2887e6e89a3eb0fffca4ac14f1d99566f9919ff65442f63aa37836410d96dbd7

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_645a0d88464a2b9470456187383841b9_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
Size 4.9MB
Sample260702-np89taft8q
SHA256 2887e6e89a3eb0fffca4ac14f1d99566f9919ff65442f63aa37836410d96dbd7
MD5 645a0d88464a2b9470456187383841b9
SHA1 4b93942a9c715f413b55fdde4cd6b63f6dcfe088
SHA512 801395e268403f5822f9e53de156937733c97af6a9a7dd606e1f6cc5b819b32a6eda0bfefaa38dc1c6737c418c90f95e4fb33f4452167585e8bcad696e61cb5d
SSDEEP 98304:qUz5esTTqsXGDgjlvaiG+Z9YnY+SAr3pr2Z1NRem9pvd:qgesTzXpvs+4nhBLYJR19pV
TLSH
T10F36020563A401ADFEB7E1368A13C107D6B17D49127B866F46607FB27F337A12A2E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows NT\Accessories\install\setup.exe	2026-07-02_645a0d88464a2b9470456187383841b9_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\install\white.gif	2026-07-02_645a0d88464a2b9470456187383841b9_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
File created	C:\Program Files\Windows NT\Accessories\install\Ohook.cmd	2026-07-02_645a0d88464a2b9470456187383841b9_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\install\Ohook.cmd	2026-07-02_645a0d88464a2b9470456187383841b9_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
File created	C:\Program Files\Windows NT\Accessories\install\keuzemenu.cmd	2026-07-02_645a0d88464a2b9470456187383841b9_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\install\keuzemenu.cmd	2026-07-02_645a0d88464a2b9470456187383841b9_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
File created	C:\Program Files\Windows NT\Accessories\install\taskkill.bat	2026-07-02_645a0d88464a2b9470456187383841b9_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\install\taskkill.bat	2026-07-02_645a0d88464a2b9470456187383841b9_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
File created	C:\Program Files\Windows NT\Accessories\install\white.gif	2026-07-02_645a0d88464a2b9470456187383841b9_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
File created	C:\Program Files\Windows NT\Accessories\install\setup.exe	2026-07-02_645a0d88464a2b9470456187383841b9_agent-tesla_amadey_icedid_luca-stealer_njrat.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2712	WMIC.exe
2712	WMIC.exe
2712	WMIC.exe
2712	WMIC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4860	2026-07-02_645a0d88464a2b9470456187383841b9_agent-tesla_amadey_icedid_luca-stealer_njrat.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2712	WMIC.exe
Token: SeSecurityPrivilege	2712	WMIC.exe
Token: SeTakeOwnershipPrivilege	2712	WMIC.exe
Token: SeLoadDriverPrivilege	2712	WMIC.exe
Token: SeSystemProfilePrivilege	2712	WMIC.exe
Token: SeSystemtimePrivilege	2712	WMIC.exe
Token: SeProfSingleProcessPrivilege	2712	WMIC.exe
Token: SeIncBasePriorityPrivilege	2712	WMIC.exe
Token: SeCreatePagefilePrivilege	2712	WMIC.exe
Token: SeBackupPrivilege	2712	WMIC.exe
Token: SeRestorePrivilege	2712	WMIC.exe
Token: SeShutdownPrivilege	2712	WMIC.exe
Token: SeDebugPrivilege	2712	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2712	WMIC.exe
Token: SeRemoteShutdownPrivilege	2712	WMIC.exe
Token: SeUndockPrivilege	2712	WMIC.exe
Token: SeManageVolumePrivilege	2712	WMIC.exe
Token: 33	2712	WMIC.exe
Token: 34	2712	WMIC.exe
Token: 35	2712	WMIC.exe
Token: 36	2712	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2712	WMIC.exe
Token: SeSecurityPrivilege	2712	WMIC.exe
Token: SeTakeOwnershipPrivilege	2712	WMIC.exe
Token: SeLoadDriverPrivilege	2712	WMIC.exe
Token: SeSystemProfilePrivilege	2712	WMIC.exe
Token: SeSystemtimePrivilege	2712	WMIC.exe
Token: SeProfSingleProcessPrivilege	2712	WMIC.exe
Token: SeIncBasePriorityPrivilege	2712	WMIC.exe
Token: SeCreatePagefilePrivilege	2712	WMIC.exe
Token: SeBackupPrivilege	2712	WMIC.exe
Token: SeRestorePrivilege	2712	WMIC.exe
Token: SeShutdownPrivilege	2712	WMIC.exe
Token: SeDebugPrivilege	2712	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2712	WMIC.exe
Token: SeRemoteShutdownPrivilege	2712	WMIC.exe
Token: SeUndockPrivilege	2712	WMIC.exe
Token: SeManageVolumePrivilege	2712	WMIC.exe
Token: 33	2712	WMIC.exe
Token: 34	2712	WMIC.exe
Token: 35	2712	WMIC.exe
Token: 36	2712	WMIC.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 5868	4860	2026-07-02_645a0d88464a2b9470456187383841b9_agent-tesla_amadey_icedid_luca-stealer_njrat.exe	88
PID 5868 wrote to memory of 564	5868	cmd.exe	90
PID 5868 wrote to memory of 2976	5868	cmd.exe	91
PID 5868 wrote to memory of 5484	5868	cmd.exe	92
PID 2976 wrote to memory of 2712	2976	cmd.exe	93
PID 5868 wrote to memory of 3160	5868	cmd.exe	95
PID 5868 wrote to memory of 5252	5868	cmd.exe	96
PID 5252 wrote to memory of 6064	5252	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-07-02_645a0d88464a2b9470456187383841b9_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_645a0d88464a2b9470456187383841b9_agent-tesla_amadey_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Windows NT\Accessories\install\keuzemenu.cmd""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    PID:564
- - C:\Windows\System32\cmd.exe
    cmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2712
- - C:\Windows\System32\find.exe
    find /i "ComputerSystem"
    3⤵
    PID:5484
- - C:\Windows\System32\reg.exe
    reg query HKU\S-1-5-19
    3⤵
    PID:3160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5252
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:6064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

keuzemenu.cmd

Path C:\Program Files\Windows NT\Accessories\install\keuzemenu.cmd
Size 59KB
SHA256 18d05864a16540dd33813978c5fb4a90f8d9df63f334e131983d4d68608d5a12
MD5 afbd06f829383b253e24bf3f70f6e5f6
SHA1 8351d0ec88925062486ee165fa24a4bf402aad89
SHA512 2658d1dfb43b99701befd3edada93649cbcb364b4ff78e6124f7a58fb2b6770b8361beab4c471b5fa59add773ebc5c6c993ae86e2fbede349efe0a9f982e5bc1
SSDEEP 1536:ly8ZUcSN8AuVbLGFvqZy0yq8BthAKlATW0GrVVzE0GQxtpo1:uqZy0yJBthAKlAa0GjE0GQxtI
TLSH
T12D5375563D8831B7527A03B04B248006FB9AD9634739C3AD755BE5A8773D1CFA2F42B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download