Overview

overview

8

Static

static

5

2026-04-20...at.exe

windows10-2004-x64

8

2026-04-20...at.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/04/2026, 21:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-20_34533212427d26a1564d814c54713c88_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
  • Size 2.0MB
  • Sample260420-1ryx3set5m
  • SHA256 d3859205cf3583a6ddd2d150eac16c1adab98f5e15deb69bb74d25d238b58266
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasion

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in Windows directory 4 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-20_34533212427d26a1564d814c54713c88_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-20_34533212427d26a1564d814c54713c88_agent-tesla_amadey_icedid_luca-stealer_njrat.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4372
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Import-Certificate -FilePath 'C:\Windows\server.crt' -CertStoreLocation 'Cert:\LocalMachine\Root' -ErrorAction SilentlyContinue"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1860
    • C:\Windows\dxdi32gs.exe
      C:\Windows\dxdi32gs.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3760
    • C:\Users\Admin\AppData\Local\Temp\BO7WIZ.exe
      "C:\Users\Admin\AppData\Local\Temp\BO7WIZ.exe"
      2⤵
      • Executes dropped EXE
      PID:3780

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        BO7WIZ.exe
        • Path C:\Users\Admin\AppData\Local\Temp\BO7WIZ.exe
        • Size 1.7MB
        • SHA256 66e8734b28ae2dfb504ce8b9fe88a43a408befe82b6d3117d15f8d4aa18a2c5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_h4jlptih.wgj.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h4jlptih.wgj.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dxdi32gs.exe
        • Path C:\Windows\dxdi32gs.exe
        • Size 12KB
        • SHA256 ebeff7280dcadd6310b1d2287e471ee4f4c590ed21bd3241f391d7c215a42414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1860-3-0x000001CF0D5F0000-0x000001CF0D600000-memory.dmp
        Download

        memory/1860-2-0x000001CF0D5F0000-0x000001CF0D600000-memory.dmp
        Download

        memory/1860-4-0x000001CF0D4E0000-0x000001CF0D502000-memory.dmp
        Download

        memory/1860-12-0x000001CF0D5F0000-0x000001CF0D600000-memory.dmp
        Download

        memory/1860-13-0x000001CF0D5F0000-0x000001CF0D600000-memory.dmp
        Download

        memory/4372-36-0x000002082AA90000-0x000002082AAA7000-memory.dmp
        Download

        memory/4372-35-0x000002082A4C0000-0x000002082A4C8000-memory.dmp
        Download