Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/04/2026, 21:53
General
- Target 2026-04-20_34533212427d26a1564d814c54713c88_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
- Size 2.0MB
- Sample260420-1ryx3set5m
- SHA256 d3859205cf3583a6ddd2d150eac16c1adab98f5e15deb69bb74d25d238b58266
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
- Executes dropped EXE 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in Windows directory 5 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_34533212427d26a1564d814c54713c88_agent-tesla_amadey_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_34533212427d26a1564d814c54713c88_agent-tesla_amadey_icedid_luca-stealer_njrat.exe"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Import-Certificate -FilePath 'C:\Windows\server.crt' -CertStoreLocation 'Cert:\LocalMachine\Root' -ErrorAction SilentlyContinue"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\dxdi32gs.exeC:\Windows\dxdi32gs.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\BO7WIZ.exe"C:\Users\Admin\AppData\Local\Temp\BO7WIZ.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BO7WIZ.exe
__PSScriptPolicyTest_qci005vs.0jn.ps1
dxdi32gs.exe
server.crt
memory/2716-49-0x000002BE71780000-0x000002BE7186A000-memory.dmp
memory/5084-23-0x0000016D491F0000-0x0000016D491FA000-memory.dmp
memory/5084-21-0x0000016D491D0000-0x0000016D491EC000-memory.dmp
memory/5084-22-0x0000016D49500000-0x0000016D495B3000-memory.dmp
memory/5084-5-0x0000016D49200000-0x0000016D49210000-memory.dmp
memory/5084-24-0x0000016D495E0000-0x0000016D495FC000-memory.dmp
memory/5084-14-0x00007FF4DD8D0000-0x00007FF4DD8E0000-memory.dmp
memory/5084-29-0x0000016D30AE0000-0x0000016D30AF2000-memory.dmp
memory/5084-28-0x0000016D49210000-0x0000016D492FA000-memory.dmp
memory/5084-13-0x0000016D49200000-0x0000016D49210000-memory.dmp
memory/5084-6-0x0000016D30CC0000-0x0000016D30CE2000-memory.dmp
memory/5084-4-0x0000016D49200000-0x0000016D49210000-memory.dmp