Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/09/2026, 23:26
Behavioral task
behavioral1
Sample
2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe
- Size 961KB
- Sample260908-3fbdrahp8v
- SHA256 28d1ace60984f8ccb8854129ba4d4eafea6a7818b508f70e4cc51a30c19e8b00
- MD5 6eb7b7527c2a4c2609c47e834cb2157c
- SHA1 c70827a7bd0e761dcd7d6492043001735feba003
- SHA512 f1245956a552654344839aca8a5080998d405562204804178bb60dcb67059ade3b1d997a91beb48ffc40aeb2edb2ec274609d7d71243158b47755e3c1284a8ed
- SSDEEP 12288:86Wq4aaE6KwyF5L0Y2D1PqLb6Wq44er5+nZoyfL1W0mer5+nIwaJVer5+nBou:6thEVaPqLBt0EE1z
- TLSH T194255A07B2559CD3CBE54A74DC24C6A55322B89DAFF34673788453CE7C6B284BE26B20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe - UPX dump on OEP (original entry point) 3 IoCs
resource yara_rule behavioral1/files/0x000b0000000241e3-4.dat UPX behavioral1/files/0x0007000000024326-125.dat UPX behavioral1/memory/392-930-0x0000000000400000-0x00000000005C2000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 812 svhost.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\t: svhost.exe - AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/392-753-0x0000000000400000-0x00000000005C2000-memory.dmp autoit_exe behavioral1/memory/812-865-0x0000000000400000-0x00000000005C2000-memory.dmp autoit_exe behavioral1/memory/392-930-0x0000000000400000-0x00000000005C2000-memory.dmp autoit_exe behavioral1/memory/812-1078-0x0000000000400000-0x00000000005C2000-memory.dmp autoit_exe -
resource yara_rule behavioral1/memory/392-0-0x0000000000400000-0x00000000005C2000-memory.dmp upx behavioral1/files/0x000b0000000241e3-4.dat upx behavioral1/memory/812-6-0x0000000000400000-0x00000000005C2000-memory.dmp upx behavioral1/memory/812-7-0x0000000000400000-0x00000000005C2000-memory.dmp upx behavioral1/files/0x0007000000024326-125.dat upx behavioral1/memory/392-753-0x0000000000400000-0x00000000005C2000-memory.dmp upx behavioral1/memory/812-865-0x0000000000400000-0x00000000005C2000-memory.dmp upx behavioral1/memory/392-930-0x0000000000400000-0x00000000005C2000-memory.dmp upx behavioral1/memory/812-1078-0x0000000000400000-0x00000000005C2000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Driver.db svhost.exe File created C:\Windows\svhost.exe 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 812 svhost.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 392 wrote to memory of 812 392 2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-07_6eb7b7527c2a4c2609c47e834cb2157c_cobalt-strike_coinminer_elex_icedid_njrat.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:812
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PerfLogs.exe
- Size 961KB
- SHA256 0129d8d72358fbc30ccfbc84ba86b20e26db1431e4212ff0f647f05682159e9e
- MD5 9822194a19f812d2f161654aea2207a7
- SHA1 19e6db9bec1c588692fb1413a57798a48f251b62
- SHA512 030d084b713a48a70a52d89f18a9ebcf2cf2ea0ef6378f60e52f2f487ac1ca7872f715f064f86b5e006469491e0087f89d87b1d4cc505c6f5cdb2f6f0880e24d
- SSDEEP 12288:86Wq4aaE6KwyF5L0Y2D1PqLb6Wq44er5+nZoyfL1W0mer5+nIwaJVer5+nBoP:6thEVaPqLBt0EE1q
- TLSH T1DD255A07B2559CD3CBE54A74DC24C6A55322B89DAFF34673788453CE7C6B284BE26B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Driver.db
- Size 82B
- SHA256 b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
- MD5 c2d2dc50dca8a2bfdc8e2d59dfa5796d
- SHA1 7a6150fc53244e28d1bcea437c0c9d276c41ccad
- SHA512 6cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
- TLSH T163A0112832A830A28EE0A00EB0FAC000E28820A00E02882A0800002E0CA83B02C00222
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\svhost.exe
- Size 961KB
- SHA256 eaa9275f9589cb0cb803c4d45992bd8ab780c82c95bffb59f870b67cbce74523
- MD5 8ba7247921400da4e43311f3dbbfa508
- SHA1 6181b42b35bebbbae12c2dd29f2af46428e3a76a
- SHA512 788f6dd0dde441b084549d0154ce197256971f7c4b59458dfe6bc4fea2244e32220e3fa35c3f0b8ddcb7bca169a8720f900d5485a51fccc107e32b729f3b243a
- SSDEEP 12288:86Wq4aaE6KwyF5L0Y2D1PqLb6Wq44er5+nZoyfL1W0mer5+nIwaJVer5+nBo2:6thEVaPqLBt0EE1f
- TLSH T151255A07B2559CD3CBE54A74DC24C6A55322B89DAFF34673788453CE7C6B284BE26B20
- MD5 SHA1 SHA512 SSDEEP TLSH