Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 04:24
General
- Target 2026-06-02_077d3489482b264e303697aa0f942d2b_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 5.5MB
- Sample260602-e1gt9sdx5s
- SHA256 105fcc36152340b4d418bde02cc697bef388cd8497db75164d2b6884201d7828
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Custom signatureUPX dump on OEP (original entry point) 13 IoCs
- XMRig Miner payload 9 IoCs
- Creates new service(s) 2 TTPs
- Executes dropped EXE 2 IoCs
- Stops running service(s) 4 TTPs
- Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Suspicious use of SetThreadContext 2 IoCs
- UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 17 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_077d3489482b264e303697aa0f942d2b_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_077d3489482b264e303697aa0f942d2b_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\New_Miner.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\New_Miner.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "yandex"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "yandex" binpath= "C:\ProgramData\eywtzacsjbmf\nuebqqojlbgq.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "yandex"3⤵
- Launches sc.exe
-
-
-
C:\ProgramData\eywtzacsjbmf\nuebqqojlbgq.exeC:\ProgramData\eywtzacsjbmf\nuebqqojlbgq.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\conhost.execonhost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
New_Miner.exe
memory/1576-19-0x00007FF766CF0000-0x00007FF76765F000-memory.dmp
memory/2452-33-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2452-32-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2452-34-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2452-38-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2452-39-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2452-41-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2452-40-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2452-37-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2452-36-0x0000026A309D0000-0x0000026A309F0000-memory.dmp
memory/2452-30-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2452-44-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2452-43-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2452-35-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2452-29-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2452-31-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2544-24-0x0000000140000000-0x000000014000D000-memory.dmp
memory/2544-25-0x0000000140000000-0x000000014000D000-memory.dmp
memory/2544-23-0x0000000140000000-0x000000014000D000-memory.dmp
memory/2544-22-0x0000000140000000-0x000000014000D000-memory.dmp
memory/2544-21-0x0000000140000000-0x000000014000D000-memory.dmp
memory/2544-28-0x0000000140000000-0x000000014000D000-memory.dmp
memory/4120-14-0x00007FF76CDC0000-0x00007FF76D72F000-memory.dmp