Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 03:47
General
- Target 2026-07-05_5a51f8a8941fbf8375253a69f990f67b_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 10.1MB
- Sample260705-ecf8tscy7r
- SHA256 7283eccdd8ac27adcebdd8af017147989052dc6fff69ab97ed8fdfb1e572c8a5
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Detect binaries embedding considerable number of MFA browser extension IDs. 2 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Detects executables manipulated with Fody 1 IoCs
- Loads dropped DLL 48 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_5a51f8a8941fbf8375253a69f990f67b_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_5a51f8a8941fbf8375253a69f990f67b_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\zn12kqn02kg\lzgz1h04m1.vbs"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\xf7yd2x86t\lzgz1h04m1.xml"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2qvym01l\2qvym01l.cmdline"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD84A.tmp" "c:\Users\Admin\AppData\Local\Temp\2qvym01l\CSCF1665C9A3F0B42978653AAFE4917C19E.TMP"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2qvym01l.dll
2qvym01l.pdb
aforge.dll
aforge.video.directshow.dll
aforge.video.dll
bouncycastle.cryptography.dll
calina.common.dll
gma.system.mousekeyhook.dll
naudio.core.dll
naudio.wasapi.dll
naudio.winforms.dll
naudio.winmm.dll
protobuf-net.dll
sharpdx.d3dcompiler.dll
sharpdx.direct2d1.dll
sharpdx.direct3d11.dll
sharpdx.dll
sharpdx.dxgi.dll
sharpdx.mathematics.dll
system.data.sqlite.dll
RESD84A.tmp
aes_iv.bin
aes_key.bin
config.txt
lzgz1h04m1.cs
lzgz1h04m1.vbs
lzgz1h04m1.xml
payload_encrypted.bin
xor_key.bin
2qvym01l.0.cs
2qvym01l.cmdline
CSCF1665C9A3F0B42978653AAFE4917C19E.TMP
memory/4196-30-0x0000000006570000-0x00000000065B4000-memory.dmp
memory/4196-49-0x000000000D040000-0x000000000D9D8000-memory.dmp
memory/4196-48-0x0000000009D60000-0x000000000A6FA000-memory.dmp
memory/4196-47-0x0000000006540000-0x0000000006548000-memory.dmp
memory/4196-32-0x0000000006C00000-0x0000000006F60000-memory.dmp
memory/4196-31-0x0000000006A20000-0x0000000006B9C000-memory.dmp
memory/4196-29-0x0000000006640000-0x0000000006762000-memory.dmp
memory/4196-28-0x00000000059E0000-0x0000000005A10000-memory.dmp
memory/4196-27-0x0000000005AB0000-0x0000000005C0A000-memory.dmp
memory/4196-148-0x000000000EA80000-0x000000000EB12000-memory.dmp
memory/4196-147-0x000000000EFA0000-0x000000000F55A000-memory.dmp
memory/4196-152-0x000000000EA40000-0x000000000EA5E000-memory.dmp
memory/4196-26-0x00000000058A0000-0x00000000058BA000-memory.dmp
memory/4196-25-0x0000000000E30000-0x0000000000E70000-memory.dmp
memory/4196-158-0x000000000EB50000-0x000000000EB5A000-memory.dmp
memory/4196-24-0x0000000074E02000-0x0000000074E03000-memory.dmp
memory/4196-159-0x000000000FF60000-0x000000000FFB0000-memory.dmp
memory/4196-160-0x0000000010070000-0x0000000010122000-memory.dmp
memory/4196-164-0x000000000FFF0000-0x000000001002A000-memory.dmp
memory/4196-173-0x00000000102F0000-0x000000001033E000-memory.dmp
memory/4196-182-0x0000000010390000-0x00000000103DC000-memory.dmp
memory/4196-200-0x0000000010430000-0x000000001045A000-memory.dmp
memory/4196-191-0x00000000103E0000-0x000000001042A000-memory.dmp
memory/4196-206-0x0000000074E02000-0x0000000074E03000-memory.dmp