Analysis
- max time kernel
149s - max time network
109s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/09/2026, 03:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe
- Size 357KB
- Sample260907-dwecxaee43
- SHA256 df80978182a6051567ce7a6b6dddbc25feb8f7064cb7e6b7a9f9304c9f6d4e29
- MD5 529f861bf4c04cc5610e6c0e93c0944b
- SHA1 70e98b2464f81c28e03908060b548ed2cb88c866
- SHA512 d74e34bb8d2177422c249c5529dfe31b9d263c07d188fd66b461a33cbba511071374e58c760c285b8a841af47f687aeb05d855d4002b711aabb5771f9d14ba35
- SSDEEP 3072:FAkZ6buAsEFNmhMnDIhN2/m36D7UuNfXxhrauZnBzNuy5pCkTZcpPSUywOy+3GHJ:FHoi0JfxhWuHtQUZcpf+4H0YlL
- TLSH T11B743946765A51A1D0728530477347E2AB3D2E226792C68F57C07B66EE3E2C0FD29B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX4361.tmp 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX4F21.tmp 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX4E92.tmp 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX4EE2.tmp 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX41F8.tmp 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX51D2.tmp 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX529F.tmp 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX5250.tmp 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX41E7.tmp 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX4E52.tmp 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX4E32.tmp 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX4341.tmp 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCX43F0.tmp 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX43B0.tmp 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX4E82.tmp 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-06_529f861bf4c04cc5610e6c0e93c0944b_cobalt-strike_elex_icedid_luca-stealer_njrat.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2340
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 108KB
- SHA256 a40aeddb4d627e4584b2a3056ee7eb0dd25edc1fcffd5a029451a8b767b42445
- MD5 57e4bc21c6f81198b27f479cd852e386
- SHA1 11e16108bcb5cdf59c21645f156fb75515d985dd
- SHA512 cce62cc94c42a55b1dff19f2b87166a1dd5fad8bcbba480ff99baf66ed31e8cee5f2a88d25e805a6fd11947af77da02600da221f5482b5ec00f941703ad235e4
- SSDEEP 1536:WeAkZVCbuEYE+9z2wpuFavGmhMnDIhzZtzM/m36G:FAkZcbuAsEFNmhMnDIhN2/m36G
- TLSH T192B3B14A6A4F8261E470887143B797F61B6D1E22B9C7D65EABC13F16E4BC180F409B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
- Size 4.6MB
- SHA256 6eaa89fa0a981c382a91e12d4abaff514580b04a2a0a8f0f8730a0d635cdae05
- MD5 910035c4607ac085685c9fdc5a43a73f
- SHA1 b2c520026412dfd597f85eab62163b05809dee38
- SHA512 5dfa2c58ce8510f5fe6fc7669cebe34177f1e038eef2f0a27c9b1b612e0853257d8d136e45185eb740c8f0bbde3b1fa2c97536f6fcd6866180fe35f4cc63ac0e
- SSDEEP 49152:hX6YRJWudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:hxSijnUdYd+RaAj
- TLSH T1C0264803B28984D4D049C074CE1AD232AB617C9947F161EF36D4BBEA3A73AD47A3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e58413a.tmp
- Size 2.8MB
- SHA256 aa0a34300a93a2882b241b7fbf23e590f594f811fabfb8fccbc789796b7fa80e
- MD5 5fb303dcaf8de9324c9e4824718c0195
- SHA1 068710eaefe9da6aac750553546c08d2ad723b3e
- SHA512 1b117e044862a9a6bfc55984e6fd5093e0baa413507ca3055becd321ee602dbd5fb41c1bfa5e21327390e83ed50f6d1dabfea6e84896c11bb284578df8e7e7ee
- SSDEEP 49152:jY2fF8FhmS86IUJWQn+6h27d+Y2fF8FhmS86IUJWQn+6h27d6:jbOjjst4bOjjsts
- TLSH T1B6D57B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH