0e73f70fa00b2ca40461d4f5a10704db0fdd0f416d84ab108086dcd8603a492a

Analysis

max time kernel
149s
max time network
117s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-24_0baf6af110d3ad7bebe2eaac641613b7_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 2.9MB
Sample260524-qjdl3adt2m
SHA256 0e73f70fa00b2ca40461d4f5a10704db0fdd0f416d84ab108086dcd8603a492a
MD5 0baf6af110d3ad7bebe2eaac641613b7
SHA1 bd64e23289e1c424a567e27783296da4928e0352
SHA512 cb1588768511d3e0d7f00bf64d2af60920f89b5a3b5577db6a16ab103160d6d01d89f68aa7e2757aba4e59d47eae8b518bc4c4c1eb8d1c663d191d768b93dad5
SSDEEP 49152:L2hvRhHukNaYqr2lr1skQkcyp3txIELl2hOAMFktnllgu50f0Bpywix:MvOiy29wkcynSU2h1MGZllHlyjx
TLSH
T1B0E52209E7E801FDD0B3E274CD824816EB76B84A57B0E7CF03A46A961F235549E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5108	Files4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 5108	3976	2026-05-24_0baf6af110d3ad7bebe2eaac641613b7_cryptbot_icedid_luca-stealer_njrat_stealc.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-24_0baf6af110d3ad7bebe2eaac641613b7_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-24_0baf6af110d3ad7bebe2eaac641613b7_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files4.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files4.exe" -pDkNbVtHdUi
  2⤵
  - Executes dropped EXE
  PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Files4.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files4.exe
Size 2.7MB
SHA256 831b99a93842bc1bd2a87f4ed9846f72454923dd6cb1dd036de0ac8961f5f4ed
MD5 4677a9734aa298c695125564a11095d0
SHA1 34bf23f08a1014d5dcdcd45b93a1fff93b085732
SHA512 5d9f64a0302b4ad0e6b81191dfd848f66b30506c2f37066e4093c57728856490a024d85b6cd09baf131e1f6b86f51858feb5e1c73b2381c6bf93ba91e9d1762e
SSDEEP 49152:L2hvRhHukNvUKUU4n025L5eXRlMuYdOCwb7ulKXG7UWijj:MvOZUq0IeXRlMusr+7DG7Jijj
TLSH
T1E9D51228E7E804FCD1B7E5B4CE924916EB3A7C4A4771E69F03E459A64F232508E3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download