Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 02:49
General
- Target 2026-06-04_f2623c06788886f835027cd11344cf3f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 1.5MB
- Sample260604-da59hahs3y
- SHA256 b24abe253f49ffbbd62b1be4144968f507fb9b94599d1b100d07a1469351aa49
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 8 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_f2623c06788886f835027cd11344cf3f_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_f2623c06788886f835027cd11344cf3f_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.ps1" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Drops file in Program Files directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe" x -y -pHelloFriend! "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sfx.rar" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\"4⤵
- Executes dropped EXE
-
-
C:\Program Files\WindowsOptions\scvhost.exe"C:\Program Files\WindowsOptions\scvhost.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
install_log.txt
Run.vbs
UnRAR.exe
install.ps1
scvhost.exe
sfx.rar
__PSScriptPolicyTest_bjqcktvi.5pq.ps1
memory/3428-241-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-234-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-2075-0x0000000006970000-0x0000000006F16000-memory.dmp
memory/3428-2074-0x0000000006320000-0x00000000063B2000-memory.dmp
memory/3428-2071-0x0000000005320000-0x0000000005386000-memory.dmp
memory/3428-2070-0x0000000005200000-0x0000000005206000-memory.dmp
memory/3428-176-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-173-0x00000000002F0000-0x000000000039E000-memory.dmp
memory/3428-174-0x0000000004E50000-0x0000000004EB4000-memory.dmp
memory/3428-175-0x00000000050B0000-0x000000000518C000-memory.dmp
memory/3428-189-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-297-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-301-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-299-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-295-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-293-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-291-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-289-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-287-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-285-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-281-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-279-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-277-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-273-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-271-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-269-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-267-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-265-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-263-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-261-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-257-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-256-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-253-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-251-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-247-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-245-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-243-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-193-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-239-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-237-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-209-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-231-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-229-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-227-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-225-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-221-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-219-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-217-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-215-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-213-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-211-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-207-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-205-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-203-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-201-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-199-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-197-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-195-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-191-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-187-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-185-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-183-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-181-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-284-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-275-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-259-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-179-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-249-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-235-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-223-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/3428-177-0x00000000050B0000-0x0000000005185000-memory.dmp
memory/5072-26-0x0000029EF8F20000-0x0000029EF8FD3000-memory.dmp
memory/5072-17-0x0000029EF8BC0000-0x0000029EF8BE2000-memory.dmp
memory/5072-25-0x0000029EF8E80000-0x0000029EF8E9C000-memory.dmp
memory/5072-30-0x0000029EF9230000-0x0000029EF924A000-memory.dmp
memory/5072-29-0x0000029EF8EB0000-0x0000029EF8EBA000-memory.dmp
memory/5072-28-0x0000029EF8ED0000-0x0000029EF8EEC000-memory.dmp
memory/5072-27-0x0000029EF8EA0000-0x0000029EF8EAA000-memory.dmp
memory/5072-31-0x0000029EF8EC0000-0x0000029EF8EC8000-memory.dmp
memory/5072-32-0x0000029EF8EF0000-0x0000029EF8EF6000-memory.dmp
memory/5072-33-0x0000029EF8F00000-0x0000029EF8F0A000-memory.dmp