9271af5e005e17f01bf762d657dba64367faa34e3d51e1d3b0bf7b7b751e2544

General

Target
2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
Size 3.9MB
Sample260928-vhn4mabh65
SHA256 9271af5e005e17f01bf762d657dba64367faa34e3d51e1d3b0bf7b7b751e2544
MD5 30d3b4aaabb2d449283c9adb467ac6f4
SHA1 ec481699673167f7a0705c3497da98983f8d5d3c
SHA512 2000c53407832a4e78e43f3ab4b339f355b989498a4173648e42e972855422acf98651115cf4c07b1dc47eb35f1383e435270b80c27f24fbe543adeacbc4c227
SSDEEP 98304:njiqMDtIXLr06AdfEThF35PzuPxcNSGvYjPKjiO:WmrmEdF32xcNSGiPBO
TLSH
T1CC16F11572E900D8F4A7E13AC9234966D6B13C160F319ADF0290BB5B2F77AD21E7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4580	2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
4536	maintenance.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2896	cmd.exe
3664	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenance.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3388	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4580	2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
4580	2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4580	2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 2896	4960	2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe	89
PID 4960 wrote to memory of 3664	4960	2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe	91
PID 2896 wrote to memory of 3852	2896	cmd.exe	93
PID 3664 wrote to memory of 5652	3664	cmd.exe	94
PID 2896 wrote to memory of 3524	2896	cmd.exe	95
PID 3664 wrote to memory of 4580	3664	cmd.exe	96
PID 3664 wrote to memory of 3388	3664	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zbe2026928165939718.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks.Exe /delete /tn "Maintenance" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3852
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks.Exe /create /tn "Maintenance" /xml "C:\Users\Admin\AppData\Local\Temp\zx2026928165939718.xml"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zb2026928165939718.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5652
- - C:\Users\Admin\AppData\Local\Temp\2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4580
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3388

C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zb2026928165939718.bat

Path C:\Users\Admin\AppData\Local\Temp\zb2026928165939718.bat
Size 904B
SHA256 89c864363afc109c1e1bc1eea81c8d531acda400e693cc5a5136c1c88eaa04e0
MD5 a767cb4fcbf6d663dc72b4faccc95c2a
SHA1 7ba131478714a934ed5ef03f5d3477214b5a8af6
SHA512 addf7c75c07143cd25cf1396bacd2ddb6d9600ecd68fb43082073e4b4df0ea62ff03af81407947958ba21ef60f5d338538f46e1c886321ca7e827cd67d9a3dad
TLSH
T119110A03C1EAEBFA0004607706B26E5EC0AA294A2F4577706795D40D52C5D8CF9F7756
MD5 SHA1 SHA512 TLSH

Submit Download

zbe2026928165939718.bat

Path C:\Users\Admin\AppData\Local\Temp\zbe2026928165939718.bat
Size 366B
SHA256 f2b6a5895c682d9ff4e1667e4e9af7ee6fb407ad32bff49a4932b207b30cbcba
MD5 5d255fc673b7643585e2e90abedf3751
SHA1 0e5aaee266d91f3e4e552abaf4a14b0ff6b662a6
SHA512 83323ebbb5b14f365c3a4de4cae8d8274e0966cd22967cbe1663e1ebaf73a284a6fe6f8df8f437ac0d1e8c8d0471e59951d557020fb979b0a1110a56cd850f33
TLSH
T140E0680803A7C4D9900CE60375DB2A1368B1606AE6E177282DD72020CA9F049F8AB703
MD5 SHA1 SHA512 TLSH

Submit Download

ze2026928165939718.tmp

Path C:\Users\Admin\AppData\Local\Temp\ze2026928165939718.tmp
Size 3.9MB
SHA256 aff7eda0c2fd9873d327d980afe704ff3bdf3d7a964b39a54683209011ab56e5
MD5 2a40d70b24ec190e9db5b8af76faa031
SHA1 b303ff1b8880fca72eae524a7301db20c129ba39
SHA512 9d88b214ea1165ec63adeeea29e2ca892450bc87fadac543a2d0b1d1927d062d8fbe91035e4d9497c6ba641252c51a0ca38f5a527fe47e582473ade79773b53b
SSDEEP 98304:sxcNSGvYjPKjiu7XsWkkjaHjTo82Pb0c0NZrk:sxcNSGiPB28WfszNpk
TLSH
T1F016F10562DD01D8E4B7E17AC9324956DAB13C1A0B328BDF02A0BB5B2F37AD15E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zx2026928165939718.xml

Path C:\Users\Admin\AppData\Local\Temp\zx2026928165939718.xml
Size 1KB
SHA256 d34276ef3abde459377ea6cac90a7bbe29a05d18ffd9ea016d8be9a8db7410bc
MD5 75cc28c2335b980b107cdbf6d9526662
SHA1 ae87514fcafdf51d2b7eb39ae07b759492b61cca
SHA512 13a6a7ce01d1e70e06714ccb03d5ff8478ed389d919d2c160b2ec59928bba5ce05a7c68ef86b235debb4b29ca62a8fe6e0d91b20e860b891b97a60e031c47a99
TLSH
T13B3125589CC0FB2BB533922BE7515282EF358393056A4038F4CC4B7B1FF50466143563
MD5 SHA1 SHA512 TLSH

Submit Download

maintenance.exe

Path C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
Size 2.2MB
SHA256 a77315296dc58edac4959c9ed69ec96e9517883684edaeba3e64c48a44c186ae
MD5 73ad6d009f1c53c23f5d068caa805299
SHA1 f50493f49c3b2b3697b5eb571738dbc70383cac0
SHA512 1f9c739c7b745ba57b3d7e50e00bac9d3019de25aab5bb22c0da810d963dab93d71c56686fccf737cf87a4c95fe53b8e4b3dda09ac1526fb4899aa0e1336e920
SSDEEP 49152:uo7TN6XYwGRV1LCnO9DivWp1daCCN2eLF6I5YDPRrBdSm2610V+9dmhBafgE:uC6NIDLCCiO/dat6I5YPFBx0VmKafgE
TLSH
T184B5337F996640A6FEB86ABC24127F7C892BD12703306D71D9D59C37045E223AB324ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads