f25fb0912d0695d2460336781af1a2c865d8f61664f2c1b7a19b149a5a353384

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_d8b96cb8fc0e9eb6b4a3615f3a38a8f1_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar.exe
Size 552KB
Sample261014-e6stqafw7v
SHA256 f25fb0912d0695d2460336781af1a2c865d8f61664f2c1b7a19b149a5a353384
MD5 d8b96cb8fc0e9eb6b4a3615f3a38a8f1
SHA1 4b68723cabef708ad96a99facaa3dce476cc5a21
SHA512 a944b2feb9fa48cb27d0c8342fa674a41f0d64daa49cce7d4b42701ae8eb3957352d25b4e09c932134be0a9448a6aeb5a333a18dc7d0dc145c2c84f40e1fe2e2
SSDEEP 6144:ivhKCHhjy7b0/W9hmXeq1eHgmuibVyCncVes4t4e8ERchOMJqhVZYtrowDYtShC:fCNy7WwO6j1bVyx418UMJ4EoftShC
TLSH
T13DC4BF06B6D004B5D0B7513889F35A62D77ABC5907619BCF23D00B6A6F33BD19E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\windows\system32\DriverStore\FileRepository\prnms003.inf_amd64_0e2452f597790e95\Amd64\PrintConfig.dll	2026-10-13_d8b96cb8fc0e9eb6b4a3615f3a38a8f1_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-13_d8b96cb8fc0e9eb6b4a3615f3a38a8f1_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2488	2026-10-13_d8b96cb8fc0e9eb6b4a3615f3a38a8f1_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar.exe
2488	2026-10-13_d8b96cb8fc0e9eb6b4a3615f3a38a8f1_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-13_d8b96cb8fc0e9eb6b4a3615f3a38a8f1_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_d8b96cb8fc0e9eb6b4a3615f3a38a8f1_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2488

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads