0993d559f974df5dfdf20f08f9ed451f2bd0b6483752733e786ac4510ebe9793

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_8f1f31b065eec9acd5d7b85862053c4b_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 13.4MB
Sample260807-vvncvszfra
SHA256 0993d559f974df5dfdf20f08f9ed451f2bd0b6483752733e786ac4510ebe9793
MD5 8f1f31b065eec9acd5d7b85862053c4b
SHA1 d7030fa63853b7ffa753fa35de9655b96f63dd69
SHA512 764d969e10baa8c5824aa817999c9c09714c7286c8c66aa364001aa89bc61b96499ff4d62f326ac34d15ba315e16c0666bf22e693ee173ad188ec1245e5d7ba9
SSDEEP 393216:PvtVzDip2JM7h8Ph9K0MJygajEns5G/GbYh/:3bA2JghqLK0MJyjEns5G/H/
TLSH
T1A0E6330CD2EA04A9E1B6F6708AE1C816DE777C965770C1CF0768596B1F23A94CE3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	2026-08-07_8f1f31b065eec9acd5d7b85862053c4b_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6108	mspaint.exe
6108	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
6108	mspaint.exe
6108	mspaint.exe
6108	mspaint.exe
6108	mspaint.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5616 wrote to memory of 6108	5616	2026-08-07_8f1f31b065eec9acd5d7b85862053c4b_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-07_8f1f31b065eec9acd5d7b85862053c4b_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_8f1f31b065eec9acd5d7b85862053c4b_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5616
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\nullsec.jpeg"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:6108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nullsec.jpeg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\nullsec.jpeg
Size 26KB
SHA256 6007d5b4ac756b5283e6450c107aef86189693dbcb18eee57fc14dabf27897fa
MD5 a711594148e1241b50dc7bc72f4d5527
SHA1 50c775fb1dfed68af730735b97ee366fe9c0d3f5
SHA512 2581e1cff66f83623f99d64b688335004edd0147ed10ecbd53b0a4369d54af7d7f5f62b24d9fa2599b99d5330a761cb7864d862fa204591ac044589a983cf42e
SSDEEP 384:KvwcYqrQ/W7lKOhdQsrdYzmXxurAYXTuOcSvswKBh5kEudek3dWLQT:x7O77dQs+z/rAM6OLswe5b83dWO
TLSH
T1E4C2D0D1BAB15082EF0DA370BC5246F8FAB6DD30F7A9354471A089912B0E350AA19F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download