Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/07/2026, 04:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-03_c120a53618d10e5535bbf00f0ce5bd22_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_c120a53618d10e5535bbf00f0ce5bd22_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target 2026-07-03_c120a53618d10e5535bbf00f0ce5bd22_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 10.6MB
- Sample260703-eza1bsgs4k
- SHA256 ed7aebe8cfeb18b896a6af704ca86387878e2cbffb359164c29b760ba26e45d8
- MD5 c120a53618d10e5535bbf00f0ce5bd22
- SHA1 f770d7fe35350d39c5a49088e20815573c23b095
- SHA512 2647424faca1bfbdad0876f553cfa7c5626e50ea50eae494279c32c2c30a492f39031308b43f5979e545a3965c6409e911dad9c3da5bd6e960a0e3326996d8c7
- SSDEEP 196608:g3bripMUtbqeq1aBhpRRH9QMw0B/bMAEHUZ3sRpWQt+qVXldnHgbM5wR94:grmp1tOecwbH9QMw8TEHUZ20Qt1Xl1Dz
- TLSH T100B63359E7A041FDE0A3E9BD8A468812E7767C5D43B0A7CF13A05BD31F371A14A3AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation 2026-07-03_c120a53618d10e5535bbf00f0ce5bd22_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Runs net.exe
- Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4772 WMIC.exe Token: SeSecurityPrivilege 4772 WMIC.exe Token: SeTakeOwnershipPrivilege 4772 WMIC.exe Token: SeLoadDriverPrivilege 4772 WMIC.exe Token: SeSystemProfilePrivilege 4772 WMIC.exe Token: SeSystemtimePrivilege 4772 WMIC.exe Token: SeProfSingleProcessPrivilege 4772 WMIC.exe Token: SeIncBasePriorityPrivilege 4772 WMIC.exe Token: SeCreatePagefilePrivilege 4772 WMIC.exe Token: SeBackupPrivilege 4772 WMIC.exe Token: SeRestorePrivilege 4772 WMIC.exe Token: SeShutdownPrivilege 4772 WMIC.exe Token: SeDebugPrivilege 4772 WMIC.exe Token: SeSystemEnvironmentPrivilege 4772 WMIC.exe Token: SeRemoteShutdownPrivilege 4772 WMIC.exe Token: SeUndockPrivilege 4772 WMIC.exe Token: SeManageVolumePrivilege 4772 WMIC.exe Token: 33 4772 WMIC.exe Token: 34 4772 WMIC.exe Token: 35 4772 WMIC.exe Token: 36 4772 WMIC.exe Token: SeIncreaseQuotaPrivilege 4772 WMIC.exe Token: SeSecurityPrivilege 4772 WMIC.exe Token: SeTakeOwnershipPrivilege 4772 WMIC.exe Token: SeLoadDriverPrivilege 4772 WMIC.exe Token: SeSystemProfilePrivilege 4772 WMIC.exe Token: SeSystemtimePrivilege 4772 WMIC.exe Token: SeProfSingleProcessPrivilege 4772 WMIC.exe Token: SeIncBasePriorityPrivilege 4772 WMIC.exe Token: SeCreatePagefilePrivilege 4772 WMIC.exe Token: SeBackupPrivilege 4772 WMIC.exe Token: SeRestorePrivilege 4772 WMIC.exe Token: SeShutdownPrivilege 4772 WMIC.exe Token: SeDebugPrivilege 4772 WMIC.exe Token: SeSystemEnvironmentPrivilege 4772 WMIC.exe Token: SeRemoteShutdownPrivilege 4772 WMIC.exe Token: SeUndockPrivilege 4772 WMIC.exe Token: SeManageVolumePrivilege 4772 WMIC.exe Token: 33 4772 WMIC.exe Token: 34 4772 WMIC.exe Token: 35 4772 WMIC.exe Token: 36 4772 WMIC.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1224 wrote to memory of 1276 1224 2026-07-03_c120a53618d10e5535bbf00f0ce5bd22_cryptbot_icedid_luca-stealer_njrat_stealc.exe 85 PID 1276 wrote to memory of 4112 1276 cmd.exe 88 PID 1276 wrote to memory of 1012 1276 cmd.exe 89 PID 1276 wrote to memory of 1988 1276 cmd.exe 90 PID 1988 wrote to memory of 5048 1988 net.exe 91 PID 1276 wrote to memory of 2800 1276 cmd.exe 92 PID 2800 wrote to memory of 4772 2800 cmd.exe 93 PID 2800 wrote to memory of 3440 2800 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_c120a53618d10e5535bbf00f0ce5bd22_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_c120a53618d10e5535bbf00f0ce5bd22_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\AntiVirus\c.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:4112
-
-
C:\Windows\system32\mode.commode con: cols=51 lines=303⤵PID:1012
-
-
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵PID:5048
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic csproduct get uuid /value 2>nul | find "="3⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid /value4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4772
-
-
C:\Windows\system32\find.exefind "="4⤵PID:3440
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AntiVirus\c.bat
- Size 25KB
- SHA256 1ec1e31814e0c8052b87a57a0dbd53df21a517ef1f72935e8ab847f0e657d2d4
- MD5 e08b6721afc641a6d1b5289431cdb75f
- SHA1 39dbb2792a22186265a405a5c2d2251698086691
- SHA512 ef69885cb5886bc762b7ad89ffd81ff4ada00810b17c406786ce7e06e4be52291ddeb11aa3bfc264b31af856313bbf73728a000ed579cbc283d812ee621e7efc
- SSDEEP 384:N0uF3BNqtmrlZxMj1IaS+Ixn6RWctLZnKzBWCkWl01KmJBH8I8kQ4:+GqM+qctL5KNdUN
- TLSH T13AC2CB7230D5B3624FF186979A70D02EA70C83F797345AC8F1DE44685B6AAD2A1E50F8
- MD5 SHA1 SHA512 SSDEEP TLSH