Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 08:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_b02fd26e2351dc1faa6032fcadad29f0_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_b02fd26e2351dc1faa6032fcadad29f0_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-09-30_b02fd26e2351dc1faa6032fcadad29f0_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
- Size 2.8MB
- Sample260930-kh4tzasgpf
- SHA256 7f6b3dc3ef73a69c2d2dc9b3645946a8af2adf26457e892a749d03fb27fcac2e
- MD5 b02fd26e2351dc1faa6032fcadad29f0
- SHA1 e6a3ac3f833e96ebdbe80365561f1a022cf24386
- SHA512 f46a4e828b11d289322b88de6f1ad270203927ddaa582c0f0ccd8c0e9510d5d06f2a3655f964f0e44536734e706084d3aad9477309517ad534fb9a37788d8517
- SSDEEP 49152:HzOxwt9F+7FiB+cfRWkkjY5qUHj1FhW825PlJ0TJctF:H+w87XsWkkjaHjTo82Pb0cb
- TLSH T145D5120B669102F9E0BBD139CA454E55FBB6B81A0720D7CB03E456A22F237E15F7E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Port Monitors 1 TTPs 13 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Virtual Port Monitor spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Virtual Port Monitor\Ports spoolsv.exe - Drops file in System32 directory 22 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\SETECB7.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\SETECA4.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\SETECA5.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\SETECA5.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\SETECB6.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\SETECB6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\MPDW-manifest.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\SETECB8.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\SETECA3.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\prnms009.Inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\MPDW-pipelineconfig.xml DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\MPDW-PDC.xml DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\SETECB7.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\SETECA3.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\MPDW_devmode_map.xml DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\SETECA4.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\prnms009.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\SETECB8.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\SETECB9.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\SETECB9.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{97fbae5d-8b2a-054e-9597-926142b475f2}\MPDW-constraints.js DrvInst.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log spoolsv.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe - Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID spoolsv.exe - Modifies data under HKEY_USERS 12 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45" spoolsv.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:" spoolsv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45" spoolsv.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1480 2026-09-30_b02fd26e2351dc1faa6032fcadad29f0_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe 1480 2026-09-30_b02fd26e2351dc1faa6032fcadad29f0_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_b02fd26e2351dc1faa6032fcadad29f0_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_b02fd26e2351dc1faa6032fcadad29f0_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1480
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
- Boot or Logon Autostart Execution: Port Monitors
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2944
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "d" "C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf" "9" "43057df13" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "C:\Windows\system32\spool\tools\Microsoft Print To PDF"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:5440