d3f63bdd18e5d95eee8b6834f133cf46377b803553747a98139b2ce99ee53b15

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_9ce4bd4f77bd8c99e1fbd6d11a01effc_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
Size 1.2MB
Sample260727-ypckysdk6x
SHA256 d3f63bdd18e5d95eee8b6834f133cf46377b803553747a98139b2ce99ee53b15
MD5 9ce4bd4f77bd8c99e1fbd6d11a01effc
SHA1 37fefcf9f8ddd6d0efe5e5a1389b22ff01fcb599
SHA512 1f48f58b474894df7cbf8d159cb812a4c29c6c183ceeece68d99dfa698757ae29d8550c17d77e8d7a85a9ee1ad53f7119d562ae3e566858f23790303853916d4
SSDEEP 24576:9CZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNranpJ:q1H4jR2TYrQbDTranp
TLSH
T120455A0573A4429DFEB7EF768A02C147D6B178B61237866F02606B766F33B611A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
6	5960	2026-07-27_9ce4bd4f77bd8c99e1fbd6d11a01effc_agent-tesla_amadey_icedid_luca-stealer_njrat.exe

Executes dropped EXE 1 IoCs

pid	Process
4608	installer.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 4608	5960	2026-07-27_9ce4bd4f77bd8c99e1fbd6d11a01effc_agent-tesla_amadey_icedid_luca-stealer_njrat.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_9ce4bd4f77bd8c99e1fbd6d11a01effc_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_9ce4bd4f77bd8c99e1fbd6d11a01effc_agent-tesla_amadey_icedid_luca-stealer_njrat.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Users\Public\Downloads\installer.exe
  C:\Users\Public\Downloads\installer.exe "C:\Users\Public\Downloads\config.data"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installer.exe

Path C:\Users\Public\Downloads\installer.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
TLSH
T101158C0373918062FEA7A5331F5FE7265B7C6D2A0323B52F13981E79B9701B1162E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download