Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 01:48
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-29_9066149eab5d511d3b95f8c0226ffe38_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_9066149eab5d511d3b95f8c0226ffe38_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 2026-07-29_9066149eab5d511d3b95f8c0226ffe38_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 1.7MB
- Sample260730-b8femaac29
- SHA256 5d99f57472e509d039207dab3cf56a31649b28bff8edc765d34c0323091f8d97
- MD5 9066149eab5d511d3b95f8c0226ffe38
- SHA1 505cc239113729792349bd34a5c29689715577ac
- SHA512 70661f5cbc6d4bac214e6444159bed0ff65d4473572a6c07d85bade9caa60fbf056f4f266aa6a412278d6bff1889d987d0c00ab4f73df1b94f5ed9c3ce00a887
- SSDEEP 24576:nRSfrAEH9XIYpj0BEHBsXPGfjuIb1iN1Eob4tLwqMpNAPnJCfu7Cqvf9:ngTbH94YxV321Cspqhdf9
- TLSH T1D6857C55A6A441B8E0A29578CB5EC933E7727CC60F70968F02D47DA73F33250BA297D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/files/0x000d00000001c498-19.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "0" powershell.exe - Modifies Windows Defender notification settings 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications powershell.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" powershell.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" powershell.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" powershell.exe - Executes dropped EXE 2 IoCs
pid Process 5652 UnRAR.exe 1228 Yjzlxkdoi.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 1496 WScript.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsOptions\Yjzlxkdoi.exe UnRAR.exe File opened for modification C:\Program Files\WindowsOptions 2026-07-29_9066149eab5d511d3b95f8c0226ffe38_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\__tmp_rar_sfx_access_check_240703375 2026-07-29_9066149eab5d511d3b95f8c0226ffe38_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\install.vbs 2026-07-29_9066149eab5d511d3b95f8c0226ffe38_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\WindowsOptions\run.ps1 2026-07-29_9066149eab5d511d3b95f8c0226ffe38_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\sfx.rar 2026-07-29_9066149eab5d511d3b95f8c0226ffe38_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\WindowsOptions\sfx.rar 2026-07-29_9066149eab5d511d3b95f8c0226ffe38_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\1.txt UnRAR.exe File opened for modification C:\Program Files\WindowsOptions\1.txt UnRAR.exe File opened for modification C:\Program Files\WindowsOptions\install.vbs 2026-07-29_9066149eab5d511d3b95f8c0226ffe38_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\run.ps1 2026-07-29_9066149eab5d511d3b95f8c0226ffe38_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\UnRAR.exe 2026-07-29_9066149eab5d511d3b95f8c0226ffe38_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\WindowsOptions\UnRAR.exe 2026-07-29_9066149eab5d511d3b95f8c0226ffe38_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\Yjzlxkdoi.exe UnRAR.exe -
pid Process 4736 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings 2026-07-29_9066149eab5d511d3b95f8c0226ffe38_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4736 powershell.exe 4736 powershell.exe 4736 powershell.exe 4736 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4736 powershell.exe Token: SeIncreaseQuotaPrivilege 4736 powershell.exe Token: SeSecurityPrivilege 4736 powershell.exe Token: SeTakeOwnershipPrivilege 4736 powershell.exe Token: SeLoadDriverPrivilege 4736 powershell.exe Token: SeSystemProfilePrivilege 4736 powershell.exe Token: SeSystemtimePrivilege 4736 powershell.exe Token: SeProfSingleProcessPrivilege 4736 powershell.exe Token: SeIncBasePriorityPrivilege 4736 powershell.exe Token: SeCreatePagefilePrivilege 4736 powershell.exe Token: SeBackupPrivilege 4736 powershell.exe Token: SeRestorePrivilege 4736 powershell.exe Token: SeShutdownPrivilege 4736 powershell.exe Token: SeDebugPrivilege 4736 powershell.exe Token: SeSystemEnvironmentPrivilege 4736 powershell.exe Token: SeRemoteShutdownPrivilege 4736 powershell.exe Token: SeUndockPrivilege 4736 powershell.exe Token: SeManageVolumePrivilege 4736 powershell.exe Token: 33 4736 powershell.exe Token: 34 4736 powershell.exe Token: 35 4736 powershell.exe Token: 36 4736 powershell.exe Token: SeIncreaseQuotaPrivilege 4736 powershell.exe Token: SeSecurityPrivilege 4736 powershell.exe Token: SeTakeOwnershipPrivilege 4736 powershell.exe Token: SeLoadDriverPrivilege 4736 powershell.exe Token: SeSystemProfilePrivilege 4736 powershell.exe Token: SeSystemtimePrivilege 4736 powershell.exe Token: SeProfSingleProcessPrivilege 4736 powershell.exe Token: SeIncBasePriorityPrivilege 4736 powershell.exe Token: SeCreatePagefilePrivilege 4736 powershell.exe Token: SeBackupPrivilege 4736 powershell.exe Token: SeRestorePrivilege 4736 powershell.exe Token: SeShutdownPrivilege 4736 powershell.exe Token: SeDebugPrivilege 4736 powershell.exe Token: SeSystemEnvironmentPrivilege 4736 powershell.exe Token: SeRemoteShutdownPrivilege 4736 powershell.exe Token: SeUndockPrivilege 4736 powershell.exe Token: SeManageVolumePrivilege 4736 powershell.exe Token: 33 4736 powershell.exe Token: 34 4736 powershell.exe Token: 35 4736 powershell.exe Token: 36 4736 powershell.exe Token: SeIncreaseQuotaPrivilege 4736 powershell.exe Token: SeSecurityPrivilege 4736 powershell.exe Token: SeTakeOwnershipPrivilege 4736 powershell.exe Token: SeLoadDriverPrivilege 4736 powershell.exe Token: SeSystemProfilePrivilege 4736 powershell.exe Token: SeSystemtimePrivilege 4736 powershell.exe Token: SeProfSingleProcessPrivilege 4736 powershell.exe Token: SeIncBasePriorityPrivilege 4736 powershell.exe Token: SeCreatePagefilePrivilege 4736 powershell.exe Token: SeBackupPrivilege 4736 powershell.exe Token: SeRestorePrivilege 4736 powershell.exe Token: SeShutdownPrivilege 4736 powershell.exe Token: SeDebugPrivilege 4736 powershell.exe Token: SeSystemEnvironmentPrivilege 4736 powershell.exe Token: SeRemoteShutdownPrivilege 4736 powershell.exe Token: SeUndockPrivilege 4736 powershell.exe Token: SeManageVolumePrivilege 4736 powershell.exe Token: 33 4736 powershell.exe Token: 34 4736 powershell.exe Token: 35 4736 powershell.exe Token: 36 4736 powershell.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3436 wrote to memory of 1496 3436 2026-07-29_9066149eab5d511d3b95f8c0226ffe38_cryptbot_icedid_luca-stealer_njrat_stealc.exe 89 PID 1496 wrote to memory of 4736 1496 WScript.exe 90 PID 4736 wrote to memory of 2016 4736 powershell.exe 92 PID 4736 wrote to memory of 5652 4736 powershell.exe 94 PID 4736 wrote to memory of 1228 4736 powershell.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_9066149eab5d511d3b95f8c0226ffe38_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_9066149eab5d511d3b95f8c0226ffe38_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsOptions\install.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "run.ps1"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender notification settings
- UAC bypass
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\system32\CiTool.exe"C:\Windows\system32\CiTool.exe" -r4⤵PID:2016
-
-
C:\Program Files\WindowsOptions\UnRAR.exe"C:\Program Files\WindowsOptions\UnRAR.exe" x -y -pByeFriend! "C:\Program Files\WindowsOptions\sfx.rar" "C:\Program Files\WindowsOptions\"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5652
-
-
C:\Program Files\WindowsOptions\Yjzlxkdoi.exe"C:\Program Files\WindowsOptions\Yjzlxkdoi.exe"4⤵
- Executes dropped EXE
PID:1228
-
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\WindowsOptions\UnRAR.exe
- Size 547KB
- SHA256 e785a0c0dcf79385f0483c1eb2242e3937d0447f6b21dd158906e92757b46542
- MD5 8d4630a7958517737dba1ab88045373b
- SHA1 5816798803373fd3dd7bd1823ab8c92a824c441c
- SHA512 99d44318285e53c720400041c2367cf5bc6d421d2cb6f8c0c5eb7478c4997f4e74aba85973fa4b00cb893da1821ecdd2c9c1b7fa04e010454ed15e214f25755b
- SSDEEP 6144:ViSm+owa1lGp1pN/hm7ifjDG0opa9wJEZoaiokUI+2GIqMvpCE4mODiUU9sbHAhi:QXPGp1j/k0SrICIio/KNzAiREOzb4P
- TLSH T1F8C47C5AA7E403BCE0B7D674C9914902FB77BC4907B1AA8F03E444B75F276518E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WindowsOptions\Yjzlxkdoi.exe
- Size 1.7MB
- SHA256 2e9afce82e3854e33607933aafa3cb7da813580f7a2a0c05adf242e5c9a7db19
- MD5 ad994161bc4a8cfa684f99254d808eb9
- SHA1 63cf499f16379840ecef5eaabf759631affd5bde
- SHA512 e8402fefb8ee8828ec4a7bd387aa971d2dd57496e0f6023ae452ac547bd65e1d697a171f7d99dab3d695d2986779b5aeacd0c402bc97e04964bf89b00209c0cb
- SSDEEP 12288:f5NQDlqCavUeT9JM5dzQlI5aL9OKSBt3ZuR7dSq0dzC22Hbudm1Xpc:f3QDlqBvZ9CDQlI4xMt3kl0BCrU
- TLSH T13485C50BEA7552E1C1BAD039D542612FFC7034A683706BD7A68A9B171B237F4E93E740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WindowsOptions\install.vbs
- Size 98B
- SHA256 a0110f07fe8d70b8c7f8d6d973f54a2cae6c8fbf09e7ae6b780f5598af903474
- MD5 b95bd766c9aa886726bcaf30577eeb23
- SHA1 ec53efe0d8a5d62d17e2609ed242e476982bcc1d
- SHA512 c27672412c356bbe6dbfb440141328f22f85754484ac9bdf66f0f64dd57f44137d319a4c674bf8af3b58fe5a8e8a0e7150f055590fe821c1364f7cfde631b5ff
- TLSH T17BB01218F504C3EC067BC4EE1175C42C8CA864A9A210875EB37092087248234D365146
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\WindowsOptions\run.ps1
- Size 23KB
- SHA256 4220408adec9f0ff9dd034efa7e71ffd0d6cdf229a147981de240d90f65bdf87
- MD5 b1339765214ee3f26067db1be03faeb7
- SHA1 e3b85c82531cf393ed5d37fbd9ac904f59d39d24
- SHA512 eceaae405c9f96e3698835b5a12110ba32860ed4685f81a42d854f7a92fea481e36e9fb831693ca3c106f744a4829e7c9cefe3027e11dd988fbaa39d44c2f031
- SSDEEP 384:+I43204WryHQ8YvPvF5xpmDCzFLZ0exEZBxy5HRp5lsFY5opRSyFTMrmyAD8PHb0:dA2Dynpxd0LZBxIPD0Voq2Ad
- TLSH T1AFB2D242A7FA0108F1F76B45EA7B08754A37BC55593AC90D519C688E0BF3E1498A2FF3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WindowsOptions\sfx.rar
- Size 432KB
- SHA256 f2612f637b19eb34703232abcae1689e5b0d13a29d00ea43125b0a8f3c0f1c50
- MD5 382aa6c04d69473b3a9662697fed3996
- SHA1 c8768f5b6c5890c5d7f3a417b94bb0f017df384a
- SHA512 907a4d00a3c5866d8acc52dc4629d9817f70e80aa89de1f54cd0308c9333829b45a14f4dd28a1f6df294f0bf7eb6971f8cad3200dbb5a397af0c59762ab7fefb
- SSDEEP 12288:lLm5LqkIcpn6qKhWYVdc+igTtCfKTZRRHpjEqvf2cMt:lLwqMpNAPnJCfu7Cqvfy
- TLSH T1DC942357C59A21E80FA487BD682E8BD8C240D4D664CE902DF51C124F2CBD4E2DDB78BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_unysriee.3bc.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH