Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/11/2026, 22:07
Behavioral task
behavioral1
Sample
2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe
- Size 5.7MB
- Sample261111-111s2acc67
- SHA256 7fa572c08a59a4f75d7a12f9043d1b9760ad8401b99d84c9bc729cc97102f7e3
- MD5 b85290699d9cd9be0ab1fb02181a1131
- SHA1 030249a4ab45afcdb142d8531441fd782aed4793
- SHA512 7ac3e8869e5704ad67d82679e2c7a11251fea6d5ee9031bf131ac830ccab8556b98b2618baec76280cb959368f711b17353c81d1d18591f82f111546f0841bf8
- SSDEEP 49152:bGkYw1BQCKMN7pXRKNnpBVsF4usuq2mSdbDUAsHpD+bsxctZE+OM2EsT/HBJJdMa:bGQ9Nn6VsFNKUbYZfgs0Qlxd
- TLSH T161566B117BE840F6E1B7D23489B6C6B6EAB6BC521D31DB0F0260C75E1F336919D29326
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Soulclose 4 IoCs
resource yara_rule behavioral2/memory/4948-0-0x0000000000400000-0x0000000000435000-memory.dmp family_soulclose behavioral2/files/0x001100000001c4ce-9.dat family_soulclose behavioral2/memory/4948-16-0x0000000000400000-0x0000000000435000-memory.dmp family_soulclose behavioral2/memory/1880-17-0x0000000000400000-0x0000000000435000-memory.dmp family_soulclose - Custom signatureUPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/4948-0-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x001100000001c4ce-9.dat UPX behavioral2/memory/4948-16-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/1880-17-0x0000000000400000-0x0000000000435000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 1880 CCTV.exe - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created F:\autorun.inf CCTV.exe File opened for modification C:\autorun.inf CCTV.exe File created C:\autorun.inf CCTV.exe File opened for modification F:\autorun.inf CCTV.exe -
resource yara_rule behavioral2/memory/4948-0-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x001100000001c4ce-9.dat upx behavioral2/memory/4948-16-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/1880-17-0x0000000000400000-0x0000000000435000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe CCTV.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe CCTV.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe CCTV.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe CCTV.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe CCTV.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe CCTV.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{C3C6D623-688C-4921-9E67-4817E803CB11}\MicrosoftEdge_X64_139.0.3405.125.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe CCTV.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe CCTV.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe CCTV.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe CCTV.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE CCTV.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe CCTV.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE CCTV.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe CCTV.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe CCTV.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe CCTV.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe CCTV.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe CCTV.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\CCTV.exe 2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe File opened for modification C:\Windows\CCTV.exe 2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe File opened for modification C:\Windows\CCTV.exe CCTV.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 120 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4948 2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe 1880 CCTV.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4948 wrote to memory of 120 4948 2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe 89 PID 4948 wrote to memory of 1880 4948 2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadam.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadamkill.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:120
-
-
C:\Windows\CCTV.exeC:\Windows\CCTV.exe2⤵
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1880
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadamkill.bat
- Path C:\Users\Admin\AppData\Local\Temp\2026-11-10_b85290699d9cd9be0ab1fb02181a1131_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rhadamkill.bat
- Size 324B
- SHA256 3e1f91d6d85d8cb941106477d01a56e896812f03bfd5d1c244534ff2f55dafc9
- MD5 21890ac56eac6fc89e48887c8048b3c0
- SHA1 5130f812940c6c591f7e2c1e3300db4513760e11
- SHA512 2446ad3d8230a562b77bbafd6fb404ee16c6c1d6918d6460c39fe31fd92c456314c30cc7fce5955bf27e9cedc40cc5e628b20eb7e533155ad92fb6dce57ef97c
- TLSH T15FE0864550BECE74A480317706EA8926C85519F72B4516967311DADA61A619CB1A21A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\CCTV.exe
- Size 5.7MB
- SHA256 7fa572c08a59a4f75d7a12f9043d1b9760ad8401b99d84c9bc729cc97102f7e3
- MD5 b85290699d9cd9be0ab1fb02181a1131
- SHA1 030249a4ab45afcdb142d8531441fd782aed4793
- SHA512 7ac3e8869e5704ad67d82679e2c7a11251fea6d5ee9031bf131ac830ccab8556b98b2618baec76280cb959368f711b17353c81d1d18591f82f111546f0841bf8
- SSDEEP 49152:bGkYw1BQCKMN7pXRKNnpBVsF4usuq2mSdbDUAsHpD+bsxctZE+OM2EsT/HBJJdMa:bGQ9Nn6VsFNKUbYZfgs0Qlxd
- TLSH T161566B117BE840F6E1B7D23489B6C6B6EAB6BC521D31DB0F0260C75E1F336919D29326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\autorun.inf
- Size 26B
- SHA256 94f4f532c5d13217e9b0cf2706ea143cf51bfe83fbe62ba3c033469bbf83802f
- MD5 36812730603173b6ebe5cf22938e3e92
- SHA1 9b262a885e488c9e51b61a7a8d741225355b636d
- SHA512 6e2cf9a92ae462996b1ff6a6b202409178422afc0e5bb4794eb6ca4e8bda07f5fc8e5b143efcb7bf4cc08112c057ad3ae4a8d065cc7729757e22bc9c93da81fd
- MD5 SHA1 SHA512