Analysis
- max time kernel
149s - max time network
116s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
15/08/2026, 17:23
General
- Target 2026-08-15_f67590dcd25e926e4e8f84da2950d5c8_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 26.5MB
- Sample260815-vx83caem2w
- SHA256 af0c5eebfe2dcffc7039c1bae13277a2a93693180cfa714dd0ec4ed75f9172fb
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 20 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_f67590dcd25e926e4e8f84da2950d5c8_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_f67590dcd25e926e4e8f84da2950d5c8_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\RarSFX0\- Porn Video - Home Alone With Stepbro And FreeUsed - Apply code FREEUSE26 on official site.mp4"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Porn Video - Home Alone With Stepbro And FreeUsed - Apply code FREEUSE26 on official site.mp4
memory/1624-8-0x00007FFE6DF1D000-0x00007FFE6DF1F000-memory.dmp
memory/1624-9-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-10-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-11-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-13-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-14-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-15-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-16-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-17-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-18-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-24-0x00007FFE7AEE0000-0x00007FFE7AF14000-memory.dmp
memory/1624-23-0x00007FF603A90000-0x00007FF603B88000-memory.dmp
memory/1624-29-0x00007FFE7AC70000-0x00007FFE7AC9B000-memory.dmp
memory/1624-28-0x00007FFE7ACA0000-0x00007FFE7ACC2000-memory.dmp
memory/1624-27-0x00007FFE7ADF0000-0x00007FFE7AE09000-memory.dmp
memory/1624-25-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-34-0x00007FFE6D290000-0x00007FFE6D526000-memory.dmp
memory/1624-37-0x00007FFE7A960000-0x00007FFE7A9A1000-memory.dmp
memory/1624-44-0x00007FFE7A620000-0x00007FFE7A631000-memory.dmp
memory/1624-52-0x000001C5FFBC0000-0x000001C5FFC51000-memory.dmp
memory/1624-53-0x000001C5FFD20000-0x000001C5FFE5B000-memory.dmp
memory/1624-54-0x00007FFE66EB0000-0x00007FFE670F5000-memory.dmp
memory/1624-51-0x00007FFE73CE0000-0x00007FFE73CF2000-memory.dmp
memory/1624-50-0x00007FFE7A600000-0x00007FFE7A61B000-memory.dmp
memory/1624-49-0x00007FFE6CDF0000-0x00007FFE6CE9B000-memory.dmp
memory/1624-48-0x00007FFE7A450000-0x00007FFE7A475000-memory.dmp
memory/1624-47-0x00007FFE7A480000-0x00007FFE7A4CF000-memory.dmp
memory/1624-46-0x00007FFE7A0E0000-0x00007FFE7A178000-memory.dmp
memory/1624-45-0x00007FFE6CEA0000-0x00007FFE6D0AB000-memory.dmp
memory/1624-43-0x00007FFE7A640000-0x00007FFE7A651000-memory.dmp
memory/1624-42-0x00007FFE7A6B0000-0x00007FFE7A6CA000-memory.dmp
memory/1624-41-0x00007FFE7A6D0000-0x00007FFE7A6FD000-memory.dmp
memory/1624-40-0x00007FFE7A700000-0x00007FFE7A726000-memory.dmp
memory/1624-39-0x00007FFE7A9F0000-0x00007FFE7AA08000-memory.dmp
memory/1624-38-0x00007FFE7A730000-0x00007FFE7A75F000-memory.dmp
memory/1624-36-0x00007FFE6D0B0000-0x00007FFE6D193000-memory.dmp
memory/1624-35-0x00007FFE6D1A0000-0x00007FFE6D288000-memory.dmp
memory/1624-33-0x00007FFE7A180000-0x00007FFE7A252000-memory.dmp
memory/1624-32-0x00007FFE7AA10000-0x00007FFE7AA21000-memory.dmp
memory/1624-31-0x00007FFE7ADB0000-0x00007FFE7ADC4000-memory.dmp
memory/1624-30-0x00007FFE6D6F0000-0x00007FFE6DA80000-memory.dmp
memory/1624-26-0x00007FFE7B790000-0x00007FFE7B7A1000-memory.dmp
memory/1624-55-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-56-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-57-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-58-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-59-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-60-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-61-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-62-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-65-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-225-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-257-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-289-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-321-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-385-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp
memory/1624-449-0x00007FFE6DC70000-0x00007FFE6DF26000-memory.dmp