Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
01/08/2026, 17:30
General
- Target 2026-08-01_15f9a1798d913615567db24626222f4d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 3.0MB
- Sample260801-v3j1eaec44
- SHA256 f51a70afb48f0687d35c2c1f22263f2cd84ed78a38134776cf8595bd559aab5f
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- UPX dump on OEP (original entry point) 30 IoCs
- XMRig Miner payload 26 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 31 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_15f9a1798d913615567db24626222f4d_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_15f9a1798d913615567db24626222f4d_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\okla.exe"C:\Users\Admin\AppData\Local\Temp\okla.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\conhost.execonhost.exe --algo=rx/0 --url=pool.hashvault.pro:443 --user="44nkuDevyMkUnE7Lc4kJThfZqW3zyQ62nZxB9Ca6ikxTK7SMYdLmb9eSdp3PcYDwziHMN1xyq3Yq7BNcbGXDCBhWMzEVEBX" --pass="2031" --cpu-max-threads-hint=100 --randomx-no-rdmsr --tls3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
okla.exe
memory/3176-12-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-11-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-13-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-14-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-15-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-17-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-19-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-23-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-24-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-25-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-22-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-21-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-20-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-18-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-16-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-26-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-30-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-34-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-31-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-38-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-36-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-35-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-33-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-29-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-32-0x0000016398D20000-0x0000016398D40000-memory.dmp
memory/3176-27-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-28-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-37-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-39-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-41-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-42-0x0000000140000000-0x00000001408E0000-memory.dmp
memory/3176-43-0x0000000140000000-0x00000001408E0000-memory.dmp