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
chrmstp.exe
chrome_pwa_launcher.exe
elevated_tracing_service.exe
elevation_service.exe
notification_helper.exe
os_update_handler.exe
chrome.exe
chrome_proxy.exe
appletviewer.exe
extcheck.exe
idlj.exe
jabswitch.exe
dotnet.exe
createdump.exe
createdump.exe
createdump.exe
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
2026-08-16_e67ea778205b3ed3c16e4075a2f87abe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar~1.Doc
Option.bat
UpdatAuto.exe
ntldr~6
ntldr~6
ntldr~6
ntldr~6
ntldr~6
ntldr~6
ntldr~6
ntldr~6
ntldr~6
ntldr~6
ntldr~6
ntldr~6
ntldr~6
ntldr~6
memory/2384-43-0x00007FFAEF8E0000-0x00007FFAEF8F0000-memory.dmp
memory/2384-49-0x00007FFAED5F0000-0x00007FFAED600000-memory.dmp
memory/2384-45-0x00007FFAED5F0000-0x00007FFAED600000-memory.dmp
memory/2384-41-0x00007FFAEF8E0000-0x00007FFAEF8F0000-memory.dmp
memory/2384-44-0x00007FFAEF8E0000-0x00007FFAEF8F0000-memory.dmp
memory/2384-42-0x00007FFAEF8E0000-0x00007FFAEF8F0000-memory.dmp
memory/2384-40-0x00007FFAEF8E0000-0x00007FFAEF8F0000-memory.dmp