458701ca476d028c1d442c91fd80b155654b77cfe81da534c8e3e640fff8c28e

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_02975f03b4144cda46176aa8f3a1716f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.2MB
Sample260604-lf7zaacy8k
SHA256 458701ca476d028c1d442c91fd80b155654b77cfe81da534c8e3e640fff8c28e
MD5 02975f03b4144cda46176aa8f3a1716f
SHA1 18ef7bbd4f9d6f56af37df5e50b75fc082ec6bb5
SHA512 72b51702a8aa8585881d67551c272ea21253158cd6b3367df2b01e1e05cd6adbb8fb6cef91258e7a891556fab8902c3b4514df37b682f4788286eb6c28a86343
SSDEEP 98304:ed1nm4VnMF/C1egH244CMatKebhzot9cs+W:eH9pMF/CYJclzotN
TLSH
T173F5EF52B55500AAF83766F2E80FCC5152A23DDA437AD74E13C3AF2F9AE3355046BB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3252	Invoice update.exe_protected.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 3252	4380	2026-06-04_02975f03b4144cda46176aa8f3a1716f_cryptbot_icedid_luca-stealer_njrat_stealc.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-06-04_02975f03b4144cda46176aa8f3a1716f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_02975f03b4144cda46176aa8f3a1716f_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Invoice update.exe_protected.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Invoice update.exe_protected.exe"
  2⤵
  - Executes dropped EXE
  PID:3252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Invoice update.exe_protected.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Invoice update.exe_protected.exe
Size 2.2MB
SHA256 716ccf5f014ca536672a937e22f04ac13621c923a0d7d6920c31b5fc5bcf849d
MD5 5592c83bdc63098620cbe73470a7116c
SHA1 ea26475786a7b5856b7d4b36e6977a8505b3dc40
SHA512 269ebb6eef84c6a5cb842d8b76b6c7eaecdf114fc597fa30799fd3d20dccf4f5091e0dd23ca5949b07ec0e7d4c10db0c463ebd472032183b2095e6ed9718620b
SSDEEP 49152:2znIMT3F2fhBn2FU665ivVKfIP/06jLCMvGPhgaWSK9J0TFcM:6nI4YfhB2FU6gwUIPM2CMShgaWjJ0TOM
TLSH
T10FB5231AB60F8EE4E236057846C1691113533E3984F7CE8357584B2F32C795AAEEF5AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3252-10-0x00007FF753F20000-0x00007FF754727000-memory.dmp

Download

memory/3252-12-0x00007FF753F20000-0x00007FF754727000-memory.dmp