d1824018d49d5e36c6bc3486d8c46c01f53f7881f55c380818c70438f973aeb2

General

Target
2026-10-25_ba026de46d11ad39ec410cb677456005_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Size 1.2MB
Sample261026-rwv8baxtb1
SHA256 d1824018d49d5e36c6bc3486d8c46c01f53f7881f55c380818c70438f973aeb2
MD5 ba026de46d11ad39ec410cb677456005
SHA1 314a164482fa7607d4e45640c7e57e1cff0cb8b5
SHA512 c0e7e8b00017482f2acb36917b63da71e77968eb23bfda98a30bb81eef1756c9bf2a4c87932d5ebc3b11e887b06ea4465334b6b92d27e6456cf1a929dfcf16a6
SSDEEP 12288:7nd4bi5ZdbWmM/ywvnqGByjJ7LxWqYKAvh3WhiFLJDLUX9T/w55nYZM5Kdnm:J4bi5rbWmM6wfqGGJvxaZaW9WGPl4pm
TLSH
T1F855497722A430ABC4B54EFAF680C131FF29754D3321DE698955952E2F3ADA421BF306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{F5D98A7A-C2C6-4DC8-B371-E76199BF51AB} = "\"C:\\ProgramData\\Package Cache\\{F5D98A7A-C2C6-4DC8-B371-E76199BF51AB}\\MeshInspectorSetup.exe\" /burn.runonce"	MeshInspectorSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 4 IoCs

pid	Process
4656	wixprqba.exe
3164	wixiuiba.exe
1868	MeshInspectorSetup.exe
1752	wixprqba.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c1fdf03c8ae10a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380120c1fdf00000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410120c1fdf0000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e320c1fdf000000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e620c1fdf000000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{F5D98A7A-C2C6-4DC8-B371-E76199BF51AB}	MeshInspectorSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F5D98A7A-C2C6-4DC8-B371-E76199BF51AB}\ = "{F5D98A7A-C2C6-4DC8-B371-E76199BF51AB}"	MeshInspectorSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F5D98A7A-C2C6-4DC8-B371-E76199BF51AB}\Version = "2.5.9.275"	MeshInspectorSetup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F5D98A7A-C2C6-4DC8-B371-E76199BF51AB}\Dependents\{F5D98A7A-C2C6-4DC8-B371-E76199BF51AB}	MeshInspectorSetup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F5D98A7A-C2C6-4DC8-B371-E76199BF51AB}\Dependents	MeshInspectorSetup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F5D98A7A-C2C6-4DC8-B371-E76199BF51AB}	MeshInspectorSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F5D98A7A-C2C6-4DC8-B371-E76199BF51AB}\DisplayName = "MeshInspector"	MeshInspectorSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F5D98A7A-C2C6-4DC8-B371-E76199BF51AB}\Dependents\{F5D98A7A-C2C6-4DC8-B371-E76199BF51AB}	MeshInspectorSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F5D98A7A-C2C6-4DC8-B371-E76199BF51AB}\Dependents	MeshInspectorSetup.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeBackupPrivilege	2276	vssvc.exe
Token: SeRestorePrivilege	2276	vssvc.exe
Token: SeAuditPrivilege	2276	vssvc.exe
Token: SeBackupPrivilege	1868	MeshInspectorSetup.exe
Token: SeRestorePrivilege	1868	MeshInspectorSetup.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4656	4876	2026-10-25_ba026de46d11ad39ec410cb677456005_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe	89
PID 4876 wrote to memory of 3164	4876	2026-10-25_ba026de46d11ad39ec410cb677456005_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe	90
PID 4876 wrote to memory of 1868	4876	2026-10-25_ba026de46d11ad39ec410cb677456005_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe	91
PID 1868 wrote to memory of 6132	1868	MeshInspectorSetup.exe	96
PID 4876 wrote to memory of 1752	4876	2026-10-25_ba026de46d11ad39ec410cb677456005_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe	98

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-25_ba026de46d11ad39ec410cb677456005_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_ba026de46d11ad39ec410cb677456005_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\TEMP\{7C33E9B4-D51B-4303-B245-839EF7132A57}\.ba\wixprqba.exe
  "C:\Windows\TEMP\{7C33E9B4-D51B-4303-B245-839EF7132A57}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{F62A7ECC-9F00-4CEC-B23F-28566F0B0B0D} {2D061016-EE5C-423A-AB23-7C18012CD11B}
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\TEMP\{7C33E9B4-D51B-4303-B245-839EF7132A57}\.ba\wixiuiba.exe
  "C:\Windows\TEMP\{7C33E9B4-D51B-4303-B245-839EF7132A57}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{B4FA96D8-BBAC-4342-9656-5375CE0C686C} {F2413FB3-D869-459E-B30A-28F3C16AAAFE}
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\TEMP\{7C33E9B4-D51B-4303-B245-839EF7132A57}\.be\MeshInspectorSetup.exe
  "C:\Windows\TEMP\{7C33E9B4-D51B-4303-B245-839EF7132A57}\.be\MeshInspectorSetup.exe" -q -burn.elevated BurnPipe.{63BD74DB-E1D3-4FE4-A162-3804ECEC19AE} {641B182D-9C0E-46D7-952C-85FD30D17C2F} 4876
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    3⤵
    PID:6132
- C:\Windows\TEMP\{7C33E9B4-D51B-4303-B245-839EF7132A57}\.ba\wixprqba.exe
  "C:\Windows\TEMP\{7C33E9B4-D51B-4303-B245-839EF7132A57}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{0D7F39DD-605D-4CC6-B5D8-FD54F8604514} {84092C78-04CE-4552-A6E1-7FE5CA143EDB}
  2⤵
  - Executes dropped EXE
  PID:1752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{7C33E9B4-D51B-4303-B245-839EF7132A57}\.ba\BootstrapperApplicationData.xml
Size 3KB
SHA256 2586db5e5c45dcb6fefb310b89fbcca4a4f5a8188de841d03dfa1ebcd3884808
MD5 cc3080f3325994d5059cfccb67a4ec9c
SHA1 c1ce3f4fb80c86f6c53f734f2764c0ba16e19400
SHA512 541a4074de15f00a950c48997d764fe813503d45b1ffae7fef4a09fdda481e9f1ee6d8e2a997df77ac0ef6b35bae60f17377c48c8cdcfe32d14150239489f91f
TLSH
T1095182563BFD1148F0F39E88FAB665111A3ABD513E39C82C01651D0E49B2E81D872FA7
MD5 SHA1 SHA512 TLSH

Submit Download

wixpreq.png

Path C:\Windows\TEMP\{7C33E9B4-D51B-4303-B245-839EF7132A57}\.ba\wixpreq.png
Size 797B
SHA256 a401a225addaf89110b4b0f6e8cf94779e7c0640bcdd2d670ffcf05aab0dad03
MD5 a356956fd269567b8f4612a33802637b
SHA1 75ae41181581fd6376ca9ca88147011e48bf9a30
SHA512 a0f7836aefa1747f481c116f6b085f503b5c09b3a1dd97cd2189f7ce4e6e7ea98f1f66503cba2e6a83e873248cc7507328710dfa670aa5763df8aedcc560285e
TLSH
T17F0175D383499C97D6540AFB1980F040B3B748B62C47C56D5C594CAAE20B9845D7D791
MD5 SHA1 SHA512 TLSH

Submit Download

wixpreq.thm

Path C:\Windows\TEMP\{7C33E9B4-D51B-4303-B245-839EF7132A57}\.ba\wixpreq.thm
Size 4KB
SHA256 a00021ce3988e95b902e3e4b287a7e2e9bce19a1ad558e5fe62205bd0fe7bcf6
MD5 1c4965b72c531889a25d9c729bed2af6
SHA1 7d766cf77eb6e2e7010ea921cd068cfa9905dad7
SHA512 c336cd845c9dc2f02de7a16a98147bf98348e1d660e3dbddc3199c6928ecd5b954ba97ce340682d158556eaa4cad08184e99b650d593aba8d5723aafa8e92ebd
SSDEEP 48:czoubn4iTfjHaPHwSgtpmFPHwlSmntNPHnWbDPK6ZzQbdPHwmWo/OhyPK6Zz1esV:Ahf24NW4htN+bDdpQx4pojdpws4xM
TLSH
T1E3A169B94AEDBC05C132E71227F322C2BF516962C5C86A49F90D2AB75FF2150787726C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixpreq.wxl

Path C:\Windows\TEMP\{7C33E9B4-D51B-4303-B245-839EF7132A57}\.ba\wixpreq.wxl
Size 3KB
SHA256 e63ed75b5fbb09c9bd90c9a3f240d5cab8f514eca1803575684416b5305ddd5d
MD5 f00f6e7a3232b0da6e3d1e3ea8af97d4
SHA1 7f7f5c3701573828af53854f0545fa5a334b0063
SHA512 62252f1c68705be2cc74004dd5b167f53fc6829c63bbf8d8d163c6c79ee6cd8e58fcc5a85676a0030cc09bd020db5d524273b0ef4f3cf07fa93655abe26e1519
TLSH
T1BF6123AB79CFEBD06673B56471F7958A2408C1EA832B2DF1F86A4487476710013B3B63
MD5 SHA1 SHA512 TLSH

Submit Download

wixiuiba.exe

Path C:\Windows\Temp\{7C33E9B4-D51B-4303-B245-839EF7132A57}\.ba\wixiuiba.exe
Size 340KB
SHA256 6b8ca5e62cf0f63cd8787870f0036fd63fe126469e3c77e4fb98440de1510e46
MD5 cb04273856f51e9bc1ba628ecf5fcdf8
SHA1 daf97395877f6dd207bc170aaf712a71699c4f9c
SHA512 f3f760c3e8339c32ae303e9ea7adebecf2c17f492455d5efd2d4179a7de937110d5f688a6286f935e4f8007b66bcaa3312db7e46c9202776950d042b62781d1f
SSDEEP 6144:za+9SsDyAXr+YWOox48FQYHt/nq7zV23WkF:OGlDyuKYpox46N8TkF
TLSH
T18E744B7962B420E9C5FE4275D980B122FF70B95C230055AB93608A396F3F9953EBF349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixprqba.exe

Path C:\Windows\Temp\{7C33E9B4-D51B-4303-B245-839EF7132A57}\.ba\wixprqba.exe
Size 489KB
SHA256 45a7a9ced923a4ab43f3208f81c15aad1c5205e98abd3a4e87305b8dd0a737cd
MD5 3250472d74b2d7278ffa7ef18b44788d
SHA1 5fecd3de0a3bf4f82e25f787aa34daa1441ddcd4
SHA512 a1eee9b68ed81be89272e1cd13a2f1b828caf213748080d0a5e2ecebb1110ec687f787679ce4483e43bd70b53a48c1eaa170d8b2a65d91972fb435b1780648c4
SSDEEP 6144:7ORPifzrWXZTAaQTaMUOKioWbM3EGbi7hBgeLgorPuQt5YEdVyhN:7+PifATdQTaLKo6i1deLJPuQLWhN
TLSH
T130B45BBA22F421E9C5FA4275D981A121FF70B55C370091AF8214C93D6F3B9A939BF345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeshInspectorSetup.exe

Path C:\Windows\Temp\{7C33E9B4-D51B-4303-B245-839EF7132A57}\.be\MeshInspectorSetup.exe
Size 1.2MB
SHA256 d1824018d49d5e36c6bc3486d8c46c01f53f7881f55c380818c70438f973aeb2
MD5 ba026de46d11ad39ec410cb677456005
SHA1 314a164482fa7607d4e45640c7e57e1cff0cb8b5
SHA512 c0e7e8b00017482f2acb36917b63da71e77968eb23bfda98a30bb81eef1756c9bf2a4c87932d5ebc3b11e887b06ea4465334b6b92d27e6456cf1a929dfcf16a6
SSDEEP 12288:7nd4bi5ZdbWmM/ywvnqGByjJ7LxWqYKAvh3WhiFLJDLUX9T/w55nYZM5Kdnm:J4bi5rbWmM6wfqGGJvxaZaW9WGPl4pm
TLSH
T1F855497722A430ABC4B54EFAF680C131FF29754D3321DE698955952E2F3ADA421BF306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1868-31-0x00007FF7FEED0000-0x00007FF7FEFC8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads