Overview

overview

7

Static

static

3

2026-08-09...lc.exe

windows10-2004-x64

7

2026-08-09...lc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 21:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_dcce5b5c65c8a20647f51d7f19498643_cryptbot_icedid_luca-stealer_njrat_stealc.exe
  • Size 11.9MB
  • Sample260809-1j91dadr71
  • SHA256 f20c41b5eb90900c2e63f403d143b85d70569c854dbb7428ee0f9b30d3175182
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 34 IoCs
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_dcce5b5c65c8a20647f51d7f19498643_cryptbot_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_dcce5b5c65c8a20647f51d7f19498643_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1424
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\architect-stats.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\architect-stats.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:6012

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        SimilDll.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SimilDll.dll
        • Size 288KB
        • SHA256 4eaef8cdf433989424e0f614e2660c00418fbe48d8854c31ec97faa3e759653d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        architect-stats.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\architect-stats.exe
        • Size 1.1MB
        • SHA256 34445c9073961e8f88665aef81b9632a5bdff1a03ba9f17b811ff1897e3ef1cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        atom.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\atom.dll
        • Size 48KB
        • SHA256 1f165172556a292209b13ca8105d10d5d4d5747d0d8be822b593581460487d9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bl-service-provider.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bl-service-provider.dll
        • Size 350KB
        • SHA256 f3f0adba8dd795756a53e4614c16ef1334fadff2c9043f34851c5fee42013b10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bl.dll
        • Size 3.0MB
        • SHA256 c59e1e419a0d6a8eaa31c15b5f94160d7023fd86dc34f42284ab9822fb3509a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        boost_filesystem-vc143-mt-x64-1_85.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\boost_filesystem-vc143-mt-x64-1_85.dll
        • Size 157KB
        • SHA256 946d13eb67d8f7d64f3757b89de68c84a43ac04dd7df95637cd75120eb4147de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        boost_serialization-vc143-mt-x64-1_85.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\boost_serialization-vc143-mt-x64-1_85.dll
        • Size 230KB
        • SHA256 ddcc7711ac651e4461bab68971d5ea12a924b893355bd3f262f8031181d4644d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        boost_thread-vc143-mt-x64-1_85.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\boost_thread-vc143-mt-x64-1_85.dll
        • Size 86KB
        • SHA256 ca1aec7adadd60683c8ab288c6b14ad941eff629b1d3f93f610d36ffe16ea248
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        boost_wserialization-vc143-mt-x64-1_85.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\boost_wserialization-vc143-mt-x64-1_85.dll
        • Size 180KB
        • SHA256 da997d2498ad041b6add115f3768d2fe8c44e4a6a72977762f6a2939724c956b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        brand.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\brand.dll
        • Size 161KB
        • SHA256 04faea240c912f10d97a73bfcf824d4bec602d9a6eea429eaccb156fa5d7941a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bz2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bz2.dll
        • Size 87KB
        • SHA256 a276745c90708ac7bba2a578c002d16c211558b7f29cc9b4c7f8f2359433dcd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        crash-handler.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\crash-handler.dll
        • Size 880KB
        • SHA256 91023c4284e4b13f3104eaedcdadd413f19ce23019c836892114be1ea112cf40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        encoding-conversion.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\encoding-conversion.dll
        • Size 24KB
        • SHA256 368bbb1900b54fb2f09a3b872f60d072f02c4695ac30093ea2fb9b67f6d21f18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libCras.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libCras.dll
        • Size 1.6MB
        • SHA256 bb7ce7efcb4cb688b9e60b4cf577dd159ccead99ce737944e088fe69398946a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libcrypto-3-x64.dll
        • Size 4.5MB
        • SHA256 fed60fdb8495fb0d130375fa86c5687da503b87b779344bae9e21fea1e21df82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcurl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libcurl.dll
        • Size 616KB
        • SHA256 1e0138c16eeb9165932d6705d7f5cf7ce856f3be70aa6aedd3d615591beb49f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libssl-3-x64.dll
        • Size 812KB
        • SHA256 663569d28d1164486bd2e524177e3da69fb53cf743dd9f03e0c708e25327b72d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logger.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\logger.dll
        • Size 266KB
        • SHA256 b6b91c459ed0328aff9435b412aa328615a0ed7008739ab5544863771c4bd319
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\msvcp140.dll
        • Size 557KB
        • SHA256 72fe4598f0b75d31ce2dc621e8ef161338c6450bb017cd06895745690603729e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_atomic_wait.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\msvcp140_atomic_wait.dll
        • Size 55KB
        • SHA256 a94b88a257e64514a7e19bbec522391f2838ac9307d597adb2d3eaf88f854de3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification-service.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\notification-service.dll
        • Size 112KB
        • SHA256 65e5ea0ce5d1c690587c6325d7669d75e624c8026e46e5c9b106135192cb73ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        root-service-provider.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\root-service-provider.dll
        • Size 351KB
        • SHA256 97fd48b041bca23362bceb95c2b5e9cfee171ee6c440c22040a4421b89e2bb28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bl.csp
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\sp\bl\bl.csp
        • Size 2KB
        • SHA256 edf5c99ae1ef33a12f34a540bbbc6ab8b232d2f7ab52121747e158a1542c2870
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        root.csp
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\sp\root\root.csp
        • Size 9KB
        • SHA256 52dee7d5610750b40b460ea937cf915ac4ef2dfedffc449f339830835c561b30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\vcruntime140.dll
        • Size 96KB
        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\vcruntime140_1.dll
        • Size 37KB
        • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win-specific-services.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\win-specific-services.dll
        • Size 432KB
        • SHA256 a0dca7a12188bac7b572bcc4dd97162a2f0ea151e6e95daa3e93de013ee921c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zip.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\zip.dll
        • Size 121KB
        • SHA256 8036c1cf20ada99abc5a50c783f6eb2fc0de4a70e1947f562c3ba94769735be7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\zlib1.dll
        • Size 100KB
        • SHA256 566ecf29d557f8efed6f4cfa5e1fb8c7e0a77e76a891ff0305be3500a2ded6f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/6012-308-0x00000283D94C0000-0x00000283D94D0000-memory.dmp
        Download

        memory/6012-311-0x00000283F1BE0000-0x00000283F1D80000-memory.dmp
        Download

        memory/6012-307-0x00007FFE1D620000-0x00007FFE1D66D000-memory.dmp
        Download

        memory/6012-306-0x00000283D9180000-0x00000283D91CD000-memory.dmp
        Download

        memory/6012-312-0x00007FFE1B520000-0x00007FFE1B6C0000-memory.dmp
        Download

        memory/6012-329-0x00000283D91D0000-0x00000283D91E8000-memory.dmp
        Download

        memory/6012-328-0x00000283D9130000-0x00000283D9150000-memory.dmp
        Download

        memory/6012-330-0x00000283D94C0000-0x00000283D94D0000-memory.dmp
        Download

        memory/6012-338-0x00000283F2570000-0x00000283F2A9D000-memory.dmp
        Download

        memory/6012-340-0x00000283D93F0000-0x00000283D944D000-memory.dmp
        Download