Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 10:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_888e8615b25c3a488306a9b442aa8458_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_888e8615b25c3a488306a9b442aa8458_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target 2026-08-09_888e8615b25c3a488306a9b442aa8458_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 1.9MB
- Sample260809-l2lceadk7z
- SHA256 df08e24c16c3bb424d50f4b72674aea5c14a6a69049ec94d52ba55d2ec76c9ec
- MD5 888e8615b25c3a488306a9b442aa8458
- SHA1 4862c423011faa0ffd1a3fbab9e97e8c87505c3b
- SHA512 d6ee3f6870c8280f7538a3b882aaa2c89fe3a2cecc781171f48bab9437b735ba339b857d9ed044210300c7819ab7056457ed793acd9dc6bc511271975554e753
- SSDEEP 24576:nRSfrAEH9XIYpj0BEHBJXPGfjuIb1iN1Eob47aSCPCSJESHJMjfHSRLhph7KwF2:ngTbH94YxVi21ISqSJCfIFph+/
- TLSH T1DC959D55A6A442B8D0A69578CB8EC933E7727CC60F70968F03D47DA73F232507A297D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/files/0x000d00000001c4e5-17.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "0" powershell.exe - Modifies Windows Defender notification settings 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" powershell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications powershell.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" powershell.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" powershell.exe - Executes dropped EXE 3 IoCs
pid Process 796 UnRAR.exe 1224 WinLogonHe1per.exe 4084 sO7ow.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 4864 WScript.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsOptions\run.ps1 2026-08-09_888e8615b25c3a488306a9b442aa8458_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\sO7ow.exe UnRAR.exe File opened for modification C:\Program Files\WindowsOptions\sO7ow.exe UnRAR.exe File created C:\Program Files\WindowsOptions\install.vbs 2026-08-09_888e8615b25c3a488306a9b442aa8458_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\WindowsOptions\UnRAR.exe 2026-08-09_888e8615b25c3a488306a9b442aa8458_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\sfx.rar 2026-08-09_888e8615b25c3a488306a9b442aa8458_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\WindowsOptions\sfx.rar 2026-08-09_888e8615b25c3a488306a9b442aa8458_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\WinLogonHe1per.exe UnRAR.exe File opened for modification C:\Program Files\WindowsOptions\WinLogonHe1per.exe UnRAR.exe File opened for modification C:\Program Files\WindowsOptions 2026-08-09_888e8615b25c3a488306a9b442aa8458_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\__tmp_rar_sfx_access_check_240751765 2026-08-09_888e8615b25c3a488306a9b442aa8458_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\WindowsOptions\install.vbs 2026-08-09_888e8615b25c3a488306a9b442aa8458_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\UnRAR.exe 2026-08-09_888e8615b25c3a488306a9b442aa8458_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\run.ps1 2026-08-09_888e8615b25c3a488306a9b442aa8458_cryptbot_icedid_luca-stealer_njrat_stealc.exe -
pid Process 3256 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WinLogonHe1per.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings 2026-08-09_888e8615b25c3a488306a9b442aa8458_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3256 powershell.exe 3256 powershell.exe 3256 powershell.exe 3256 powershell.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe 1224 WinLogonHe1per.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3256 powershell.exe Token: SeIncreaseQuotaPrivilege 3256 powershell.exe Token: SeSecurityPrivilege 3256 powershell.exe Token: SeTakeOwnershipPrivilege 3256 powershell.exe Token: SeLoadDriverPrivilege 3256 powershell.exe Token: SeSystemProfilePrivilege 3256 powershell.exe Token: SeSystemtimePrivilege 3256 powershell.exe Token: SeProfSingleProcessPrivilege 3256 powershell.exe Token: SeIncBasePriorityPrivilege 3256 powershell.exe Token: SeCreatePagefilePrivilege 3256 powershell.exe Token: SeBackupPrivilege 3256 powershell.exe Token: SeRestorePrivilege 3256 powershell.exe Token: SeShutdownPrivilege 3256 powershell.exe Token: SeDebugPrivilege 3256 powershell.exe Token: SeSystemEnvironmentPrivilege 3256 powershell.exe Token: SeRemoteShutdownPrivilege 3256 powershell.exe Token: SeUndockPrivilege 3256 powershell.exe Token: SeManageVolumePrivilege 3256 powershell.exe Token: 33 3256 powershell.exe Token: 34 3256 powershell.exe Token: 35 3256 powershell.exe Token: 36 3256 powershell.exe Token: SeIncreaseQuotaPrivilege 3256 powershell.exe Token: SeSecurityPrivilege 3256 powershell.exe Token: SeTakeOwnershipPrivilege 3256 powershell.exe Token: SeLoadDriverPrivilege 3256 powershell.exe Token: SeSystemProfilePrivilege 3256 powershell.exe Token: SeSystemtimePrivilege 3256 powershell.exe Token: SeProfSingleProcessPrivilege 3256 powershell.exe Token: SeIncBasePriorityPrivilege 3256 powershell.exe Token: SeCreatePagefilePrivilege 3256 powershell.exe Token: SeBackupPrivilege 3256 powershell.exe Token: SeRestorePrivilege 3256 powershell.exe Token: SeShutdownPrivilege 3256 powershell.exe Token: SeDebugPrivilege 3256 powershell.exe Token: SeSystemEnvironmentPrivilege 3256 powershell.exe Token: SeRemoteShutdownPrivilege 3256 powershell.exe Token: SeUndockPrivilege 3256 powershell.exe Token: SeManageVolumePrivilege 3256 powershell.exe Token: 33 3256 powershell.exe Token: 34 3256 powershell.exe Token: 35 3256 powershell.exe Token: 36 3256 powershell.exe Token: SeIncreaseQuotaPrivilege 3256 powershell.exe Token: SeSecurityPrivilege 3256 powershell.exe Token: SeTakeOwnershipPrivilege 3256 powershell.exe Token: SeLoadDriverPrivilege 3256 powershell.exe Token: SeSystemProfilePrivilege 3256 powershell.exe Token: SeSystemtimePrivilege 3256 powershell.exe Token: SeProfSingleProcessPrivilege 3256 powershell.exe Token: SeIncBasePriorityPrivilege 3256 powershell.exe Token: SeCreatePagefilePrivilege 3256 powershell.exe Token: SeBackupPrivilege 3256 powershell.exe Token: SeRestorePrivilege 3256 powershell.exe Token: SeShutdownPrivilege 3256 powershell.exe Token: SeDebugPrivilege 3256 powershell.exe Token: SeSystemEnvironmentPrivilege 3256 powershell.exe Token: SeRemoteShutdownPrivilege 3256 powershell.exe Token: SeUndockPrivilege 3256 powershell.exe Token: SeManageVolumePrivilege 3256 powershell.exe Token: 33 3256 powershell.exe Token: 34 3256 powershell.exe Token: 35 3256 powershell.exe Token: 36 3256 powershell.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2608 wrote to memory of 4864 2608 2026-08-09_888e8615b25c3a488306a9b442aa8458_cryptbot_icedid_luca-stealer_njrat_stealc.exe 88 PID 4864 wrote to memory of 3256 4864 WScript.exe 89 PID 3256 wrote to memory of 5772 3256 powershell.exe 91 PID 3256 wrote to memory of 796 3256 powershell.exe 93 PID 3256 wrote to memory of 1224 3256 powershell.exe 95 PID 3256 wrote to memory of 4084 3256 powershell.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_888e8615b25c3a488306a9b442aa8458_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_888e8615b25c3a488306a9b442aa8458_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsOptions\install.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "run.ps1"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender notification settings
- UAC bypass
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\system32\CiTool.exe"C:\Windows\system32\CiTool.exe" -r4⤵PID:5772
-
-
C:\Program Files\WindowsOptions\UnRAR.exe"C:\Program Files\WindowsOptions\UnRAR.exe" x -y -pByeFriend! "C:\Program Files\WindowsOptions\sfx.rar" "C:\Program Files\WindowsOptions\"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:796
-
-
C:\Program Files\WindowsOptions\WinLogonHe1per.exe"C:\Program Files\WindowsOptions\WinLogonHe1per.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1224
-
-
C:\Program Files\WindowsOptions\sO7ow.exe"C:\Program Files\WindowsOptions\sO7ow.exe"4⤵
- Executes dropped EXE
PID:4084
-
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\WindowsOptions\UnRAR.exe
- Size 547KB
- SHA256 e785a0c0dcf79385f0483c1eb2242e3937d0447f6b21dd158906e92757b46542
- MD5 8d4630a7958517737dba1ab88045373b
- SHA1 5816798803373fd3dd7bd1823ab8c92a824c441c
- SHA512 99d44318285e53c720400041c2367cf5bc6d421d2cb6f8c0c5eb7478c4997f4e74aba85973fa4b00cb893da1821ecdd2c9c1b7fa04e010454ed15e214f25755b
- SSDEEP 6144:ViSm+owa1lGp1pN/hm7ifjDG0opa9wJEZoaiokUI+2GIqMvpCE4mODiUU9sbHAhi:QXPGp1j/k0SrICIio/KNzAiREOzb4P
- TLSH T1F8C47C5AA7E403BCE0B7D674C9914902FB77BC4907B1AA8F03E444B75F276518E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WindowsOptions\WinLogonHe1per.exe
- Size 416KB
- SHA256 e169a188cf6adc299d3600e4a14c79c738a18dee4060e794ec34eab11e45b30f
- MD5 e2710e301fa96d38a1afad2ee3091c07
- SHA1 5373260027f464b001d59dcee85ab34454ee9410
- SHA512 39cec524d8791b28cc0528fdd997018ec5d35ff382d9b77d21af44bfd39b9679272a9f3df50af8d5e20ab972963d677edeff463771867fef538cd49974843ce0
- SSDEEP 6144:8Kr+F0OPQYtGE8N1xovqcfRJy7vITt21KuhBo:bql8BxoPffiXkuh
- TLSH T19294293B32A58F21C3461373C1C7590187A646873AB7EB0B35D513DA09463FEEE5A29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WindowsOptions\install.vbs
- Size 98B
- SHA256 a0110f07fe8d70b8c7f8d6d973f54a2cae6c8fbf09e7ae6b780f5598af903474
- MD5 b95bd766c9aa886726bcaf30577eeb23
- SHA1 ec53efe0d8a5d62d17e2609ed242e476982bcc1d
- SHA512 c27672412c356bbe6dbfb440141328f22f85754484ac9bdf66f0f64dd57f44137d319a4c674bf8af3b58fe5a8e8a0e7150f055590fe821c1364f7cfde631b5ff
- TLSH T17BB01218F504C3EC067BC4EE1175C42C8CA864A9A210875EB37092087248234D365146
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\WindowsOptions\run.ps1
- Size 24KB
- SHA256 75b78f8e11008c74e5622f039f75be8ac82611ff7e0857994702f29086b0e3fb
- MD5 20c9856c1f25602f4244ca27e423a582
- SHA1 13294751911e55c30cf28ab82d7d7764fc321d07
- SHA512 5cebecf65e40def8fac799d287bbb818c3cc7a5cd7c0e37fbfe5e7eb4844639c3a905068be226c159a2537660e011c202115a4cedafa54b012d90d22b3adc844
- SSDEEP 384:+I43204WryHQ8YvPvF5xpmDCzFLZ0exEZBxy5HRp5lsFY5op018yFTMr4yAD8PH4:dA2Dynpxd0LZBxIPD003o02Ad
- TLSH T1B2B2C042A7FA0108F1F76B45EA7B08750A37BC55593AC90D519C688E0BF3A1498E3FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WindowsOptions\sO7ow.exe
- Size 1.7MB
- SHA256 f6bbcce1c2a1f887928233d13ea4603c9161627705836858b3d68906f11d7f82
- MD5 63f9b724a697c09e44143b7b3b2f8953
- SHA1 b3990c28209296fecee7ed296975693ecc3a1001
- SHA512 cabf9028b323a6c60218477db09d12bd3e58fd4906995ed487c452a926bbf0ebcc8d61db9ac2c10e29d063eef17d3cfaa46964315bbcb4d6c982d694967fec5f
- SSDEEP 24576:U5exKGLlK4ceyu2nhVJ4dr8TG9y91TwQbiwM:I8KGk4cluChVJd91TjVM
- TLSH T12985C60BAA7552E1C1BAD039D542612FFC7134A6833097D7B68A9B171B23BF4E93E740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WindowsOptions\sfx.rar
- Size 647KB
- SHA256 3810a7dd21fef5b5066b24b214950dbbc1f7933e66e90b5d76a4b033a4021c12
- MD5 4333a9d04ec1187a8f7f15d1d502e57b
- SHA1 02a78b91cb29e26b306ec820457788d9b74e46f4
- SHA512 2281a8f5b87871a66aa6877da50dba80037c4dc05193def34d4343499567e1c657ef14244cd3a352d61008ff169236b97b64c3d43d516e88e4367e6b5539667c
- SSDEEP 12288:dZbbaGDC0ACSOk1CM+Dlw95D1MjJhvvJ6LLS4msRHsk5h1Ph7KuvR:TaSCPCSJESHJMjfHSRLhph7KwR
- TLSH T1F2E42384D40162684F4CF65D5AC50CBEA9B7C7DA8B89C8C7E518FC08DED6E34CAA815F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rfasawbc.w01.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH