2751b90116fb4de7aaee2c387d2cbb754466ab9696bbe24b5f1d26c44fa4fdb7

General

Target
2026-07-20_993880e1322bee3a350031a8932b0cab_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 11.7MB
Sample260720-xtklpaes2v
SHA256 2751b90116fb4de7aaee2c387d2cbb754466ab9696bbe24b5f1d26c44fa4fdb7
MD5 993880e1322bee3a350031a8932b0cab
SHA1 5461c7041033bc1df933015e115455fced258245
SHA512 5a65f051d6d606d65f2e841b500b3507146cca9302d66d25290aff47c5c35df840e8950c6e1938adffd083e4afcc84c58afb9a6c02b55fe2b6364451da6a9e28
SSDEEP 196608:rpcjx3oTgqC+MbYo0h0pPP9qWtBpZqJUPVX9aHAmZIWmdiQ+CoaB1UqV:1c94TgOMcb28JU3LIIWJaB1Um
TLSH
T1BBC6331DD3A106F8E0B6E178DD468B45FB767C0A07B1E7C703A4A9E24F536909E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware trojan upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c58b-11.dat	UPX
behavioral2/memory/1140-13-0x00007FF654AC0000-0x00007FF6555E3000-memory.dmp	UPX
behavioral2/memory/1140-23-0x00007FF654AC0000-0x00007FF6555E3000-memory.dmp	UPX

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DEFE98DBED143E72525829F183B00733925E8FFC\Blob = 030000000100000014000000defe98dbed143e72525829f183b00733925e8ffc200000000100000029050000308205253082040da00302010202100c5f956bce16d66a70f60e2819af50ce300d06092a864886f70d01010505003073310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d313230300603550403132944696769436572742048696768204173737572616e636520436f6465205369676e696e672043412d31301e170d3134313131313030303030305a170d3138303131373132303030305a3077310b3009060355040613024155311830160603550408130f4e657720536f7574682057616c6573310e300c060355040713054d616e6c79311e301c060355040a13155669727475616c48657265205074792e204c74642e311e301c060355040313155669727475616c48657265205074792e204c74642e30820122300d06092a864886f70d01010105000382010f003082010a0282010100be6f9602d0b1c82710db5784e2931c0b872e7c92ee6b346caf47b0a8fd6f005c21aa3777d05b70a2dfbbdb321ddaaa6b2642adf5fab9e0836b0888c21ac7648f2971dcbae4aff2d18e1e8ad3c8ae9d7c0174efb03371c44977e1b9d582bbf491d48363e0fcf66af24606f962806edfb7a6628fcaec27de92782b43e91ed82fc6c06b9f1832587bd43a2fbd2524f40660e3760c4e8a03472a11f604199cf6f8dabc073ace635f82a87761430bdb952512c0ed00f894fdd17cbe4b1ba9a01245b12554348549fad84cd81d1d7b4f687daa21f9105c3e5275008a79b170e11e21c7ba6fbae5b7b2694baab22fef872d1504722d8580d4801e41e51ef26b89cd24390203010001a38201af308201ab301f0603551d23041830168014974803eb15086bb9b25823cc942ef1c665d2648e301d0603551d0e0416041401f4de35b0f66dcb3a3f576005ea10d724884afe300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330690603551d1f04623060302ea02ca02a8628687474703a2f2f63726c332e64696769636572742e636f6d2f68612d63732d32303131612e63726c302ea02ca02a8628687474703a2f2f63726c342e64696769636572742e636f6d2f68612d63732d32303131612e63726c30420603551d20043b3039303706096086480186fd6c0301302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f43505330818606082b06010505070101047a3078302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305006082b060105050730028644687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274486967684173737572616e6365436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d01010505000382010100ae0461da8d6a9965d3ed23707b3cc3f60dbd686f129521b93da554e70dd9082648898809d4463c0b5f3cbb64ad49ef969469ba4054377351fb58b57c4f5c1712aebbebc35dbbe186b9d740e12106491d567c2f9cbe5e5def5631d3eb0197c8b373a2f410c9acd4191c356badd878aa8a310a65f64b027f084f35b934ae975c9afef2130e954f2db2e32608346518d25bc31ba6a2298787caaec027d8ae5ad16317e43f5c105a6c196479c3e507eb25721a4c33a2af8989d82ea04d5d2c562f903b0aeedd533c1e8da16a7c785d41dc679592bf00efe91d8b4a3f8c3b60c28d0e3bf2d4a61a863806980181f215e513bf3cbb902f8e7985a5d88ef649b14a4ed9	v1.exe

Executes dropped EXE 3 IoCs

pid	Process
1140	v1.exe
4608	n.exe
4528	n.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
880	WScript.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c58b-11.dat	upx
behavioral2/memory/1140-13-0x00007FF654AC0000-0x00007FF6555E3000-memory.dmp	upx
behavioral2/memory/1140-23-0x00007FF654AC0000-0x00007FF6555E3000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\INF\oem0.PNF	v1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	n.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	n.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	n.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	9	Go-http-client/1.1

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	2026-07-20_993880e1322bee3a350031a8932b0cab_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	n.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DEFE98DBED143E72525829F183B00733925E8FFC	v1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DEFE98DBED143E72525829F183B00733925E8FFC\Blob = 030000000100000014000000defe98dbed143e72525829f183b00733925e8ffc200000000100000029050000308205253082040da00302010202100c5f956bce16d66a70f60e2819af50ce300d06092a864886f70d01010505003073310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d313230300603550403132944696769436572742048696768204173737572616e636520436f6465205369676e696e672043412d31301e170d3134313131313030303030305a170d3138303131373132303030305a3077310b3009060355040613024155311830160603550408130f4e657720536f7574682057616c6573310e300c060355040713054d616e6c79311e301c060355040a13155669727475616c48657265205074792e204c74642e311e301c060355040313155669727475616c48657265205074792e204c74642e30820122300d06092a864886f70d01010105000382010f003082010a0282010100be6f9602d0b1c82710db5784e2931c0b872e7c92ee6b346caf47b0a8fd6f005c21aa3777d05b70a2dfbbdb321ddaaa6b2642adf5fab9e0836b0888c21ac7648f2971dcbae4aff2d18e1e8ad3c8ae9d7c0174efb03371c44977e1b9d582bbf491d48363e0fcf66af24606f962806edfb7a6628fcaec27de92782b43e91ed82fc6c06b9f1832587bd43a2fbd2524f40660e3760c4e8a03472a11f604199cf6f8dabc073ace635f82a87761430bdb952512c0ed00f894fdd17cbe4b1ba9a01245b12554348549fad84cd81d1d7b4f687daa21f9105c3e5275008a79b170e11e21c7ba6fbae5b7b2694baab22fef872d1504722d8580d4801e41e51ef26b89cd24390203010001a38201af308201ab301f0603551d23041830168014974803eb15086bb9b25823cc942ef1c665d2648e301d0603551d0e0416041401f4de35b0f66dcb3a3f576005ea10d724884afe300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330690603551d1f04623060302ea02ca02a8628687474703a2f2f63726c332e64696769636572742e636f6d2f68612d63732d32303131612e63726c302ea02ca02a8628687474703a2f2f63726c342e64696769636572742e636f6d2f68612d63732d32303131612e63726c30420603551d20043b3039303706096086480186fd6c0301302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f43505330818606082b06010505070101047a3078302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305006082b060105050730028644687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274486967684173737572616e6365436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d01010505000382010100ae0461da8d6a9965d3ed23707b3cc3f60dbd686f129521b93da554e70dd9082648898809d4463c0b5f3cbb64ad49ef969469ba4054377351fb58b57c4f5c1712aebbebc35dbbe186b9d740e12106491d567c2f9cbe5e5def5631d3eb0197c8b373a2f410c9acd4191c356badd878aa8a310a65f64b027f084f35b934ae975c9afef2130e954f2db2e32608346518d25bc31ba6a2298787caaec027d8ae5ad16317e43f5c105a6c196479c3e507eb25721a4c33a2af8989d82ea04d5d2c562f903b0aeedd533c1e8da16a7c785d41dc679592bf00efe91d8b4a3f8c3b60c28d0e3bf2d4a61a863806980181f215e513bf3cbb902f8e7985a5d88ef649b14a4ed9	v1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4528	n.exe
4528	n.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	n.exe
Token: SeDebugPrivilege	4528	n.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1140	v1.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1140	v1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1140	v1.exe
1140	v1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 880	1860	2026-07-20_993880e1322bee3a350031a8932b0cab_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 880 wrote to memory of 1140	880	WScript.exe	90
PID 880 wrote to memory of 4608	880	WScript.exe	92
PID 880 wrote to memory of 4528	880	WScript.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-20_993880e1322bee3a350031a8932b0cab_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_993880e1322bee3a350031a8932b0cab_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.vbe"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\v1.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\v1.exe"
    3⤵
    - Manipulates Digital Signatures
    - Executes dropped EXE
    - Drops file in Windows directory
    - Modifies system certificate store
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1140
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\n.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\n.exe" authtoken 1x4AJO3GhBONetjEVCCvMEGTuMI_3jKWJscYd9FRW1JfKdQag
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4608
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\n.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\n.exe" tcp 7575
    3⤵
    - Executes dropped EXE
    - Modifies trusted root certificate store through registry
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Visual Basic

1

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

3

T1553

Install Root Certificate

2

T1553.004

SIP and Trust Provider Hijacking

1

T1553.003

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

n.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\n.exe
Size 29.9MB
SHA256 bbc243ad331536c7d5e244d6efb74679559bed457edd5ee9f2ce1bd45430fe12
MD5 1f994b3055e7791ecda9313739c004bc
SHA1 fef7da6f547b9eab0e08904cb673062d5506be08
SHA512 b3eda3ebc0aea9de5a2c725938fce6fd4f12fb278734f0aeedcc4ea9245a38ee4ae68ea45045ee7e1f040774a1f9ea188f70edc7a76fdf9d23e38b034a77b303
SSDEEP 196608:yaLy2pV9jl/FsXoK5XMASzWmqCL6UvaNqgIpjnuLXvE01jl4ZzASHJHf+X+Q0JHQ:JfsJ585NLTCJGuLXcpHvSP
TLSH
T1B7674B41FECB12F5EA471430549BB26F233A1D058B28CBD7EB04BA26F8775961D7630A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start.vbe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.vbe
Size 644B
SHA256 5d5f206778793093fe9509e6424a7fbcb948917fd863006e9818c69791545b37
MD5 3d7bf3a8077eb00988edec42d0cbff38
SHA1 873ec8f1b28abc64e53a19e1bc30f86a10787fc4
SHA512 136a8eef712e07c02e24c84501ecb5250e87eae13f848859c79bd452deb98283f002233b204b0762b5fe34d55c5b05cd4da042cb0fe4a1a2b009d096d0c6cc3c
TLSH
T12FF023E5D7E3137645C593E35E09306028143E07417D37508C69C929D2259A6636D9A1
MD5 SHA1 SHA512 TLSH

Submit Download

v1.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\v1.exe
Size 3.3MB
SHA256 add5d7e32758096df079f3047aaf486f287e8c172f77d8d49f60805ec7f5d6ad
MD5 39f89e74071a43eda70d6b36e56570c2
SHA1 c6d0afab037ae45d6a7163ab729603ed180d3119
SHA512 237a6be47e6f3e9e094b928673c557e4b1ec6dd6e0e951f73a64894a7a25c55197bea9282844c0a191de68d36a095087df65fa7319c6b1c35b5edc3252fb7a77
SSDEEP 98304:eE2ohDdRZi/a+ApwtwtwjZH3JyNzv15Tm:KoLRRnmmtGH2zy
TLSH
T1DBF533AD540B0C83F1752831BA76FB77F4762E055640D56208EBBF2331BF6B160B6A92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ngrok.yml

Path C:\Users\Admin\AppData\Local\ngrok\ngrok.yml
Size 85B
SHA256 0ad07ae4327d6e2ef9c253482dbb9e770571bcdfcc505b17d8a8523197abef50
MD5 d1da1c34d5e49e8b40736b8cdbb1c083
SHA1 3e7b4df9a3ebc3ef0988a44cdbf50d00e5c11415
SHA512 660233a40036643ad21440be847a98c9d268beb4c8ede7bb227593263dabb3e2a5195372f654c5384dd1947dd343ebde40a6f988e1685eee5fcc69f44aa1b5c1
TLSH
T150A012418042C870B11031132204BA45414666546052012112597F401F43C03708C60D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1140-13-0x00007FF654AC0000-0x00007FF6555E3000-memory.dmp

Download

memory/1140-23-0x00007FF654AC0000-0x00007FF6555E3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads