Overview

overview

7

Static

static

3

2026-06-04...at.exe

windows10-2004-x64

7

2026-06-04...at.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 10:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-04_a0fff0ecf0a0a5b4daac10a9426e14e1_coinminer_icedid_luca-stealer_njrat.exe
  • Size 8.0MB
  • Sample260604-mbrl6sdv2m
  • SHA256 6618a048ad8c11521a08edeb0ded2a425dbae4265fe841292df00df7301b240f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 12 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_a0fff0ecf0a0a5b4daac10a9426e14e1_coinminer_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_a0fff0ecf0a0a5b4daac10a9426e14e1_coinminer_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Local\Temp\2026-06-04_a0fff0ecf0a0a5b4daac10a9426e14e1_coinminer_icedid_luca-stealer_njrat.exe
      C:\Users\Admin\AppData\Local\Temp\2026-06-04_a0fff0ecf0a0a5b4daac10a9426e14e1_coinminer_icedid_luca-stealer_njrat.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3964

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _imaging.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PIL\_imaging.pyd
        • Size 2.5MB
        • SHA256 8a3b959721dc32f808dba6834b2bf167e98fe0068d067078b2bc544670d815bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imagingmath.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PIL\_imagingmath.pyd
        • Size 24KB
        • SHA256 a4e2f1632aa05532e35113fe8edd949b60394b8b957ec18f644dd1bfc61937d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_queue.pyd
        • Size 34KB
        • SHA256 0d316914b426e71bbd263b78fe23622ac1c8e6f86bae42ef6ffbb609e6257e3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
        • Size 84KB
        • SHA256 a69f3a7e281009c86868dd56c2e933ca2634a3979fdc2a4ca751ee4ef5e6ece7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        flameget.png
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\flameget.png
        • Size 32KB
        • SHA256 19268ab3459af8616de8b0e90d64c680e403f31836d5f377ef3ad60d15654350
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _webp.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2028_134250418702562277\PIL\_webp.pyd
        • Size 400KB
        • SHA256 44bb3fd0a2fb035e83fa731d560ef18d5ae5311bf3251d6475193d749f64d11f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2028_134250418702562277\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2028_134250418702562277\_ctypes.pyd
        • Size 131KB
        • SHA256 c95add0b1a541b723c9090c23abeadb8f642b31bb33f2e1ae005fbb8a331ef73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2028_134250418702562277\_decimal.pyd
        • Size 279KB
        • SHA256 e80e2c4533958c717f40238155bd9f4101df23f832e1dddb8be4e83f7ad3355a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2028_134250418702562277\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2028_134250418702562277\python313.dll
        • Size 5.8MB
        • SHA256 265a27242ee97f81eeac6a556fd7de56baff2222f2334386d8f948e359a649d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2028_134250418702562277\select.pyd
        • Size 32KB
        • SHA256 7d061afc87ba79f90878af39a1ebc7b4cf238d52e5bbe16ff7e176cbba266ec0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tray.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2028_134250418702562277\tray.dll
        • Size 10.0MB
        • SHA256 2018186b8df0fb4d020135b8bdad3c6e571ee1e17ac213addc6e977a5e9ee00b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3964-45-0x0000016951D10000-0x0000016951D11000-memory.dmp
        Download