Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 04:13
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target 2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe
- Size 13.0MB
- Sample260822-es9kbaeb49
- SHA256 de5b41b22d7262671a9ff63a74a0bb8dce72ee1b96f19bc99e07135154af4ae3
- MD5 5f9a109014e75db82854818e533686cc
- SHA1 bc19326706ad8b517755d8b1533c9162270872df
- SHA512 1af1e325e349082f8aa3a1ba1c75da63080b07b36e653442ab21834fe42cda12657ac766630d4496ce261b5bde411f170f9941b179299874e1cfad371fef11a7
- SSDEEP 196608:p5agcVBJsDuLyAJaSJWAjOU60iiW47HQdA73+wc2vx/zitV2R44QfR:Hk0+yNSJa0rW46AinMmtC34
- TLSH T1BDD6BE1962D41219F1B39130DAB2C216E7737CD65B708B8F2ADE67035BB3AD19837329
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 5 IoCs
resource yara_rule behavioral2/memory/3324-1-0x00007FF6AB840000-0x00007FF6AC54B000-memory.dmp INDICATOR_SUSPICIOUS_USNDeleteJournal behavioral2/files/0x000e00000001c462-4.dat INDICATOR_SUSPICIOUS_USNDeleteJournal behavioral2/memory/3324-5-0x00007FF6AB840000-0x00007FF6AC54B000-memory.dmp INDICATOR_SUSPICIOUS_USNDeleteJournal behavioral2/memory/1124-8-0x00007FF782340000-0x00007FF78304B000-memory.dmp INDICATOR_SUSPICIOUS_USNDeleteJournal behavioral2/files/0x000d00000001c464-10.dat INDICATOR_SUSPICIOUS_USNDeleteJournal - Deletes itself 1 IoCs
pid Process 1124 ITdoGFG.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 1 IoCs
pid Process 1124 ITdoGFG.exe - Loads dropped DLL 1 IoCs
pid Process 4280 regsvr32.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 3324 2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe 3324 2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe - Executes a command shell one-liner 1 TTPs 6 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 796 cmd.exe 1056 cmd.exe 988 cmd.exe 5436 cmd.exe 5988 cmd.exe 3132 cmd.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1056 cmd.exe 3376 PING.EXE 988 cmd.exe 2332 PING.EXE - Modifies registry class 26 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CE4A85DB-5768-475B-A4E1-C0BCA2112A6B}\ = "Generic StackWalker" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E6756135-1E65-4D17-8576-610761398C3C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91904831-49CA-4766-B95C-25397E2DD6DC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91904831-49CA-4766-B95C-25397E2DD6DC}\InprocServer32\ = "c:\\msdia140.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91904831-49CA-4766-B95C-25397E2DD6DC}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E6756135-1E65-4D17-8576-610761398C3C}\InprocServer32\ = "c:\\msdia140.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91904831-49CA-4766-B95C-25397E2DD6DC}\ = "Debug Information Accessor w/o Global Memory Usage" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CE4A85DB-5768-475B-A4E1-C0BCA2112A6B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\ = "dia 2.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\0\win64 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CE4A85DB-5768-475B-A4E1-C0BCA2112A6B}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E6756135-1E65-4D17-8576-610761398C3C}\ = "Debug Information Accessor" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E6756135-1E65-4D17-8576-610761398C3C}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E6756135-1E65-4D17-8576-610761398C3C}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CE4A85DB-5768-475B-A4E1-C0BCA2112A6B}\InprocServer32\ = "c:\\msdia140.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CE4A85DB-5768-475B-A4E1-C0BCA2112A6B}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\0\win64\ = "c:\\msdia140.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91904831-49CA-4766-B95C-25397E2DD6DC}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\HELPDIR\ = "c:" regsvr32.exe - Runs ping.exe 1 TTPs 2 IoCs
pid Process 3376 PING.EXE 2332 PING.EXE - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3324 2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe 3324 2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe 1124 ITdoGFG.exe 1124 ITdoGFG.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 3324 2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1124 ITdoGFG.exe Token: SeSystemEnvironmentPrivilege 1124 ITdoGFG.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3324 wrote to memory of 1056 3324 2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe 90 PID 1056 wrote to memory of 3376 1056 cmd.exe 91 PID 3324 wrote to memory of 1124 3324 2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe 92 PID 1124 wrote to memory of 988 1124 ITdoGFG.exe 93 PID 988 wrote to memory of 2332 988 cmd.exe 94 PID 1124 wrote to memory of 5436 1124 ITdoGFG.exe 95 PID 1124 wrote to memory of 5988 1124 ITdoGFG.exe 96 PID 5988 wrote to memory of 4280 5988 cmd.exe 97 PID 1124 wrote to memory of 3132 1124 ITdoGFG.exe 98 PID 1124 wrote to memory of 796 1124 ITdoGFG.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 1 localhost&echo %random%>>C:\Users\Admin\AppData\Local\Temp\ITdoGFG.exe2⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\system32\PING.EXEping -n 1 localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3376
-
-
-
C:\Users\Admin\AppData\Local\Temp\ITdoGFG.exe"C:\Users\Admin\AppData\Local\Temp\ITdoGFG.exe" C:\Users\Admin\AppData\Local\Temp\fivDnjoc.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 1 localhost&echo %random%>>C:\Users\Admin\AppData\Local\Temp\fivDnjoc.exe3⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\system32\PING.EXEping -n 1 localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2332
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
PID:5436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c regsvr32 /s c:\msdia140.dll3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\system32\regsvr32.exeregsvr32 /s c:\msdia140.dll4⤵
- Loads dropped DLL
- Modifies registry class
PID:4280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
PID:3132
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
PID:796
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\ITdoGFG.exe
- Size 13.0MB
- SHA256 e68bd3b5e5117141188f703fa80d906750c94a693ba85d7f0d5cecb50344aa1e
- MD5 73a6900a6db54f41143b9883d276bfa7
- SHA1 f9b15b8bc28075ba8f3e6a02351bc2f2d2fa2346
- SHA512 3195b6f32003573ea1d2b5885dd5fedf401abb21c1af61d3f9df938a76f2a3b7ed1c2760f9e38634eb1670fd7e73b8a142fe41e12a618b3d315f76b177a1fb94
- SSDEEP 196608:p5agcVBJsDuLyAJaSJWAjOU60iiW47HQdA73+wc2vx/zitV2R44Qfh:Hk0+yNSJa0rW46AinMmtC3s
- TLSH T140D6BE1962D41219F1B39130DAB2C216E7737CD65B708B8F2ADE67035BB3AD19837329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\fivDnjoc.exe
- Size 13.0MB
- SHA256 44d000149753148799850845c5d95e022e0068944f39868bdb397d5ccd7d423b
- MD5 d5d388382d2eb37bfda4e168d8e4f370
- SHA1 337aac72b6455db1d63a5e9f0d9ace44f17c7678
- SHA512 2e2d12a7c5c1df0b58b1df061b463fe8abd955542cfc334c5a8db8912a50cd9c28d6094484ef3dcf9a973764b8bcb6ebd43fc36681d4740b263dc833ecc5d897
- SSDEEP 196608:p5agcVBJsDuLyAJaSJWAjOU60iiW47HQdA73+wc2vx/zitV2R44Qf4:Hk0+yNSJa0rW46AinMmtC3d
- TLSH T186D6BE1962D41219F1B39130DAB2C216E7737CD65B708B8F2ADE67035BB3AD19837329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\msdia140.dll
- Size 1.5MB
- SHA256 46351bd350799dc196481cbe2b26f628b489a280a9e2f49bace71930f3dc80d3
- MD5 73e0349829750676b7791ac210e304e8
- SHA1 38d8faa45f57ea050bff328bf0f23a8cd1f4e73f
- SHA512 7ae086c3dec0fb33a648cc2bd5fde69804b6b752e05c6ef4f45c00780b13ba086183a9adc4c432e38748d05c551107c3ab01fcbb8e29d966588a3ab220e4e311
- SSDEEP 24576:Rwx85I7xvZ6XlppppppLqrcQCGFV7FO8tiD/2ql5jszR25sb6:Rwr7xUScjuiJl5jszRA
- TLSH T1AF657D57B3B441A8D57AC138C71B9A06D7F374150311A7CF1AA147AABF2BBE61A3D320
- MD5 SHA1 SHA512 SSDEEP TLSH