e5a07d9107fe74d6d04ef44c71f3b026a9f0422a04910f5851e5ffd861f2f082

Analysis

max time kernel
148s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 03:49

Target
2026-06-04_0f050fa42d0546af9bc6bd1460503d10_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 4.8MB
Sample260604-ednpashw81
SHA256 e5a07d9107fe74d6d04ef44c71f3b026a9f0422a04910f5851e5ffd861f2f082
MD5 0f050fa42d0546af9bc6bd1460503d10
SHA1 5145215fb963974d7d5efb09c00e566edcda4903
SHA512 d989f8e0c9e1bb54b2e8df983dda953997279fd18679d27c190be086e6ec7d1b4ebc5dcc5bce75546e89a2139c56b91296e003f96286929ad02aae4836ae600a
SSDEEP 49152:CiEP1yqBDFntk0KbDYvOUTDSXM7/lAmewtCTUyTT5rfXzzfs5:SyGeAS8rSmuTUyTTlfM5
TLSH
T1A3360146F2A405FCD47B92389947961BEB3678591320DBCF13E08A652FA32E09F7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Deletes itself 1 IoCs

pid	Process
392	ZBOTK.exe

Executes dropped EXE 1 IoCs

pid	Process
392	ZBOTK.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
392	ZBOTK.exe
392	ZBOTK.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
392	ZBOTK.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 392	2332	2026-06-04_0f050fa42d0546af9bc6bd1460503d10_icedid_luca-stealer_njrat_stealc_vidar.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-04_0f050fa42d0546af9bc6bd1460503d10_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_0f050fa42d0546af9bc6bd1460503d10_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\ZBOTK.exe
  ZBOTK.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:392

OGO.ini

Path C:\Users\Admin\AppData\Local\Temp\OGO.ini
Size 104B
SHA256 919e65d8ec365ff4577db6dbea422d8799fd48504ea448e53b5fa80e8fe00272
MD5 01fa9fa18188d570979190c718517c3c
SHA1 14fc716377eaa70d2c6d346abbf6af7b30ffec82
SHA512 6f5bbd0591ec8e65579fa8e1d6538894d762b4ae4311b27c3edb0e32d273840ba97d8c0ab35d043cd2660594b3c514546b45c756dc4183cc76d88adcfad29b77
TLSH
T1FFB01218029149D04116544BD11CEAB7888734316F2E8748A3C83F7191C00CC2D52665
MD5 SHA1 SHA512 TLSH

Submit Download

ZBOTK.exe

Path C:\Users\Admin\AppData\Local\Temp\ZBOTK.exe
Size 4.8MB
SHA256 751385f8eed30703678bf947cd46c0b29b5e57199a3dafc60b12e947b7460a79
MD5 f345d8690a1738d4414ef1944dc99685
SHA1 f9da5088aa82ead6deec7ce4e7a0994959815207
SHA512 5defd0dbec0c580938f596fe82db648c8610d959f6730653aa4295ea8f6eaba68fa0643627b55ba5a013fb14f67deb2b31425aa2bea848a6d32828f0e3e14bce
SSDEEP 49152:CiEP1yqBDFntk0KbDYvOUTDSXM7/lAmewtCTUyTT5rfXzzfs1:SyGeAS8rSmuTUyTTlfM1
TLSH
T146360146F2A405FCD47B92389947961BEB3678591320DBCF13E08A652FA32E09F7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/392-8-0x0000000140000000-0x00000001404DA000-memory.dmp

Download

memory/392-10-0x0000000140000000-0x00000001404DA000-memory.dmp

Download

memory/2332-0-0x0000000140000000-0x00000001404DA000-memory.dmp

Download

memory/2332-6-0x0000000140000000-0x00000001404DA000-memory.dmp

Download