e455ebe514a88a13f96a2a86698f50436b459e1d5854f1b5673446a89e5a8d46

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_88a957c2dd9d793805596f79da6a03ed_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.0MB
Sample260802-gla5aadp5t
SHA256 e455ebe514a88a13f96a2a86698f50436b459e1d5854f1b5673446a89e5a8d46
MD5 88a957c2dd9d793805596f79da6a03ed
SHA1 6b2c07602101591aec008022243e527f28a9686b
SHA512 97dbf8c762cd4d044cb92dff8baad4a2ed1007740c800cd390478fc9b5723de62af5b094f9775940e1512b955c6a5c6ec6435b7a8f71148d82e20326978c2cb2
SSDEEP 49152:rKA5/fBjo8VI3NvmF4xqfs9QXrePf7H/F6T9BTT3k0VY9FeNVdPL4j7:rKAVsYsY2zHd6fjDfNVNm
TLSH
T166E52204D7E404F9E1B7D578CE824D52EB767C0943B1EB9F43A4B9960E272E0893EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/1288-12-0x0000000140000000-0x00000001408E0000-memory.dmp	UPX
behavioral2/memory/1288-13-0x0000000140000000-0x00000001408E0000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
1372	okla.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1372 set thread context of 1288	1372	okla.exe	90

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1288-11-0x0000000140000000-0x00000001408E0000-memory.dmp	upx
behavioral2/memory/1288-12-0x0000000140000000-0x00000001408E0000-memory.dmp	upx
behavioral2/memory/1288-13-0x0000000140000000-0x00000001408E0000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1372	okla.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5980	2026-08-02_88a957c2dd9d793805596f79da6a03ed_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5980	2026-08-02_88a957c2dd9d793805596f79da6a03ed_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5980 wrote to memory of 1372	5980	2026-08-02_88a957c2dd9d793805596f79da6a03ed_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 1372 wrote to memory of 1288	1372	okla.exe	90
PID 1372 wrote to memory of 1288	1372	okla.exe	90
PID 1372 wrote to memory of 1288	1372	okla.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-02_88a957c2dd9d793805596f79da6a03ed_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_88a957c2dd9d793805596f79da6a03ed_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Users\Admin\AppData\Local\Temp\okla.exe
  "C:\Users\Admin\AppData\Local\Temp\okla.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\system32\conhost.exe
    conhost.exe --algo=rx/0 --url=pool.hashvault.pro:443 --user="44nkuDevyMkUnE7Lc4kJThfZqW3zyQ62nZxB9Ca6ikxTK7SMYdLmb9eSdp3PcYDwziHMN1xyq3Yq7BNcbGXDCBhWMzEVEBX" --pass="2031" --cpu-max-threads-hint=100 --randomx-no-rdmsr --tls
    3⤵
    PID:1288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

okla.exe

Path C:\Users\Admin\AppData\Local\Temp\okla.exe
Size 3.0MB
SHA256 4e0c99f5527c4b35c522a674e0179a14a8370c219398065a6b542f1856bed064
MD5 4f4d7d6ef0416a99b2490f40880b32c7
SHA1 a79f21c979d5c831759eadae03d4194bbfe271cf
SHA512 c291aecda2b5bff01bc793802ddcabf8455287ff9a4f780b92f50b6f8ecc299ba8349ecc48162e8540b4bbf3fc94455382f1d7de1a92480dc5563b20d9e388cd
SSDEEP 49152:xOnIJ5awII4//JaE4WaOXlSCIogrW+IWZqJ5/ePukSjFYwEiwVFyO5V:xOsMVHnIXO1SCI3X7wPWYufFyg
TLSH
T187E53384A46395E9EF264274DA76BC60CC123159C7D8FBF31229C87072335E746B9E9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1288-11-0x0000000140000000-0x00000001408E0000-memory.dmp

Download

memory/1288-12-0x0000000140000000-0x00000001408E0000-memory.dmp

Download

memory/1288-13-0x0000000140000000-0x00000001408E0000-memory.dmp

Download