neshta | 81b4c90d8ca557028c39b5b1c765159baaa5413eec68d69816f39a1275162d7f

Analysis

max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
Size 4.2MB
Sample261102-ar2e4ay1f1
SHA256 81b4c90d8ca557028c39b5b1c765159baaa5413eec68d69816f39a1275162d7f
MD5 6e103ad7d5c7352d78d29b82ef62a19b
SHA1 0c2120f3bf5fcbc71dd7f6cae90d3100be1c86b7
SHA512 7a1d3c7ee5a0a1d005b3542ddbf14af1eaf809b66029fb6d1089d5eb5e6dfc25dab50d5844af9a248ccc94baabed43d652b22ca1eee9ba51e26b4817675c2b5e
SSDEEP 98304:ud50Hg7MdBRy+A5jHTECFIeepdDv7Wq+wnBGmboHoWQ:ud50Hg7MdBk1zECiCqPGmbGfQ
TLSH
T11626F17623B424B9C4BA46BAD5818132FF31764D332117E9CAA4952C7F3ADE429BF305
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery neshta persistence spyware stealer trojan

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Detect Neshta payload 5 IoCs

resource	yara_rule
behavioral1/files/0x000600000002027a-138.dat	family_neshta
behavioral1/memory/4180-365-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/4180-366-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/4180-367-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/4180-369-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe

Executes dropped EXE 2 IoCs

pid	Process
1784	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
1096	CoreBA.exe

Loads dropped DLL 3 IoCs

pid	Process
1096	CoreBA.exe
1096	CoreBA.exe
1096	CoreBA.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\ELEVAT~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\NOTIFI~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{5625B~1\WINDOW~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\pwahelper.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MIA062~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI9C33~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~3.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\PWAHEL~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\IDENTI~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~4.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI391D~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreBA.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreBA.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D	CoreBA.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D\Blob = 0f000000010000003000000009cc9211dbd405f0eb21b2fe598b2439893f4c3d478888adf01431a8b1fb66bd524266fc4e875f022623e69fcb4dd9be0b000000010000004a0000005300650063007400690067006f0020005000750062006c0069006300200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400360000006200000001000000200000007e76260ae69a55d3f060b0fd18b2a8c01443c87b60791030c9fa0b0585101a3814000000010000001400000032eb929aff3596482f284042702036915c1785e61d0000000100000010000000b57b5c441b8ef4866b6f8f43ff6e45f609000000010000000c000000300a06082b06010505070303030000000100000014000000ccbbf9e1485af63ce47abf8e9e648c2504fc319d20000000010000007c0500003082057830820360a00302010202104b2c3b01018bad2abc8c7b5b3eed9057300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a3056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a02820201008de79412220424742eff162302928ab6ae3685ac47d423912b3edc7de231a0516fac8491e3528ab5e296ded0876324898affef12933b7dbbb68abdbd057f279b6b65d3a50c69b1bc49399af16d6eaae4a08327da9a0d2b50e94b5bb3b86436a47e4a3da971ab61b373b33c0b0cefdb3357e5be3437e3971b5dfd1f123d820376e6fb3f66d2943169fa6db334acc17a78dc9250f264c7aa2d04abc36aeae02fa7a7dc6ed7e8ffda21ab40bfb9ee0d9ec6d99e99efc6de1fa90c76b32720a1d6bafd80e701d2efeb822995708dffbb15cffed10f36a22e4f329074466b4735137705334f632eb82de1bf65a7046b18d871facc08f26d899910b1addb3e2ce4aa18b0c607017567de6de963631e367f6989beaa453e6e5a5f8fa15bcb9d308630e803b340c60d0f38cd67a85388fab83065fa6fc7e71db18374693eacc4683bb1e667339ab608e080054840eef6826446a8f573b00695f26c659fbf555b1c9c571ac778467c70aa941b8217ac87e9b6c90e811c40d6161729fc5c9c182bea45f5efbdd5674f285e05ee904c7ae7c6f4d0fcfacd3e32461320368a04eab7aa07469c0d933a096699585c29a3b90ca630383cd04636357c9cbaeec3d5f90a76fa7e051b40ca9235e9d57ad1b57f00aea990aac57f019c10b116fccc6e18dc6f62fea650a7b87bb89d153ffe200c75c8225a1395199000e91ad5c286f1e38eec5ff4e50203010001a3423040301d0603551d0e0416041432eb929aff3596482f284042702036915c1785e6300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201007665c2e3d7224ad71d895eff695ec614024d73a6cdcd28cab037eabfa7c921aaaa5fdabff6836cd080d10a5c00a4cbf3cc390f9e417188d53ce88a7b8c1723f7ca3474916c06ae503f0059b2263c3c178357033e2dd11a3dd4cf0754b2430b5272a888f5c417f26fd158a5d168e43d980818ee36f448489afa5470f088d47016304249d0d93f754b4571d8aea2bb610e88855057b9ba112b36291f8f20729e5c9e89d182da458d6a99da84716b33a510bb79f097f67481a03f57c7868c308c0e3895ae01c61eabdca81f6f2fd7ff761eae17736de5b975b36106a89533c24e6fb237f295be855412b9c8bd624276f72afcf53731032657fed1e6dbf0160272838c08b384aca9e407f8a188c4135a50475442a6edd041342c98b13ea234a10c5dbdacf77f79a7bf6d0c5632851b4b97b8e1ace4a43c71f1a3e14e63d6f446baf50b08e1633ceda2592f0ad42c6b23a29ea14deed112cd183350ed416ecb7f3d41600b630b78f575ef4315b7360b10afdc5c18a998d936d91dd884b3068a82e37b1b24a742ceee0f3e565c327dec4bde562b3b3bbaf97a58d051b66cd6f658a252247a4486a11c603f49d3fcfaf9841c05c234bfe2e6f1192a992f5657359cb5f507c3462fde383d190dfba3f1df139ee7a9725831afbdeadad7d66d7733338ef4acfdc1bf4987d27005677406a6f678402d1604910f1fd316c4b87a170d24c9b2	CoreBA.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D\Blob = 1900000001000000100000000e8c3d8a006eb5c23a7725464ad10a8c030000000100000014000000ccbbf9e1485af63ce47abf8e9e648c2504fc319d09000000010000000c000000300a06082b060105050703031d0000000100000010000000b57b5c441b8ef4866b6f8f43ff6e45f614000000010000001400000032eb929aff3596482f284042702036915c1785e66200000001000000200000007e76260ae69a55d3f060b0fd18b2a8c01443c87b60791030c9fa0b0585101a380b000000010000004a0000005300650063007400690067006f0020005000750062006c0069006300200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400360000000f000000010000003000000009cc9211dbd405f0eb21b2fe598b2439893f4c3d478888adf01431a8b1fb66bd524266fc4e875f022623e69fcb4dd9be20000000010000007c0500003082057830820360a00302010202104b2c3b01018bad2abc8c7b5b3eed9057300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a3056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a02820201008de79412220424742eff162302928ab6ae3685ac47d423912b3edc7de231a0516fac8491e3528ab5e296ded0876324898affef12933b7dbbb68abdbd057f279b6b65d3a50c69b1bc49399af16d6eaae4a08327da9a0d2b50e94b5bb3b86436a47e4a3da971ab61b373b33c0b0cefdb3357e5be3437e3971b5dfd1f123d820376e6fb3f66d2943169fa6db334acc17a78dc9250f264c7aa2d04abc36aeae02fa7a7dc6ed7e8ffda21ab40bfb9ee0d9ec6d99e99efc6de1fa90c76b32720a1d6bafd80e701d2efeb822995708dffbb15cffed10f36a22e4f329074466b4735137705334f632eb82de1bf65a7046b18d871facc08f26d899910b1addb3e2ce4aa18b0c607017567de6de963631e367f6989beaa453e6e5a5f8fa15bcb9d308630e803b340c60d0f38cd67a85388fab83065fa6fc7e71db18374693eacc4683bb1e667339ab608e080054840eef6826446a8f573b00695f26c659fbf555b1c9c571ac778467c70aa941b8217ac87e9b6c90e811c40d6161729fc5c9c182bea45f5efbdd5674f285e05ee904c7ae7c6f4d0fcfacd3e32461320368a04eab7aa07469c0d933a096699585c29a3b90ca630383cd04636357c9cbaeec3d5f90a76fa7e051b40ca9235e9d57ad1b57f00aea990aac57f019c10b116fccc6e18dc6f62fea650a7b87bb89d153ffe200c75c8225a1395199000e91ad5c286f1e38eec5ff4e50203010001a3423040301d0603551d0e0416041432eb929aff3596482f284042702036915c1785e6300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201007665c2e3d7224ad71d895eff695ec614024d73a6cdcd28cab037eabfa7c921aaaa5fdabff6836cd080d10a5c00a4cbf3cc390f9e417188d53ce88a7b8c1723f7ca3474916c06ae503f0059b2263c3c178357033e2dd11a3dd4cf0754b2430b5272a888f5c417f26fd158a5d168e43d980818ee36f448489afa5470f088d47016304249d0d93f754b4571d8aea2bb610e88855057b9ba112b36291f8f20729e5c9e89d182da458d6a99da84716b33a510bb79f097f67481a03f57c7868c308c0e3895ae01c61eabdca81f6f2fd7ff761eae17736de5b975b36106a89533c24e6fb237f295be855412b9c8bd624276f72afcf53731032657fed1e6dbf0160272838c08b384aca9e407f8a188c4135a50475442a6edd041342c98b13ea234a10c5dbdacf77f79a7bf6d0c5632851b4b97b8e1ace4a43c71f1a3e14e63d6f446baf50b08e1633ceda2592f0ad42c6b23a29ea14deed112cd183350ed416ecb7f3d41600b630b78f575ef4315b7360b10afdc5c18a998d936d91dd884b3068a82e37b1b24a742ceee0f3e565c327dec4bde562b3b3bbaf97a58d051b66cd6f658a252247a4486a11c603f49d3fcfaf9841c05c234bfe2e6f1192a992f5657359cb5f507c3462fde383d190dfba3f1df139ee7a9725831afbdeadad7d66d7733338ef4acfdc1bf4987d27005677406a6f678402d1604910f1fd316c4b87a170d24c9b2	CoreBA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	CoreBA.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b553000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e1d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd20f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b00000001000000100000005300650063007400690067006f0000002000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	CoreBA.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c0000000100000004000000001000000b00000001000000100000005300650063007400690067006f000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	CoreBA.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 1784	4180	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe	84
PID 1784 wrote to memory of 1096	1784	2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\TEMP\{DA781E96-6C62-4468-81C0-B520FE78D6D9}\.ba\CoreBA.exe
    "C:\Windows\TEMP\{DA781E96-6C62-4468-81C0-B520FE78D6D9}\.ba\CoreBA.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{A5751080-919B-4DD1-ACE3-AC344547C3AE} {4E31CCB4-7683-4A32-A66B-6008FFDFF486}
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Modifies system certificate store
    PID:1096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Size 2.4MB
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427
SSDEEP 49152:oTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:oTfiG/nzU90T
TLSH
T179C59226A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-31_6e103ad7d5c7352d78d29b82ef62a19b_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_vidar.exe
Size 4.2MB
SHA256 a58374ba8868696f1b2b585a6a29dd0af850512e6fe53afe267ded53eb68afd2
MD5 26937495b92961901ec937f292a42cea
SHA1 3d047db0805bd2b7f48610025b3125d24bf4dfd9
SHA512 ef1da19dafb4b271ae17e1ba219152c083d54947737d1d30fc94810567204d3b0879acd72588744e0076a4511c0cfb7656ffedbacc7e3e407e274df51560fdea
SSDEEP 98304:0d50Hg7MdBRy+A5jHTECFIeepdDv7Wq+wnBGmboHoWA:0d50Hg7MdBk1zECiCqPGmbGfA
TLSH
T14F16F17623B420F9C4BA46BAD5818132FF71754E332117E9CAA4952C7F3ADA429BF305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{DA781E96-6C62-4468-81C0-B520FE78D6D9}\.ba\BootstrapperApplicationData.xml
Size 13KB
SHA256 a48e1fe3921bb3c6496c6d4d1a8e8551e53fbb4f9f33afd3a8ffb15835ccee17
MD5 6187669087555518f0f4afe7ecbc0805
SHA1 4aedd9453371d2432792f5bc7314475e354e90b5
SHA512 774115338257994eaa8a18e41a87f6631703306d5eceacd5af67611f8cea357baf8af92c0fb66579a1cdaffc70d8c44c4877af6887c6340c6fbcec4ccdb41ef4
SSDEEP 192:WPDyotE8/H9ZjtRSAOdmLAdGQpazjOBWXP2ownPBuhkrsxI+THtQeOZEDc39wIGI:W4ZhStW
TLSH
T14952A5593BFD0118F0F38F48EAB955955B79BCA12A38C85D01602D0E4DB3E429962FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BundleDefinition.xml

Path C:\Windows\TEMP\{DA781E96-6C62-4468-81C0-B520FE78D6D9}\.ba\BundleDefinition.xml
Size 6KB
SHA256 9fd9e22b990dd99314e0dac88154a77961bb0a62fcf647e18e19183babd96c40
MD5 59b5222c74e9daeaeae57b8de8789d59
SHA1 a410ec3e6d21958266564cf2343891181f1834bd
SHA512 b4a323d738082bf0fc86ca54b533689327441e53b7e8f5acbdeb8f1913c08a4a149740fc46780177a35cb7cbd4f387a9005c71e15cd6811929a691ea20276ed1
SSDEEP 96:jf6JngcpZTbikiKbsnfcoBUbn6HdCKyQxGVEIPY5iAphG0f/iOkeEc:Nj02nh3ibeEc
TLSH
T1CFD13B67DECBF4676B2E9369BD13D64A9C3480DB10196782B09D52071F3F03BA193A93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonUtils.dll

Path C:\Windows\TEMP\{DA781E96-6C62-4468-81C0-B520FE78D6D9}\.ba\CommonUtils.dll
Size 163KB
SHA256 9f2d458ecd533271494e3767cde8fac96b10b1b69b686d01bd01bd69b669233f
MD5 b6510ad9d8bffc52576653019d34644b
SHA1 6a189d2a1381d657d237fb39ff90b69d2e1b27ef
SHA512 3868df02605059e0ed652016bd21113fac7fafbfcf2df2b8afc164c03b3158ef69ff6d34f94835b5a9c5acbf6b089dcf6b07841415d961a5cb90c0e49b1d7d5c
SSDEEP 3072:ldRkJMqHe4LzxKHqi46A1PsJ6YXTOjhhClUkoelUhkJK2QLt:VkJTeixKKrtuO8UJOJSLt
TLSH
T151F36C41B3E89A95E4FF0B7A787449120FB5F687E931D7AE17809C7D186370189A03BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BundleDefinitionSchema.xsd

Path C:\Windows\TEMP\{DA781E96-6C62-4468-81C0-B520FE78D6D9}\.ba\Config\Data\Schema\BundleDefinitionSchema.xsd
Size 12KB
SHA256 4e1713b6691a1c0842240c3b783f97e06f2cf8a31be8a9e8ca44f9d9587f2976
MD5 ff590a29b95670711081119a0e8aee15
SHA1 5ee8eee2724c199bfd62029542c0c18d84c51b66
SHA512 27d512e7bc050603e55deb451e65b7eb3bdf2bcc2691e5a30c98eaedc7e0a99e2ceb044dfa05511d82a8b48aeedc3c0f9afb998fe19da3e0682b5892e39535ac
SSDEEP 192:8oDpnZTDpuDUpbvDLDpLSH4n70VtOlZr5cS/yycFpTL+Y47LP:8ob1prH7VEeF
TLSH
T1514229DA71C0DE1A0D3B45748682390DEF15913303A42EB0F4DCB3779F7AA458A6B2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreBA.exe

Path C:\Windows\TEMP\{DA781E96-6C62-4468-81C0-B520FE78D6D9}\.ba\CoreBA.exe
Size 798KB
SHA256 e108a411bf730eca6396c75f060917ae39dbb4226c2ed048516ba50add6c2334
MD5 ea5059b2de70a12a636b9c2295751ee9
SHA1 a0fec00658fa975d161f2be6aec0dd84657480d8
SHA512 8e5114b53c39d4f3e1a028dfc2925f4b39f321ffeef08d8940c883017bd54ea989872e78958ff9a9c78267b600ada60e9be592cef36e6f613a70713652122086
SSDEEP 24576:+oWN4knsfkxE8o3ppl4h+D0dxHK9CD0dD:oKFkxToZoAgdxHK1
TLSH
T16705D01167EC4069F5BB5B34BAB584004BFAF9575931C27E380C3C9E6BA3B829522773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BundleSettingsSchema.xsd

Path C:\Windows\TEMP\{DA781E96-6C62-4468-81C0-B520FE78D6D9}\.ba\Core\CustomBAConfig\Data\Schema\BundleSettingsSchema.xsd
Size 2KB
SHA256 2b531e8eff92ada9ed484349c8edc403165f9f1c5d0c763e9c20f1d0cef277ec
MD5 3543268dbbea7ca61a1a6661d7b22b15
SHA1 e12acb66190c96dcdfe67fc458c070b9ea8c7861
SHA512 6add5d61f4a684c4a67c136f133367943296808f427940751e41a9439ca751eda5627db93ac319af37aafad6e5e169ee3502f746c478e3c97625e2ea1f04d55c
TLSH
T10D4125CA35C1DA050A3B0935A692270DFF99323302E82CB1F9CC5763AF759C212A72B4
MD5 SHA1 SHA512 TLSH

Submit Download

CoreBA_en-us.xml

Path C:\Windows\TEMP\{DA781E96-6C62-4468-81C0-B520FE78D6D9}\.ba\Core\Localization\Data\LocalizationXml\CoreBA_en-us.xml
Size 13KB
SHA256 6010c8befa765bc5c6bb41b5f42264c62344b6fc23b102c3eb79a56b7e0b5af9
MD5 efe0b2b898778cf32372298074a3111c
SHA1 99c35bc09b8959985875754e6e1311f6a8eb1859
SHA512 309b671ff47277e5bc23625a7a3945fa55cb1f37c296561a5c334343bac9c362c031b7200e341805055e31d5d4fbee02ab19ca887159e54f78c1d2a930ff81bb
SSDEEP 192:vbhUQvSLrvCKnfVnwn2KRHjRhsDEMtUhNfvMmo7mzBTXvWOJbcV+VV:DuQvSLrvVVROjvelUhNfvT28x/ltr
TLSH
T149526D1E7B9A53D128722269DA9504BA591940BF433306F5FD97712BCF6AC224373F83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizationSchema.xsd

Path C:\Windows\TEMP\{DA781E96-6C62-4468-81C0-B520FE78D6D9}\.ba\Core\Localization\Data\Schema\LocalizationSchema.xsd
Size 1KB
SHA256 04b5877bb219d308b4700db36c894b9e3dbd2b34978868c9bbcc27d0be7b3bd0
MD5 5b229e7af30dc2425806de351aded129
SHA1 4c349460f77ce7c5309e7365c20fafb6ba9f3f2a
SHA512 7d9e342579af8c6ed87003df69ed0ba8ebf9135b9e825f3cf7285fd3daebfca3b45e4e57da26da9d0243c57e7a2fba94b05f19e90e44f75ac8a12064235c886e
TLSH
T1291148E670C1CA054E3AC972AAD13509EF55A17B03A42EE0F8CC93A75B755C306673B4
MD5 SHA1 SHA512 TLSH

Submit Download

IDK.Common.dll

Path C:\Windows\TEMP\{DA781E96-6C62-4468-81C0-B520FE78D6D9}\.ba\IDK.Common.dll
Size 43KB
SHA256 94dc7f9deb6cfcd562824928496ea4b669b0e7a255c516c6aa47b0abdf5dbaa8
MD5 c29cf8c157b7b56176adf0a6866a8f57
SHA1 8eb183ca1b3bebc04a2a8d2dece64fb45b6e7742
SHA512 804c075e394e8ed87ed71e44248a7315188aa25297d6f6327b5df38802ab91d02613e10fedddb50c85ebf6f922d47d011170336773d0f23f857f2fb8fbb308be
SSDEEP 768:X3blqlHXAr9umnY/UcQRhuKMLmqXsFLBFXFAtU5FETHOjuYlFVFWFDboggMXbozI:HRrOmHSXbo/et
TLSH
T147134B0923B55164CAE68FBAF9F3851109F3FA993913D5AD5DD280CD2D6DB83320293B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WirelessBundle_en-US.xml

Path C:\Windows\TEMP\{DA781E96-6C62-4468-81C0-B520FE78D6D9}\.ba\Localization\WirelessBundle_en-US.xml
Size 1KB
SHA256 7d55bcc9db03b82b04bbb745cfe11026bd526a49c4b4edb5c3b7b2cc7e7133fa
MD5 a8a6e37fb065cee0791d3de5a6e62d6b
SHA1 9db64dc2e1b783d9b3f2a69e1b56a5f3cb096117
SHA512 9a153621468dc8f558c223d99a0cd25004162400016fd1a18ccc70caf0fa0d79e2098d0fb9791b0e07d2a32d16b7d3a0629f1fb3931d22b41f8cb1ac8e200c09
TLSH
T1362178C67F676080163BA5329E6680A5A92F41DE51B516E0B848313EF3CA87A133AF65
MD5 SHA1 SHA512 TLSH

Submit Download

WixToolset.BootstrapperApplicationApi.dll

Path C:\Windows\TEMP\{DA781E96-6C62-4468-81C0-B520FE78D6D9}\.ba\WixToolset.BootstrapperApplicationApi.dll
Size 168KB
SHA256 afaeff3e1c543eb93dfe048de02fb932d8c864a3f2d3340de4dec4a3daf2c858
MD5 e838f3766485a48df018928b2c17378a
SHA1 6b8a9f09884022ccdf34db316f96b333dc8a97ea
SHA512 318ed441ed8a4f60544d27a40349f08ce6b081184203cd02c405e5df1a980e8dee3c0c7487c14b069e80663c3b9fe4320cabd1de9faf315618db33b822ac7efb
SSDEEP 3072:AyBmMtVxcKhL+N5KpjjV10d15g9clpLk9zwdGgJhu:AKFWK2oNjVe15gelpI9zwdGgu
TLSH
T102F3181543EA9173F387793EE0164B5386BAF98914A1F3A956219CFF2C337061921BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{DA781E96-6C62-4468-81C0-B520FE78D6D9}\.ba\EULA\de-de\license.rtf
Size 268KB
SHA256 718bd1bde02c13688f9b48455468982386ab74462face0fe32006ef2b5e93a32
MD5 071dbfa6642999d78abaedf237aa83f7
SHA1 6d6efe62173116665d2d1a69e91e6e3f1061a239
SHA512 97431e6ec5b94e4b24ed5bfb9fb4b9800ac2d1e1c867e3c73d1104f6cf52c8e563791a279d27d31ddad43c11b6ca4c4035d45cffa2830dbc299f3fcd809319d7
SSDEEP 768:rK8Hw4elzw4P764SIgW26vW8KDmGi62zHfIGWV6eWLKkmWiC2eIUYzpA9UCpWwY4:rKc4t6VDfzigljxkg2JpgnQ/0tg
TLSH
T1B744D3BC188AE3D5F3ACD34AEC57F4CCEC3680603119C592636685AE509FD2C996D36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbanative.dll

Path C:\Windows\Temp\{DA781E96-6C62-4468-81C0-B520FE78D6D9}\.ba\mbanative.dll
Size 305KB
SHA256 e92d832d7bceee2356d2229b1bf3e041049ac49bd3147f788a4ed368caa4b982
MD5 eab8dd5bf7a4b455b939858ce1222b40
SHA1 6810c1e41c435935df0b969a9e22537c05d23853
SHA512 7e38f61d872cf42f2a4de94a6a8e7fae3e6f4c5011ddbf69d103a179aed8315a28e20544787e845b5aea747870e5d72572395e96b6206448ee7766569f94612a
SSDEEP 3072:7EMIIfKrJLIaeIjzDZYIwegry+nCfdO/JPETxlVk7yrRaczcpbZrDvnzALwzzoP:fLfeItKV4egry+jJsnVk7MaDnvkP
TLSH
T13D643B6422B414A9C5F956B9DAC2B122FFB0B54C230091DB83548E397F3FB9926BF345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-133-0x000002B4044F0000-0x000002B404500000-memory.dmp

Download

memory/1096-129-0x000002B404450000-0x000002B40447A000-memory.dmp

Download

memory/1096-130-0x000002B404420000-0x000002B404432000-memory.dmp

Download

memory/1096-132-0x000002B4043D0000-0x000002B4043DE000-memory.dmp

Download

memory/1096-125-0x000002B4044F0000-0x000002B404500000-memory.dmp

Download

memory/1096-120-0x000002B403F40000-0x000002B404008000-memory.dmp

Download

memory/1096-122-0x000002B4043E0000-0x000002B40440E000-memory.dmp

Download

memory/4180-365-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4180-366-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4180-367-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4180-369-0x0000000000400000-0x000000000041B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads