2247a04796dbf6e9a3a60ff3c7f90850a09b22ddfb19875c0e3d4cf650652bce

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_5cc0c8023a211c50446373fc6ee925c2_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
Size 1.1MB
Sample260729-c9bnhadf86
SHA256 2247a04796dbf6e9a3a60ff3c7f90850a09b22ddfb19875c0e3d4cf650652bce
MD5 5cc0c8023a211c50446373fc6ee925c2
SHA1 65e53b82f4a3a4c63def33faf8d2be1d68573a7a
SHA512 b6fcb29460054616c255b68b0b9d93ab679936f0e001700b0bb9fa439ba9ecba5b1d76e3afcbf59efcb288bbd8af4fe08aabcc05ca55b60732e06aed469e9a59
SSDEEP 24576:SCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrv4H4444Ck8:R1H4jR2TYrQbDTrv4H4444Ck
TLSH
T14D356B0573A441EDFEABE4768B13C617C7B278450237961F06A06A766F33BB16A2F311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
5	6124	2026-07-29_5cc0c8023a211c50446373fc6ee925c2_agent-tesla_amadey_icedid_luca-stealer_njrat.exe

Executes dropped EXE 1 IoCs

pid	Process
5864	installer.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 5864	6124	2026-07-29_5cc0c8023a211c50446373fc6ee925c2_agent-tesla_amadey_icedid_luca-stealer_njrat.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-29_5cc0c8023a211c50446373fc6ee925c2_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_5cc0c8023a211c50446373fc6ee925c2_agent-tesla_amadey_icedid_luca-stealer_njrat.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Users\Public\Downloads\installer.exe
  C:\Users\Public\Downloads\installer.exe "C:\Users\Public\Downloads\config.data"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installer.exe

Path C:\Users\Public\Downloads\installer.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
TLSH
T101158C0373918062FEA7A5331F5FE7265B7C6D2A0323B52F13981E79B9701B1162E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download