9f52ade367ad37705de5ed38f85cf72c6cfd3541a586f2a7fbe83b42cd8db58b

General

Target
2026-08-21_5a17eb46d4cd8f60a74e2ff204d35ead_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Size 1.1MB
Sample260821-e6ft6ahf53
SHA256 9f52ade367ad37705de5ed38f85cf72c6cfd3541a586f2a7fbe83b42cd8db58b
MD5 5a17eb46d4cd8f60a74e2ff204d35ead
SHA1 672bfe49849adebb7ec21061d998b44cf7feaefe
SHA512 519e1f704e5b40ac682638d4a0f3f6a7f08364c6d68e48c552eed70eb4317fe6b4bd2d0ca6573451fa14f7543a7fc825b94e8b97dfcbcaf94d1a9a340e542e0f
SSDEEP 12288:knd4bi5ZdbWmM/ywvnqGByjJ7LxWqYKAvhXQSxDcjVx6XN1jzbE+fA9:m4bi5rbWmM6wfqGGJvxa6oDIVx6jjPEF
TLSH
T11D356A7623F424F9C4F947BAE6808131FF75B64E33215169CA99852C3F3A96826BF305
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1580	wixstdba.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1580	1936	2026-08-21_5a17eb46d4cd8f60a74e2ff204d35ead_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-21_5a17eb46d4cd8f60a74e2ff204d35ead_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_5a17eb46d4cd8f60a74e2ff204d35ead_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\TEMP\{490F1BDD-7C9C-4378-A6F4-C3905218A448}\.ba\wixstdba.exe
  "C:\Windows\TEMP\{490F1BDD-7C9C-4378-A6F4-C3905218A448}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{5ABAD5E4-0C6D-4B5B-B4F1-98F61167FB06} {F0B0E156-FA8C-473F-8DAA-C7E9D6E42D52}
  2⤵
  - Executes dropped EXE
  PID:1580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{490F1BDD-7C9C-4378-A6F4-C3905218A448}\.ba\BootstrapperApplicationData.xml
Size 2KB
SHA256 354baaaa42288c44a443596ae0602fbd47b4b75f5c57357a35d72cbe2591d35f
MD5 8390a818e8e1f3410595e6d3224f4ffd
SHA1 9f8af6f51d6dc41357c8006f964f34b4236ffad0
SHA512 2ff7cfb26ca10a45849db2283187c6121adcac07087640366cbb320954cc66fab81140ee82d5ef3208531faf0d81d40a0f457828581620d428037b29a011fbe4
TLSH
T12151C85237FE0218F1F34F88EEBA61225939BD612E39CC2C00651D0E4972E5198B2FB7
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Windows\TEMP\{490F1BDD-7C9C-4378-A6F4-C3905218A448}\.ba\logo.png
Size 5KB
SHA256 3d707b7a0423135ac29bc76a85c7e32b02def21587a8c7bab034cf5c8c521098
MD5 87b49915c5f68733a5dba868965cd4e7
SHA1 13b9bf971f287eb0f3e3378ce4d0fe474e95310b
SHA512 b297f4bd9993173bc1bd629c13cca26301ff1497d583f06094ce5a51a128493c2a0e4fea4c6249f9c2788dcbbf6f3c2725ad70ab780bd953f3ad39b348d46927
SSDEEP 96:GL5JmaPcXUakSuedgl5JOuNUd7UG4/JIchScbGPRoAACJ2+J9wvqsGzg0GcaWkU:GL5J9cjHdglOB7CIwGPRdtRJ9t3zgVLM
TLSH
T1B1C19ECFABD5C82CC3042962D1105EA155D14C34907E8884D37B61EF9E42556DBC8F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logoside.png

Path C:\Windows\TEMP\{490F1BDD-7C9C-4378-A6F4-C3905218A448}\.ba\logoside.png
Size 62KB
SHA256 d99a953d36a6cb1ed0edc557f025726efbcb1f4dd19549b4d22a0eaa00a4ed47
MD5 14fb17c2e11be7889a7b979ad6b3554b
SHA1 bf161c7261590e0e0dc16130759ee64378957d86
SHA512 e0195e4967c62cfbbe61559df061f875bdaa72fb6c19cd90b540609180f436a0a8ebaf5cd02168e8fdc242b3adcc39a1ed0a602c29f04c359a7b116838d0bb6b
SSDEEP 1536:3rMpbbTWpzjO+CfzaCvvE3c5OzUDF70rtSiw3te5E0eTQxDIB:bu/pzaCXE3cDDart1w3ten++g
TLSH
T10C530271433FB2081BE02DB15A3A535CF83AFE398D2985854B6628F739D2392745B1B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{490F1BDD-7C9C-4378-A6F4-C3905218A448}\.ba\thm.wxl
Size 5KB
SHA256 3a4fbb839544c4b4e80827fcb3aa91648bb73a1e84359f207264ec4bd468ee4f
MD5 f65abbbe0c427fb3bf79b893f02e5ad9
SHA1 f050535eb2f52e609afcd790d7dd884aee55e938
SHA512 d28cd76a0045a44f99f20d49d78a499f78fd1c055992c07c7837650c6a0b4457a682e7d91e57b7e1175a1e1f706f7007176911f1130de6482541b207e2b21982
SSDEEP 96:HL/vK0c0vMcivL5MQP1+XS/cEOYJA0SCwZQipCeyAC:rHEbdYuwYK0r
TLSH
T1CFC1D36B58CFEFE02A736654B5F3988A3518C1D6432B2CF1F86A454B876710163B3753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{490F1BDD-7C9C-4378-A6F4-C3905218A448}\.ba\thm.xml
Size 10KB
SHA256 1454dc663e12dfec53227bc1748ae27f93c110f0a50d83843c0486d4d28bf7e2
MD5 c52367214962ea18080a3b16805145d3
SHA1 fcf612b8e3826e77450db6d8712c6d392a9b3be4
SHA512 3520b6e6c261ade1c23564ee9cf2ddaf993f2b6944c353a08d5dfcff94d8a756afb1f182179119c106fefc1c2a6ca8089a611796af8e52128f1768f612aa4741
SSDEEP 96:8Lai4/t0LJ0HMLlh4CCsjPByR4Gyvqc/4smbOBcpR5DpQ+l4MmoJLA1AEpeypwsV:him47CB7HJyxP
TLSH
T10D32CC7946EDBC01C233E70267E326C2BF122D62C5C42A59F94D2AB75FF215068B726D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{490F1BDD-7C9C-4378-A6F4-C3905218A448}\.ba\wixstdba.exe
Size 489KB
SHA256 e05dda0c23421cfc7a2a39b91074928605e1e69ad5f0a2a4e230ed5996fe2ff9
MD5 8c03e8907ba4ab272dd305a3bca52bc7
SHA1 bdf3b9ad081792cce2a6ea8ac4b23d54c8add31f
SHA512 36a96a722df0d9a3e8ea8b9e4d98b4fee3c869883c2530863c6ef5b8255c73488e9607280f0491d9969fea8bf09381310a5684a2ac475ba569834549f5e119af
SSDEEP 6144:5jdeA6Rk9w8aCu8CwlLSHosx7BxoUzLKo2XSgt5Yxsuy:5ZfwkOpCu8N+jEUnOXSgLBZ
TLSH
T1F5B45BBA22F422E9C5F94276D581A122FF70B54C370091AF8614C93D6F3B9A939BF345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads