293b92c2b7a01cdd467a1bfea51db4e44b5e28597f2571f4ada6d2c607ee2d10

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_1badf88389a42319a53c0a5f462c0d74_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 81.5MB
Sample260814-15ercstvht
SHA256 293b92c2b7a01cdd467a1bfea51db4e44b5e28597f2571f4ada6d2c607ee2d10
MD5 1badf88389a42319a53c0a5f462c0d74
SHA1 efef9fa0ea5a46f00611134706a37bd412d9da20
SHA512 3b26f93ae5698c875bc39cad275e251a5b81ae70903c5b6bd20efa83c6ed490e308fd49744ba7fd0b2682e2478565701faaf031f2acdc37fb09c72f5c5725200
SSDEEP 1572864:JdGlVq97KDilCglLsUQQuswSddwtFOgKPhj3ZrR+wre7DtvvEnB6OVI:2lCe+CGsUIsZTwtF/KPhjprYwaPt3Eno
TLSH
T10718330F93A544BDE07715B88DA54C9EE2F4784C9350DFCA8385EA6A9F473B40E6CB42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	2026-08-14_1badf88389a42319a53c0a5f462c0d74_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4584	mspaint.exe
4584	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4584	mspaint.exe
4584	mspaint.exe
4584	mspaint.exe
4584	mspaint.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 4584	4404	2026-08-14_1badf88389a42319a53c0a5f462c0d74_cryptbot_icedid_luca-stealer_njrat_stealc.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-14_1badf88389a42319a53c0a5f462c0d74_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_1badf88389a42319a53c0a5f462c0d74_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\llambo.png"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:1428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

llambo.png

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\llambo.png
Size 422KB
SHA256 a403c034daa683ab1a0139c9a513cd7bf9d2b7424bff34b98daeef9a2f75bb09
MD5 f274279466002a1564062b338b037f5e
SHA1 2577c9ae5f292483b2ed0528aaae48b7f87b347b
SHA512 420c2b3ee58639f16d0d97d0d5c24967f19b7804e099adc54e88ed9b2c0706fb679815414521fe0320ea01e9c483b64805a5158947309620687b4d7259267f31
SSDEEP 12288:Bf+tKfee77Apy05mfBsdwDEblQnMqqBXGXEbZoxeAM/QJ3:Bf+tKfeeYp7xfmOXSEbZDAMYJ3
TLSH
T1579423C700E6DA62A67617E2FEEC4BC811D42ADE677D77304A0C86ACDA253F5AF1014D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download