neshta | 1c4e9517f5cee31d186bc4ea989b9dd7658f3e2e2441f4e39dfbf9816fc150f6

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 21:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
Size 428KB
Sample261022-1arsfabe93
SHA256 1c4e9517f5cee31d186bc4ea989b9dd7658f3e2e2441f4e39dfbf9816fc150f6
MD5 74321eb7d7f371fe84df6a407f9486df
SHA1 6f62d62f7cd07f46969f9b5601c90f3871960841
SHA512 fe2ccf862258e340dfc115531f8a670ca38fe338dccd364f0b4020798aca09a785d085579adf8c427aa728ca65e202bf3496e9ad06fc6326377145e5c4eccb83
SSDEEP 6144:k9UWD50AsbgLK4i3s4Fw3beU1U80Sruh6u6vEHGLc:aD50AsgmpXFw3bL0Srjzq2c
TLSH
T199945B10F7A440F9E17786B8C9A58B55DB32FC151F219B8F33A05A8E2E336D09D39B91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neshta persistence spyware stealer

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Detect Neshta payload 5 IoCs

resource	yara_rule
behavioral2/files/0x00090000000188ff-11.dat	family_neshta
behavioral2/memory/4404-132-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4404-133-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4404-134-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4404-136-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Executes dropped EXE 1 IoCs

pid	Process
4136	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MID1AD~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~2.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\INSTAL~1\setup.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_proxy.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedgewebview2.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_helper.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~2.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_click_helper.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~3.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\pwahelper.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI9C33~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_pwa_launcher.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~4.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI391D~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 4136	4404	2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe"
  2⤵
  - Executes dropped EXE
  PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Size 2.4MB
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427
SSDEEP 49152:oTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:oTfiG/nzU90T
TLSH
T179C59226A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-21_74321eb7d7f371fe84df6a407f9486df_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
Size 387KB
SHA256 31ef6be666ce767cba5745571d9945c7f43a83b5d02c8b85873dad8ebbeda543
MD5 6366c6d13b67c6242ed034ce9376c8ea
SHA1 d9f1d17f05c9c0b92e41815c0a07988bc68185e4
SHA512 28d385f87acc150ce9d5b27ca98ae88091dcf878a92531004caa08a52b43accbc82d47249fa7729ad7da2a16d6cffb1a548744683250b531553e07e9b96a6904
SSDEEP 6144:TEHGL2WD50AsbgLK4i3s4Fw3beU1U80Sruh6u68:+2lD50AsgmpXFw3bL0Srjz8
TLSH
T132845B10F7A440E9E5778674C9A58B55DB32FC151F20DB4F33A06A8E2E336D09D3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4404-132-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4404-133-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4404-134-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4404-136-0x0000000000400000-0x000000000041B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads