041159e598815fd0073e63bb30baa9a7242d3e74eb005e8c6b0e7fa6a8ecf91d

General

Target
2026-06-01_68a00cf93d550cc5c0f0c9348a65313e_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 11.0MB
Sample260601-bk2b7aay61
SHA256 041159e598815fd0073e63bb30baa9a7242d3e74eb005e8c6b0e7fa6a8ecf91d
MD5 68a00cf93d550cc5c0f0c9348a65313e
SHA1 d8da4089725a9cf8ecd1102c36e3d61eace2c51f
SHA512 6fcd34c7d2294b06479eeefaafa55382f87468277832204c34c505e4d851c24f2e4d7788bea32b7144dd5ac1b76833507b83419d4ba466540006a083c37b4de7
SSDEEP 196608:9Oas3RqHrJpGoZrYobLn/9B5Dw9TFxg7e7CNzJZbxa5Uey7TkStaOoJAfIcSBhio:9OamA3Rko/n/n5E9TI733bTaOoJAfJ2V
TLSH
T147C63368C6B541FDD1B2A534CD968B0AE272744503B5E6CF03A49D6B1E3F2B48D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3828	Crack.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GiliSoft\Total Repair\CompressFile	Crack.exe
File opened for modification	C:\Program Files (x86)\GiliSoft\Total Repair\FileRepair	Crack.exe
File opened for modification	C:\Program Files (x86)\GiliSoft\Total Repair\FileRepair\FileRepair.exe	Crack.exe
File opened for modification	C:\Program Files (x86)\GiliSoft\Total Repair\SystemCleaner\SystemCleaner.exe	Crack.exe
File opened for modification	C:\Program Files (x86)\GiliSoft\Total Repair\TotalRepairMain.exe	Crack.exe
File created	C:\Program Files (x86)\GiliSoft\Total Repair\FileRepair\FileRepair.exe	Crack.exe
File created	C:\Program Files (x86)\GiliSoft\Total Repair\SystemCleaner\SystemCleaner.exe	Crack.exe
File opened for modification	C:\Program Files (x86)\GiliSoft	Crack.exe
File opened for modification	C:\Program Files (x86)\GiliSoft\Total Repair\CompressFile\CompressFile.exe	Crack.exe
File opened for modification	C:\Program Files (x86)\GiliSoft\Total Repair\DllRepair	Crack.exe
File opened for modification	C:\Program Files (x86)\GiliSoft\Total Repair\DllRepair\DllRepair.exe	Crack.exe
File created	C:\Program Files (x86)\GiliSoft\Total Repair\TotalRepairMain.exe	Crack.exe
File created	C:\Program Files (x86)\GiliSoft\Total Repair\__tmp_rar_sfx_access_check_240647218	Crack.exe
File created	C:\Program Files (x86)\GiliSoft\Total Repair\CompressFile\CompressFile.exe	Crack.exe
File created	C:\Program Files (x86)\GiliSoft\Total Repair\DllRepair\DllRepair.exe	Crack.exe
File opened for modification	C:\Program Files (x86)\GiliSoft\Total Repair\SystemCleaner	Crack.exe
File opened for modification	C:\Program Files (x86)\GiliSoft\Total Repair	Crack.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4640	taskkill.exe
5416	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4640	taskkill.exe
Token: SeDebugPrivilege	5416	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 6040 wrote to memory of 6124	6040	2026-06-01_68a00cf93d550cc5c0f0c9348a65313e_cryptbot_icedid_luca-stealer_njrat_stealc.exe	80
PID 6124 wrote to memory of 5368	6124	cmd.exe	82
PID 6040 wrote to memory of 1488	6040	2026-06-01_68a00cf93d550cc5c0f0c9348a65313e_cryptbot_icedid_luca-stealer_njrat_stealc.exe	83
PID 1488 wrote to memory of 4640	1488	cmd.exe	85
PID 1488 wrote to memory of 5416	1488	cmd.exe	87
PID 6040 wrote to memory of 3828	6040	2026-06-01_68a00cf93d550cc5c0f0c9348a65313e_cryptbot_icedid_luca-stealer_njrat_stealc.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-01_68a00cf93d550cc5c0f0c9348a65313e_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_68a00cf93d550cc5c0f0c9348a65313e_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\down.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\system32\curl.exe
    curl -o total-repair.exe https://download.gilisoft.com/gs/total-repair.exe
    3⤵
    PID:5368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\kill.cmd" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\system32\taskkill.exe
    taskkill /im TotalRepairMain.exe /t /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4640
- - C:\Windows\system32\taskkill.exe
    taskkill /im TotalRepairMain.exe /t /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5416
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Crack.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
Size 10.8MB
SHA256 873da72262ff4dd4403175cbd41161bdb926b88887efa1d22339ed14f6493f49
MD5 d5d4dd1e17afcccf603c361b71488a60
SHA1 c4e961bcb0ce0cb4c38ab50925d62a5cafe0b07a
SHA512 0bbb37ff6ffeeb9227e31093c979d191c82e2fd01151b189fa2a17b3a04c9335dfc96d8684ecb561959fe3503f8008ba02ece6ed37aef2fb5fc88e5e9f04846d
SSDEEP 196608:9avK91Augt19R65P0DWP5Jv0gmNQPTsxnXNIRYtfTHU1xJEeF:9ai9KP2P0DWP/fmNOsxdI+tfT0LJtF
TLSH
T1DEB6332897F941F8D1A7E178DE46894AEB71B8094B34B7DF03749CE25F275A04D3AB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

down.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\down.bat
Size 139B
SHA256 164ca5cca4eb1757f8b4adc788138813468c0140db68499a82d5cf7b87ba7e2f
MD5 4211f6b0f745a65ceddaf01e940f1cfb
SHA1 2c4ed88057383b0eb44290d50b8e52884c1ebc11
SHA512 291a714ff47d90abd46f7603f080b6e097442b79955fabf4f158c37e66887bb39117e9f68580d270e473581e1962fe31bc34df38d5ac93a5033139b1f0950a30
TLSH
T1CFC04C43C20D1DE4531085054F6E34E5A32B02E33C88BE4880D19A7DD0544579949F45
MD5 SHA1 SHA512 TLSH

Submit Download

kill.cmd

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\kill.cmd
Size 78B
SHA256 e90c7dd84298a1bbee6ebdd096ef712a747388db38b9998bc59d4187461211bc
MD5 0e8994c211c56840675033b4630272bf
SHA1 8d51472bb05c83036f74d89e44c9035fc4894945
SHA512 2b32e066853a71bb30328ad62213a18443b6fed287a6879273d6b397f051364afdb8dcd0362836f5a4e4c4bda560e1fd75539806dd11c712a8fc10e673f8d23e
TLSH
T1C7A00453C73FD1D0DF5001F713400104D105F13D143130541041353414D5015D11D3CC
MD5 SHA1 SHA512 TLSH

Submit Download

total-repair.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\total-repair.exe
Size 261B
SHA256 c17ea93e08c0321610f745cf38973fcb1076e6372c435af397a8f282a16a0a5a
MD5 05819ed1766b4a0b230435ff406f323e
SHA1 c44992a5f1e1f4731e377b36cc08c1af9fea829b
SHA512 1d534f882deba2150ec05505cec51814f57110da1e555e18243075deaf0b301aa661a5b211ae6947359f5caa93b1fc0d5b8a41bc6d33226526c61cfc500c29fb
TLSH
T106D097FED34220D4661337407ED220E121AF10F2A9C9A8EE15EF6988D02C4738CCE1CA
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads