4b5cd7c553f9e21b3afee13962942bc3d5c401345eb20e7dc31ae669bac8940f

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_f3958500893bd62fb6ebd9a26fdb7e3b_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 142.2MB
Sample260522-3ry9ysa121
SHA256 4b5cd7c553f9e21b3afee13962942bc3d5c401345eb20e7dc31ae669bac8940f
MD5 f3958500893bd62fb6ebd9a26fdb7e3b
SHA1 c9ebe3f1d01a108a0f92d12b42caba83157ef61b
SHA512 f8c4377e3df0eeb2e4255c2f22e01659ce4238a3855c90353645c8e98e3e977d970ac7e242d595d1bbaa75c83be0bff0e902a611c072a05e806c9321ec9636e8
SSDEEP 3145728:Uv3XKFKEEEV2Loxj1Wy4f7HZ8z9WHyOM+jkg+JC0IBdZv:83iMEWoALfLNNlkg+JPI
TLSH
T10968332E7AF10E91C582F578D60ECF938DB2382A4B24D74E93BE95618E97531C51EBC0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
988	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1904	NRJiiiiYcW.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings	2026-05-22_f3958500893bd62fb6ebd9a26fdb7e3b_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
988	powershell.exe
988	powershell.exe
1904	NRJiiiiYcW.exe
1904	NRJiiiiYcW.exe
1904	NRJiiiiYcW.exe
1904	NRJiiiiYcW.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	988	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 2588	3764	2026-05-22_f3958500893bd62fb6ebd9a26fdb7e3b_cryptbot_icedid_luca-stealer_njrat_stealc.exe	79
PID 2588 wrote to memory of 988	2588	WScript.exe	80
PID 988 wrote to memory of 1904	988	powershell.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-05-22_f3958500893bd62fb6ebd9a26fdb7e3b_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_f3958500893bd62fb6ebd9a26fdb7e3b_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoLogo -NoProfile -NonInteractive -Command "& { try { $ErrorActionPreference='SilentlyContinue'; . '"C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\.runner.ps1"'; } catch {} }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Users\Admin\AppData\Local\Temp\tmp_f4Sg4eepoBVElk\NRJiiiiYcW.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp_f4Sg4eepoBVElk\NRJiiiiYcW.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup.vbs

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.vbs
Size 637B
SHA256 baa56b50510ec137c6189c4439a8be55aacdad30e7015c0399a04617b22188ef
MD5 b4da72e23ea406bafdcaf6901eec613b
SHA1 c1b0c170221db8ddf6af7e856c6e1df20dc63e1b
SHA512 77d465f8166966e5d09649bbf92333fb83b74c1cfe023bb28bd7ff9f3a41c063d0176a1830c5bdfe921c429724b84735c12c7b08e4ef15302051821249e1dad3
TLSH
T176F0A2269D69DC658AD68993C1F7F90C875B60511323C1240A58FDA4F7319B40E05D87
MD5 SHA1 SHA512 TLSH

Submit Download

.runner.ps1

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\.runner.ps1
Size 4KB
SHA256 23d0e81b02f44b5a50cd6af26b58a702a8eba562c7d1ec1ea308ccd33dbba08c
MD5 5a265ac6322dc2f8ed681ad3fee3b30c
SHA1 3883e99698ff946ca861f99f6d92e133da578893
SHA512 fffc3cc01665fa02192f8739d38809f414af7f9218bb8c7e78cd5d6227d08578f1a1a70052265c2c5f2a5fb36ed4a0741fa62b01e55a370a28f36ff03f46b15e
SSDEEP 96:t7wg8JpKroHMmn+1C0Dey+TU5HkLllzl3kN/67CH0S8m23Fov:eCIzn+1C0Dey+TUBAl5l3kNi7CUPD1y
TLSH
T195A19528360BD15156BBBB2EEA5FA54DEF1A40372016D40076EDC6C0EF71648C7A8BCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file1_info.json

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\file1_info.json
Size 1KB
SHA256 ceee3b5612094e52e5e36c95950b3de481e262f1d729000196de10847b391f7f
MD5 1a3c782bc659cc8eabf7b9db522b994a
SHA1 3934f128965cf226e030002e51009151f0a1a9b9
SHA512 0486652f37ff079c9ff1405627e5efbc6b0470ea0ec70f127d4680e92ff88443a099000db164e8c6cb130cbdfbced0eb000c60a267c4cd71e830304fcc9635d4
TLSH
T13D21C11AC3ACDC261A7CE6B2491A2F91E181A31B11558F8337FD55CC4F73E221191ABB
MD5 SHA1 SHA512 TLSH

Submit Download

CEn9gRPo3FRr.part

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\file1_parts\CEn9gRPo3FRr.part
Size 16KB
SHA256 edaf431bb594cf9c3197dd7970393529607225f14a5982e0bf71827e0a540d5f
MD5 ed3b36a7b50d5ba1f88ddbb671a0802a
SHA1 905d5285339e64e16f9d2f8ca08f97e5ede34bf1
SHA512 4b710345af83b55de5018176b0230a2b8fe1d5a3a5c445da016b42704ec897d2e3168871c4729a760e7f7be40c410423746ca4610028a43f0010fa83ba79276e
SSDEEP 384:FXKh7Uy/dn9RAC9409dSWxwjKyvYl08v2S6IEIoA4Cr2uUFpW:FXk7t9Rx9Lq+yQl0NeT4npW
TLSH
T1D572C9734CE26E52899023672EF635905BEAE48F1AD7B85C1F741379F1EB44280AD31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VM7uWo250Kk6.part

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\file1_parts\VM7uWo250Kk6.part
Size 413KB
SHA256 13d1d05e33ca4a35ddbf1d26f7ec2ba5391df3152d8539d30a69a93c80e57ed0
MD5 5e826ffc3d69f74e39845e11127c017e
SHA1 7469e6164bc5db053ef944b30ed7e227607f2c09
SHA512 de0c3edf8e87f0effb43f3e6b0a9141c9662efe3582f7aeddd4e850eae31555ad5dbf9481e4264b0be47a08012672ff2d4740b748ed5d8b44826af81877b76c4
SSDEEP 12288:HP67OIHHPDktY+xHa5T5to92YTwhsgkB7C:HP67O+HPwtX6dEAYEB
TLSH
T13094E55B5CB540E8C0FEE2358667B612BD723064073837DB2EE18A610F6AFF164B8B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxwRTMvjCpcT.part

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\file1_parts\cxwRTMvjCpcT.part
Size 176KB
SHA256 adc67ce937855190f6bbeb3b80129499ce3d0a3dd5b8ecb6fab1b38ec654155a
MD5 1ba0cb2301667cd4893d44082abb2c4b
SHA1 565ef2a85d478d0eba655ec79377b1d0225cda7f
SHA512 7be3da4ec9d6b2149785744dfe9a4ca2edfd5e7733a468dc84b2cd50211b1935e215489ab10190aadcf64dbfe3701df7a1ba7d3390c3bf1eee372dd6339009ff
SSDEEP 3072:A9fkRe4NTU+8r/3eprGrBVArQtSqSMsaTKRpKwtX:4fkRPRUn/3ep4BVtt5KaTKtX
TLSH
T1F6045A55DC5B3FBB336733124A5A5819EA4620C17333466E9ECAD7F03C03792A922B79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d20BBzV21MOg.part

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\file1_parts\d20BBzV21MOg.part
Size 214KB
SHA256 8f7f4cdb5b566d57a2cbe0a2f751c00c933240b911ed038422ab3af0a81f1d87
MD5 ca40f60a6d6854d5661cf327aedd230e
SHA1 479959982796a286cc934cd0a88c603b66233635
SHA512 7a0e0d377cc52e9f001456bafb17102381a7e74e616d63da699ad22708f7561ac55afec5384b3d1ea436bbffcad5bf343601d2e87ccc4e767367aee102ec245a
SSDEEP 3072:4fm9kasfG3p3PEs7/i2EG+yWPJfiFI4JKWxY+YKB:ZkfG5/EsSyAKF9JbYKB
TLSH
T13E24F66B6CB440F884BED6B58E63B657BDA23415133933D72AE046900FDAFE071B8B45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

laCdidVvPyNN.part

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\file1_parts\laCdidVvPyNN.part
Size 580KB
SHA256 e6f791accc40bc731d0f38a12e203b7d1e5d1f2a3ab49b99ff35aa3a24c2f982
MD5 d06285f752ef3dae6512d6cea26e0a44
SHA1 8092d25cf184a2eaea1bbc12488aba757808b7de
SHA512 5fd4b43d57b8aacfc9febb3bc1490950b759a2e35a12a7a30a4e722254996b73865590fa27b1ed488aebf614327049a0554f05a2d7095890df6044fe63c97819
SSDEEP 12288:i2EBCWUrVb7PVnKpY+OVODQ0OXWbfmqp+PeleP1jy:ICWKVb7PVnKDOVOkVSfsPele5y
TLSH
T1D8C4AE2ABE8189E3C4161231D4D36C803B76CEA04F2127A766C6B37C3DB67F16D5B658
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pXSVOYcz6MdI.part

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\file1_parts\pXSVOYcz6MdI.part
Size 124KB
SHA256 c3a1c41b793d4c9679e7534a9499d24b9ee4a6cee177c6369eac05650d4e32f1
MD5 b5e153995c4ebd858ad594b4e20324d6
SHA1 5a44de348afdb0164b9079c2549e09e68247bab4
SHA512 1f60f269c697a1c3fba9705f78e82771e81f3ac000f6ca37c9acdbecafcc810f52f772afdaf1530656799d940b681dd02600fadf22812e38b632c90d467435ad
SSDEEP 768:u1temlPQIwrNvsq0dX9yqvAStI02nHXFqUtXdM4R+OjvmHmmQ+i5JQvbA7RvLOS:uferJ9CX90mI0AqUZu4AOjeH88vbuRj/
TLSH
T1D5C322092E9FDEEBC1682AB1088236F953F05E461E930F53AD92B76D1CF19B84F146D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rebDXfuU2IZm.part

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\file1_parts\rebDXfuU2IZm.part
Size 351KB
SHA256 f0bee767f34355e4f66bf81da747647ec87e90f33b3f52f26835002a42a86319
MD5 1139971ecf3a1d717cdebe7fad5f7762
SHA1 2203837ec78822f84d6b1f3e108833e69c8933c0
SHA512 4718afb731ab79c9bf46ffb4f843f380e6107fc1610f43d95a6c76df6a744730481a1455efd2cc022d7ddbcf00cd2518a5ba81144cbca960f9823c0bfc581826
SSDEEP 3072:mge83kXV1Fii+M3jXSUOMPu+h+EBQ0gmI/95MzVTGlWNFsI7Oar/mhsoKwrq1nPs:mO3kXAi+Mh5cGrgz9q0VP2/jqL
TLSH
T1CE745309BC815EABD843673288F702D1B77A9D1A2F7393173A407B3D3D766A09D06768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_5ygke5m1.r11.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ygke5m1.r11.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

NRJiiiiYcW.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp_f4Sg4eepoBVElk\NRJiiiiYcW.exe
Size 29.8MB
SHA256 91d9665ebc90358c0e79bc8a08a15572f05973a8dbd095917c02ea0c1c74ea47
MD5 860bfade0cde8643da3929accb062739
SHA1 9ddbb8918848f1f1b1e9ddb0756f6ec7ed420150
SHA512 8b3f436ac00d7f3c9df9626dc1c6d0307c173b728aba5ef6216f69a109b5f6877764cb29709782ca76e72ae9162ada83d659eb0a510add6e71075ef6ed20b99b
SSDEEP 393216:HVNvYF2gXIZQM3GwaxyPUhvSZ1bkKcw1prgX72kADWyX5M7vhMB6RPuwwK12QUoz:HVNgMQ+GwaxA0SnkKDZgXR7vBphWk
TLSH
T1FC67331BAC9159F7D0AA733188A3A5917A717C192F3223D72980B77C2FB2BE06D35714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/988-33-0x0000017DB32A0000-0x0000017DB3462000-memory.dmp

Download

memory/988-30-0x0000017D97040000-0x0000017D97062000-memory.dmp

Download

memory/988-35-0x0000017DB39A0000-0x0000017DB3EC8000-memory.dmp

Download