Analysis
- max time kernel
75s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 10:47
General
- Target 2026-08-08_9d2fa2bc7d816bb8bdcd661dce1840c9_cloudeye_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 86.4MB
- Sample260808-mvrraavfph
- SHA256 7f8cb48384c74a47b78b45e13ee017431fed9c6b6f6d38b1be58d1ccc55e9d75
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 8 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Windows directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: MapViewOfSection 12 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_9d2fa2bc7d816bb8bdcd661dce1840c9_cloudeye_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_9d2fa2bc7d816bb8bdcd661dce1840c9_cloudeye_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\windows\LNXoEr.exe"C:\windows\LNXoEr.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Local\assembly\dl3\n4Muq7\YmDxgJ\RhZ7\eQqRsC.exe"C:\Users\Admin\AppData\Local\Local\assembly\dl3\n4Muq7\YmDxgJ\RhZ7\eQqRsC.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\windows\sysdiag-all-x64-6.0.11.1-2026.08.01.1.exe"C:\windows\sysdiag-all-x64-6.0.11.1-2026.08.01.1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
eQqRsC.exe
qVhB.xlF
tEwtsIx.f3p
DuiLib.dll
System.dll
inst.ui
installer-helper.dll
LNXoEr.exe
memory/1220-29068-0x000001D5A1700000-0x000001D5A3C05000-memory.dmp
memory/1220-29068-0x000001D5A1700000-0x000001D5A3C05000-memory.dmp
memory/4220-3434-0x00000149C2FA0000-0x00000149C54A5000-memory.dmp
memory/4220-2418-0x00000149C2FA0000-0x00000149C54A5000-memory.dmp
memory/4220-2418-0x00000149C2FA0000-0x00000149C54A5000-memory.dmp
memory/4220-3374-0x00000149C2FA0000-0x00000149C54A5000-memory.dmp
memory/4220-3596-0x00000149C2FA0000-0x00000149C54A5000-memory.dmp
memory/4220-3705-0x00000149C2FA0000-0x00000149C54A5000-memory.dmp
memory/4220-3505-0x00000149C2FA0000-0x00000149C54A5000-memory.dmp
memory/4220-3596-0x00000149C2FA0000-0x00000149C54A5000-memory.dmp
memory/4220-3505-0x00000149C2FA0000-0x00000149C54A5000-memory.dmp
memory/4220-3705-0x00000149C2FA0000-0x00000149C54A5000-memory.dmp
memory/4220-3434-0x00000149C2FA0000-0x00000149C54A5000-memory.dmp
memory/4220-3374-0x00000149C2FA0000-0x00000149C54A5000-memory.dmp
memory/4372-42-0x0000000070000000-0x0000000070001000-memory.dmp
memory/4372-42-0x0000000070000000-0x0000000070001000-memory.dmp
memory/4424-93-0x0000000000EC0000-0x0000000001226000-memory.dmp
memory/4424-93-0x0000000000EC0000-0x0000000001226000-memory.dmp
memory/4424-18-0x0000000000EC0000-0x0000000001226000-memory.dmp
memory/4424-16-0x00000000011B1000-0x00000000011B3000-memory.dmp
memory/4424-18-0x0000000000EC0000-0x0000000001226000-memory.dmp
memory/4424-16-0x00000000011B1000-0x00000000011B3000-memory.dmp