e80993541022ee0cf6b6d5ad227a708a6aa10776b8e25be044f1b2698c479d00

General

Target
2026-05-06_03481d8ab10858f7825f27f9f9905789_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.2MB
Sample260506-3p3vcsby31
SHA256 e80993541022ee0cf6b6d5ad227a708a6aa10776b8e25be044f1b2698c479d00
MD5 03481d8ab10858f7825f27f9f9905789
SHA1 f0f98ebc6c715fcdf06751f50380a97a784b8446
SHA512 4596d2ff611be47a9e72337600a8917e74d7245b44cdd97799f833e21476f16d6728e011e1446a40894c51878a7e1d84d8078329cc22da28dab696f39b80b5b2
SSDEEP 49152:wgTbH94YxEcbTBP+Zggjsj2zPC0XId5hQnVZ/DrCa5aTFLyuNEgp2VQ7C0xjt:r2CXBWZFsjeCRYT/gTFKgp2VQTp
TLSH
T19AF5231EE7B405FDE1A7E538CD824A46E7767C095761E6CF03A09AA61F232E08D3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244a1-16.dat	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	2026-05-06_03481d8ab10858f7825f27f9f9905789_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	remote.exe

Executes dropped EXE 1 IoCs

pid	Process
3364	remote.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00070000000244a2-18.dat	autoit_exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000244a1-16.dat	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\2121.exe	xcopy.exe
File opened for modification	C:\Windows\2121.exe	xcopy.exe
File created	C:\Windows\367.Exe	xcopy.exe
File created	C:\Windows\remote.exe	xcopy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remote.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5036	timeout.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 3364	4788	2026-05-06_03481d8ab10858f7825f27f9f9905789_cryptbot_icedid_luca-stealer_njrat_stealc.exe	84
PID 3364 wrote to memory of 5008	3364	remote.exe	86
PID 5008 wrote to memory of 4968	5008	cmd.exe	88
PID 5008 wrote to memory of 1744	5008	cmd.exe	89
PID 1744 wrote to memory of 5036	1744	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-05-06_03481d8ab10858f7825f27f9f9905789_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_03481d8ab10858f7825f27f9f9905789_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\remote.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\remote.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1018.tmp\1019.bat C:\Users\Admin\AppData\Local\Temp\RarSFX0\remote.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\system32\xcopy.exe
      xcopy ".\*" "C:\Windows\" /y /q /h /s /e /k
      4⤵
      Drops file in Windows directory
      PID:4968
  - - C:\Windows\system32\cmd.exe
      cmd /c "timeout /t 2 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\remote.exe" & if exist "C:\Windows\remote.exe" del /f /q "C:\Windows\remote.exe" & exit"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1744
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 2
        5⤵
        Delays execution with timeout.exe
        
        PID:5036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1019.bat

Path C:\Users\Admin\AppData\Local\Temp\1018.tmp\1019.bat
Size 1KB
SHA256 f147059b62e019b2d4c7e8494fe1085154de7b9569f6bd65505acfbf59a36808
MD5 bfc34205ce452f3b93d8066d9001f45b
SHA1 45ba37fef60b2e328af7db9b38fe8ceb21a8e1e2
SHA512 46d69ab40d6eac7eee3cc88e9d3b8ca0d158faf9a4510bf25429047567d2a6ba7051c8b2da43fdcbdc32912bd78d8eb897d6ac8877da9e7bb4ea6fefb7f96c9a
TLSH
T12C2145B3A077230060324D916BD9A1F7E363EC47173744887E5C94C6AE125CA029F6FD
MD5 SHA1 SHA512 TLSH

Submit Download

2121.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\2121.exe
Size 3.1MB
SHA256 34199049b5cd19c8966fbf550fdb6319a6726068c8ee98de5b3b1df049bd0cfb
MD5 42cb6d9dead45cbe7216db37d4efb58c
SHA1 74f281b7b25cae9cb86f3943667c74108fc8bece
SHA512 9737426f9a97ea4dff8a070426146e245203f3e7866686af338bccc33c529de8c9f9e8ea041bc095b9a0cafd75a7ff2f5f6f83de4f1188c767db50a71e6cab4a
SSDEEP 98304:owGvScg7CadnOxVgqdZ+QQ1pLWogHabliR:oWhUVgnWogHabliR
TLSH
T125E501E17EAD185DF8E964B38FF9DDB8891FBCD87616112B2011726BF6337001A4A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

367.Exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\367.Exe
Size 1.3MB
SHA256 69325bb6a9a7e5e57c2048484c5b492540dbc7b9f8678f904e538b07bc3ce51f
MD5 1f360f47a4c3da928d9f7761fc352149
SHA1 ac90ff45a5efe438dbda7b9a405cefe0b9526025
SHA512 27b39756342d9286d8e032ebcddba0d89256c316535ac03668f9cceb7ff1d53b51e37dcf49657a1c2692f51e921b8fc24791463dd3128705f0800c01971924f3
SSDEEP 24576:vrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9Tvavsa:v2EYTb8atv1orq+pEiSDTj1VyvBavR
TLSH
T1CC556BC463A481ADFEAFD6768932CD12D2F17C055A72D62F06E4B7E16F33AA1152E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remote.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\remote.exe
Size 70KB
SHA256 66762a090fe667dffd50a4523f2d74bfe0e60bd24eceb6512f4cdfe9b1f88508
MD5 6ae7bd1436d6da78e7498bc9ce203ba8
SHA1 7d3e37b1b15a1e2fd6595f7c6f70f8fdf33bfa20
SHA512 378bbb0713397e04cadf394606876ba77696a2324b5f9f410593a55a695d43a110b440bbabd74befb669d8d2b6c385bdbcf78b98753b04cc8bdd6b39d1e3ef66
SSDEEP 1536:dqcmDHE9l2jV5onOelkT57Y0S73jQSlfYU8J3yYOP:7Hcolp0kf1Yh8
TLSH
T1A8634A43B6C207B2C68146B585A239BAD775D73A87165FC7D308D983DFA40F1CC722AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3364-13-0x0000000000412000-0x0000000000413000-memory.dmp

Download

memory/3364-21-0x00000000023C0000-0x000000000243E000-memory.dmp

Download

memory/4788-22-0x000002AB1D610000-0x000002AB1DD4F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads