Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/11/2026, 22:07
Behavioral task
behavioral1
Sample
2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe
- Size 5.7MB
- Sample261111-111s2acc67
- SHA256 7fa572c08a59a4f75d7a12f9043d1b9760ad8401b99d84c9bc729cc97102f7e3
- MD5 b85290699d9cd9be0ab1fb02181a1131
- SHA1 030249a4ab45afcdb142d8531441fd782aed4793
- SHA512 7ac3e8869e5704ad67d82679e2c7a11251fea6d5ee9031bf131ac830ccab8556b98b2618baec76280cb959368f711b17353c81d1d18591f82f111546f0841bf8
- SSDEEP 49152:bGkYw1BQCKMN7pXRKNnpBVsF4usuq2mSdbDUAsHpD+bsxctZE+OM2EsT/HBJJdMa:bGQ9Nn6VsFNKUbYZfgs0Qlxd
- TLSH T161566B117BE840F6E1B7D23489B6C6B6EAB6BC521D31DB0F0260C75E1F336919D29326
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Soulclose 5 IoCs
resource yara_rule behavioral1/memory/2916-0-0x0000000000400000-0x0000000000435000-memory.dmp family_soulclose behavioral1/files/0x0008000000024341-8.dat family_soulclose behavioral1/memory/432-11-0x0000000000400000-0x0000000000435000-memory.dmp family_soulclose behavioral1/memory/2916-14-0x0000000000400000-0x0000000000435000-memory.dmp family_soulclose behavioral1/memory/432-16-0x0000000000400000-0x0000000000435000-memory.dmp family_soulclose - Custom signatureUPX dump on OEP (original entry point) 5 IoCs
resource yara_rule behavioral1/memory/2916-0-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0008000000024341-8.dat UPX behavioral1/memory/432-11-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2916-14-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/432-16-0x0000000000400000-0x0000000000435000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 432 CCTV.exe - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf CCTV.exe File created C:\autorun.inf CCTV.exe File opened for modification F:\autorun.inf CCTV.exe File created F:\autorun.inf CCTV.exe -
resource yara_rule behavioral1/memory/2916-0-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0008000000024341-8.dat upx behavioral1/memory/432-11-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2916-14-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/432-16-0x0000000000400000-0x0000000000435000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe CCTV.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe CCTV.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe CCTV.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\java.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe CCTV.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe CCTV.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe CCTV.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE CCTV.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\CCTV.exe 2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe File opened for modification C:\Windows\CCTV.exe 2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe File opened for modification C:\Windows\CCTV.exe CCTV.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1388 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2916 2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe 432 CCTV.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2916 wrote to memory of 1388 2916 2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe 85 PID 2916 wrote to memory of 432 2916 2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadamkill.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1388
-
-
C:\Windows\CCTV.exeC:\Windows\CCTV.exe2⤵
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:432
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadamkill.bat
- Path C:\Users\Admin\AppData\Local\Temp\2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadamkill.bat
- Size 324B
- SHA256 3e1f91d6d85d8cb941106477d01a56e896812f03bfd5d1c244534ff2f55dafc9
- MD5 21890ac56eac6fc89e48887c8048b3c0
- SHA1 5130f812940c6c591f7e2c1e3300db4513760e11
- SHA512 2446ad3d8230a562b77bbafd6fb404ee16c6c1d6918d6460c39fe31fd92c456314c30cc7fce5955bf27e9cedc40cc5e628b20eb7e533155ad92fb6dce57ef97c
- TLSH T15FE0864550BECE74A480317706EA8926C85519F72B4516967311DADA61A619CB1A21A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\CCTV.exe
- Size 5.7MB
- SHA256 7fa572c08a59a4f75d7a12f9043d1b9760ad8401b99d84c9bc729cc97102f7e3
- MD5 b85290699d9cd9be0ab1fb02181a1131
- SHA1 030249a4ab45afcdb142d8531441fd782aed4793
- SHA512 7ac3e8869e5704ad67d82679e2c7a11251fea6d5ee9031bf131ac830ccab8556b98b2618baec76280cb959368f711b17353c81d1d18591f82f111546f0841bf8
- SSDEEP 49152:bGkYw1BQCKMN7pXRKNnpBVsF4usuq2mSdbDUAsHpD+bsxctZE+OM2EsT/HBJJdMa:bGQ9Nn6VsFNKUbYZfgs0Qlxd
- TLSH T161566B117BE840F6E1B7D23489B6C6B6EAB6BC521D31DB0F0260C75E1F336919D29326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\autorun.inf
- Size 26B
- SHA256 94f4f532c5d13217e9b0cf2706ea143cf51bfe83fbe62ba3c033469bbf83802f
- MD5 36812730603173b6ebe5cf22938e3e92
- SHA1 9b262a885e488c9e51b61a7a8d741225355b636d
- SHA512 6e2cf9a92ae462996b1ff6a6b202409178422afc0e5bb4794eb6ca4e8bda07f5fc8e5b143efcb7bf4cc08112c057ad3ae4a8d065cc7729757e22bc9c93da81fd
- MD5 SHA1 SHA512