Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
17/04/2026, 04:49
General
- Target 2026-04-17_89faa5902802be6a557fabbf9db16eb4_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 23.2MB
- Sample260417-ff644afw5k
- SHA256 d77a3b3fc34bf31f5122af9b6faae7e3a2b5f2b71b9ea3968ebba4110f15fdcb
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_89faa5902802be6a557fabbf9db16eb4_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_89faa5902802be6a557fabbf9db16eb4_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Playstore For PC Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Playstore For PC Setup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoLogo -NoProfile -NonInteractive -Command "& { try { $ErrorActionPreference='SilentlyContinue'; . '"C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\.runner.ps1"'; } catch {} }"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp_Uffrdpt5HTyNIr\CDChFnO8EH.exe"C:\Users\Admin\AppData\Local\Temp\tmp_Uffrdpt5HTyNIr\CDChFnO8EH.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCFCE2718\BlueStacksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zSCFCE2718\BlueStacksInstaller.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCFCE2718\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zSCFCE2718\HD-CheckCpu.exe" --cmd checkHypervEnabled7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCFCE2718\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zSCFCE2718\HD-CheckCpu.exe" --cmd checkSSE47⤵
- Executes dropped EXE
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
backicon.png
checked_gray.png
close_red.png
custom.png
installer_bg.jpg
installer_logo.png
installer_minimize.png
loader.png
setpath.png
unchecked_gray.png
BlueStacksInstaller.exe
BlueStacksInstaller.exe.config
HD-CheckCpu.exe
JSON.dll
i18n.en-US.txt
ThemeFile
File.lnk
File.vbs
Playstore For PC Setup.exe
.runner.ps1
file1_info.json
c8IKkDXlNHft.part
uVV4N2E479RH.part
__PSScriptPolicyTest_wvygzeas.ujr.ps1
CDChFnO8EH.exe
memory/1504-94-0x000001A1E26C0000-0x000001A1E2882000-memory.dmp
memory/1504-92-0x000001A1E1FB0000-0x000001A1E1FD2000-memory.dmp
memory/1504-242-0x000001A1E2890000-0x000001A1E2A39000-memory.dmp
memory/1504-241-0x000001A1C9870000-0x000001A1C987C000-memory.dmp
memory/1504-96-0x000001A1E2DC0000-0x000001A1E32E8000-memory.dmp
memory/3324-243-0x00000000008C0000-0x0000000000956000-memory.dmp
memory/3548-84-0x0000024E79AD0000-0x0000024E79ADC000-memory.dmp
memory/4528-240-0x0000024F3DDD0000-0x0000024F3E242000-memory.dmp
memory/5284-234-0x000000001B5B0000-0x000000001B5BC000-memory.dmp
memory/5284-70-0x0000000000A30000-0x0000000000A3A000-memory.dmp
memory/5916-259-0x000000001F200000-0x000000001F20E000-memory.dmp
memory/5916-258-0x000000001F230000-0x000000001F268000-memory.dmp
memory/5916-244-0x0000000000EE0000-0x0000000000EEC000-memory.dmp
memory/5916-239-0x000000001B1D0000-0x000000001B238000-memory.dmp
memory/5916-237-0x00000000005B0000-0x000000000064A000-memory.dmp
memory/5916-269-0x000000001F270000-0x000000001F278000-memory.dmp