78b17715fd29a4236d24876053cf14f33e9350b628f3f2087379b311cfa4d567

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-10_f8e7279cf714c50c4432bfea5a6b872f_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 2.6MB
Sample261110-e31p6ayzcz
SHA256 78b17715fd29a4236d24876053cf14f33e9350b628f3f2087379b311cfa4d567
MD5 f8e7279cf714c50c4432bfea5a6b872f
SHA1 bbe2361c868d86420136e65a1acfb0e8d9a865d1
SHA512 3d7b8161e07a9aec780daa3d13133353e61aafa521014044cad251d399cf7ec6a876deddc9e636503873d50ef2594c1630eacec86229f3c279ebbbf1ee8e08c5
SSDEEP 49152:2tMzLAVStcdiT7FoR2A0W1+7x3+YCcZc+cB/6tO+J7:2tq5cdGFoR2y1+7x3tCcZc+clw
TLSH
T1D5C5D00BB39A02F9D4779934C956E307E375BC651B209AEF23D40E666F9B1E01D3A702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4376	Phantom Fivem.exe
3700	PhantomNew.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PhantomNew.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PhantomNew.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-10_f8e7279cf714c50c4432bfea5a6b872f_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4376	5080	2026-11-10_f8e7279cf714c50c4432bfea5a6b872f_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe	90
PID 5080 wrote to memory of 3700	5080	2026-11-10_f8e7279cf714c50c4432bfea5a6b872f_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe	92
PID 3700 wrote to memory of 6056	3700	PhantomNew.exe	93
PID 3700 wrote to memory of 6056	3700	PhantomNew.exe	93
PID 3700 wrote to memory of 6056	3700	PhantomNew.exe	93
PID 3700 wrote to memory of 6056	3700	PhantomNew.exe	93
PID 3700 wrote to memory of 6056	3700	PhantomNew.exe	93
PID 3700 wrote to memory of 6056	3700	PhantomNew.exe	93
PID 3700 wrote to memory of 6056	3700	PhantomNew.exe	93
PID 3700 wrote to memory of 6056	3700	PhantomNew.exe	93
PID 3700 wrote to memory of 6056	3700	PhantomNew.exe	93
PID 3700 wrote to memory of 6056	3700	PhantomNew.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-11-10_f8e7279cf714c50c4432bfea5a6b872f_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-10_f8e7279cf714c50c4432bfea5a6b872f_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\Temp\Phantom Fivem.exe
  "C:\Users\Admin\AppData\Local\Temp\Phantom Fivem.exe"
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Users\Admin\AppData\Local\Temp\PhantomNew.exe
  "C:\Users\Admin\AppData\Local\Temp\PhantomNew.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\System32\cttunesvr.exe
    "C:\Windows\System32\cttunesvr.exe"
    3⤵
    PID:6056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
Size 355B
SHA256 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
MD5 53ae64e9ee4ba962ee4b516077735710
SHA1 dae8a6fd15a9c447cdb2778f63880db25b0dd198
SHA512 ec31df0d1fbf225bc5a884ee8324aab6e2aa43031bede210b04677ed825966c8ebc0693b06d8f0e55de2cd5919b95a7b25691b6ae1fab893f58756e08836a168
TLSH
T1BFE0C08867AC24200AB19E539550C4936FBE31892970B05C8251CBED30C1A58C28B30F
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 283B
SHA256 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
MD5 7f9d3dc54f928bf6c38576705ad18203
SHA1 2b5e33e5301753684973bfddbc6cfb11d297cf90
SHA512 ef5b01e74a5e49cd0fe887b9d92d830e1052bd93cda7d11ee68829705432a21a9943535de8dff9d77eb3402253adf9d5760eda03ca80a0c3495f83396d648967
TLSH
T102D0C29CA9273E660FE69B454A50C087AEE610CA9C15B648008EC45B0887B02EA962AE
MD5 SHA1 SHA512 TLSH

Submit Download

4B6CE403D7DDB9F8EF953DF96C445B05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4B6CE403D7DDB9F8EF953DF96C445B05
Size 100KB
SHA256 13d91ab66d0fb2d7897833c453927008536ca841b09b0f25daf1c4137953a7f3
MD5 5034edbb84cd08101992bd3656518d42
SHA1 8bc597f36f5b2ece6ca0ea6eeff0116053efa2eb
SHA512 918424b2a3fe1385da23b39e79857d958212b80d9174a94292b035ca8f4ad56744c465aad2b79eeaab1b41a74ba8161e7db58b49d9c8f69ef5aab5646766067f
SSDEEP 1536:Xezk+tZr+INMLvZkl2mGSFf57oeTlvyVgCvfrjuGW1KEq:XezhiIemGSRhZlK1vnup7q
TLSH
T12FA39098DDA6F8977986AC61DCC75DB389F22D563383962F49A05FC41C1BBCB8DA10C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 4ebd93359c131a81a7e19048fba977cb9538846e03fd9edee138da2f0c7b7277
MD5 dcb1e4b0bc4700a578b739a7bfecebc5
SHA1 bf783dd4240fb37306d99b8bac7d8ced6649fbf9
SHA512 f3a2ee64351f79e5ee59c1d3a05d640706f2dce06ac8e5ece3695f4ca05dc77d4541b9841a8e9b5954eb666ef22c6979d0c97e81b803e6cf6483d374c3796fab
TLSH
T1B5C08C1C9AA20A06F2A8437D02C139039B208602E6418F051AF16A08CA9AB166C38D6A
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Size 192B
SHA256 1614306f429c52f88a898b12df1bde09e648b58f7106a3903a9da125cd3971ff
MD5 7a07935ea17976791da934fb880f73e8
SHA1 b6ff807ddce66d1c78180a5f852e0f4b6e00aa80
SHA512 2f1977dbbc296d58cac28ce3ae4d265e909b4e84918063be7e2da3ccb7a87acfab7bc01bc1e08fd1ee525a19ef9cf0d9592ead6da4f28612d1ba970c933cd63c
TLSH
T1E7C08C1C4A620606F2E4437D02C12D039B218821F2468F0116B17A18CD29F902C38C28
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 192B
SHA256 7d2ca079ce89185babc73e07fd503ccadb208ac4f2d6c1c980b5746b6ac79888
MD5 141d81b365f1c1db85e8758a2d2d5cf2
SHA1 278d43dd4952a19b4fb3da6615c391436697b7e1
SHA512 6d36171cc759e2184600b0616b90cff58083b882e1b804bcc547eea0805217e6568daa52f241f948de06b4d43dc8e4ca3afda1d0c0dab0f18cb5f72718131549
TLSH
T1F4C08C181BA60A06F2E80BBE22D12A839A14D401F3818F4A263A2A488D15B541C30C1C
MD5 SHA1 SHA512 TLSH

Submit Download

4B6CE403D7DDB9F8EF953DF96C445B05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4B6CE403D7DDB9F8EF953DF96C445B05
Size 246B
SHA256 cba54bb4aaf2562d548b1164519db48058db041f0819fb49dab34a8a147b584a
MD5 24f3e990c77b5a1618981ebc6da095b5
SHA1 3c8a9d3f8ce03f7b14a460dfe4523a0baea7c60d
SHA512 100392dd79cb60632071c7066ab792d5ed428c65899b76baaf88fe99f5885b35c31802eada1970ceea23630d4c6c03bcf2cf0fc1a99d36cd8e7364c0ddb0ffc8
TLSH
T129D012091BBA0222F1608B3599765D939A25AA0AB191470D0FB386A9CC5FF951C21C3D
MD5 SHA1 SHA512 TLSH

Submit Download

Phantom Fivem.exe

Path C:\Users\Admin\AppData\Local\Temp\Phantom Fivem.exe
Size 1.4MB
SHA256 021f53c2328113f02db282d7bde017efcf807b1021173e497c06711a15d7f98f
MD5 8b923746242130bc39f9566cf8ab60dc
SHA1 430ef7824759dc2295eb6cc5591bf2558c71e350
SHA512 981a338cdb8ee7fa15fcec8e10e2abb21af0eb653f15c0cec041144c9bedb9df4af513605c3533b815e981023b0c76eb804f0adc4d63be846baf22b7f69d6c7b
SSDEEP 24576:iJgvkMzSYAM9YSlbczEpQizfmQDc06WogeOfQr0W:itMzLAVStcdiT7FoR2A0W
TLSH
T11A65AE0F735A03E9D4B68934DA96E317E37578601B2086EF67D40F56AF9F2E0193A702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhantomNew.exe

Path C:\Users\Admin\AppData\Local\Temp\PhantomNew.exe
Size 351KB
SHA256 8bfc95548ec5ec37abf7022dba84566154175df957e91406ef947a1949f40173
MD5 a57b3ad10589a58f2ee1ab34f4807e9e
SHA1 4b55ba737ff8a3c91741294b079315350d40ad97
SHA512 68801309825dda02c2e87f253c4074bf64dcc2f781e8420f8210327c32ae5a208e6a46457a52da7039499a270cc2990cbb38e92231a6d53f1b16b946b4bf856a
SSDEEP 6144:N9qmv+7x3OWB/mWirj70doczsko8aSuBJqT:NEc+7x3rB/TiDEzBla6
TLSH
T174747C15F7E904F9E677557CCD220502E772BC4A03A1ADEF23D04AB62E139E49A3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3700-19-0x00007FFB6D4C0000-0x00007FFB6D723000-memory.dmp

Download

memory/3700-49-0x0000022974610000-0x0000022974873000-memory.dmp

Download

memory/5080-17-0x0000000000400000-0x0000000000693000-memory.dmp

Download

memory/6056-46-0x0000027874AA0000-0x0000027874AEC000-memory.dmp

Download

memory/6056-53-0x0000027874AA0000-0x0000027874AEC000-memory.dmp

Download

memory/6056-51-0x00007FFB6D4C0000-0x00007FFB6D723000-memory.dmp

Download

memory/6056-44-0x0000027874AA0000-0x0000027874AEC000-memory.dmp

Download

memory/6056-45-0x0000027874AA0000-0x0000027874AEC000-memory.dmp

Download

memory/6056-41-0x0000027874AA0000-0x0000027874AEC000-memory.dmp

Download

memory/6056-47-0x0000027874AA0000-0x0000027874AEC000-memory.dmp

Download

memory/6056-43-0x0000027874AA0000-0x0000027874AEC000-memory.dmp

Download

memory/6056-42-0x0000027874AF0000-0x0000027874AF1000-memory.dmp

Download

memory/6056-63-0x0000027874AA0000-0x0000027874AEC000-memory.dmp

Download

memory/6056-86-0x0000027874AA0000-0x0000027874AEC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads