2cc2a4723ebbe42d6cbacec345c4b2deeb925d9e6144823660b829a211635db8

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_5468da208958c4f4582c3ef9840147a6_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
Size 19.7MB
Sample260818-l9d83ahl21
SHA256 2cc2a4723ebbe42d6cbacec345c4b2deeb925d9e6144823660b829a211635db8
MD5 5468da208958c4f4582c3ef9840147a6
SHA1 70ce014158b1907ae93c88a091d19fbd623697f7
SHA512 70e05bfe45a5cd530348a2aeb75e00698961c78d01a93df9f30bd2055fd7b201595ad1a2af4cab3b7a5788623703beadda5791c9293419a97282a74dc661f5b0
SSDEEP 393216:2+ObIc4h+a9WQvV86VZZqCd7vDe0cWv90QwdcfcP4hsUJK6s:25IZQ0BzZZq+7vVDScfK4zK
TLSH
T11627331133E441EEFEABE076CA43C607DBB1B8490633965F06A55A666F337B0662F311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution pyinstaller

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4356	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4356	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1484	A5_Device_Bypass.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000d00000001c4e8-20.dat	pyinstaller

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4356	powershell.exe
4356	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeIncreaseQuotaPrivilege	4356	powershell.exe
Token: SeSecurityPrivilege	4356	powershell.exe
Token: SeTakeOwnershipPrivilege	4356	powershell.exe
Token: SeLoadDriverPrivilege	4356	powershell.exe
Token: SeSystemProfilePrivilege	4356	powershell.exe
Token: SeSystemtimePrivilege	4356	powershell.exe
Token: SeProfSingleProcessPrivilege	4356	powershell.exe
Token: SeIncBasePriorityPrivilege	4356	powershell.exe
Token: SeCreatePagefilePrivilege	4356	powershell.exe
Token: SeBackupPrivilege	4356	powershell.exe
Token: SeRestorePrivilege	4356	powershell.exe
Token: SeShutdownPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeSystemEnvironmentPrivilege	4356	powershell.exe
Token: SeRemoteShutdownPrivilege	4356	powershell.exe
Token: SeUndockPrivilege	4356	powershell.exe
Token: SeManageVolumePrivilege	4356	powershell.exe
Token: 33	4356	powershell.exe
Token: 34	4356	powershell.exe
Token: 35	4356	powershell.exe
Token: 36	4356	powershell.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
5164	2026-08-18_5468da208958c4f4582c3ef9840147a6_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
5164	2026-08-18_5468da208958c4f4582c3ef9840147a6_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
5164	2026-08-18_5468da208958c4f4582c3ef9840147a6_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
5164	2026-08-18_5468da208958c4f4582c3ef9840147a6_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
5164	2026-08-18_5468da208958c4f4582c3ef9840147a6_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
5164	2026-08-18_5468da208958c4f4582c3ef9840147a6_agent-tesla_amadey_icedid_luca-stealer_njrat.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
5164	2026-08-18_5468da208958c4f4582c3ef9840147a6_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
5164	2026-08-18_5468da208958c4f4582c3ef9840147a6_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
5164	2026-08-18_5468da208958c4f4582c3ef9840147a6_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
5164	2026-08-18_5468da208958c4f4582c3ef9840147a6_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
5164	2026-08-18_5468da208958c4f4582c3ef9840147a6_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
5164	2026-08-18_5468da208958c4f4582c3ef9840147a6_agent-tesla_amadey_icedid_luca-stealer_njrat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5164 wrote to memory of 4356	5164	2026-08-18_5468da208958c4f4582c3ef9840147a6_agent-tesla_amadey_icedid_luca-stealer_njrat.exe	89
PID 4356 wrote to memory of 1484	4356	powershell.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-18_5468da208958c4f4582c3ef9840147a6_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_5468da208958c4f4582c3ef9840147a6_agent-tesla_amadey_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\Modified_Scripts.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Users\Admin\AppData\Local\Temp\A5_Device_Bypass.exe
    "C:\Users\Admin\AppData\Local\Temp\A5_Device_Bypass.exe"
    3⤵
    - Executes dropped EXE
    PID:1484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A5_Device_Bypass.exe

Path C:\Users\Admin\AppData\Local\Temp\A5_Device_Bypass.exe
Size 18.7MB
SHA256 6395fc437da6154d85a7946cd6abf52bfdad4d2d9eecab0556b9e55eb3a41c95
MD5 69a4c8abb7075c262ff8e7c884f7c7be
SHA1 1a36bc1f5758c31dcd3217e28924bcf5b9208011
SHA512 bf6fb7c38bdc9d5bf8ca29860ef013e5de895ea43adaad25815633952654d7a741555d7c22f5274dd245637aa64ab78cd40cd1aac494881d79824c3c8095899d
SSDEEP 393216:RkkIJdt7T6nYbJhFaomlJieNSBR2Zd63+qa2DXuo7aaSbI6id+cq+h1qqSg:RxINn6nCMEeNSBR2Zk+q2YxSbIBrq+3K
TLSH
T1B61733A5A24000A7EAEA023F849FD53CF736ED929765C58F07E471893997789943BF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Modified_Scripts.ps1

Path C:\Users\Admin\AppData\Local\Temp\Modified_Scripts.ps1
Size 7KB
SHA256 3137ea9ad39df181be60ba6d536e3d224794a6f56fcf9ed15115338cc427d2d2
MD5 51b4237bafa2459632c76850756d1ceb
SHA1 a47e2f4fddd3f7b509ef43fd824ffe02c340de0c
SHA512 9559ce7edfd408c8be560a42bd38b020b4458bf68598bd0c64068ac0a77987ca42c2ca084d7ce5936ff296e996f36cf99f6a91c35392897b7b3e119d27003ce5
SSDEEP 192:K4E+rfgNA+AEgS6wlEgS67d8A8I/W6p1Z66zjk:7rR+nZW6P06nk
TLSH
T1A9F1F00E7549846251B25F35D9A3928DFFA7503F0A0B461079BCC0C26F726628FE9F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4356-17-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4356-13-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4356-12-0x00000205687E0000-0x0000020568802000-memory.dmp

Download

memory/4356-15-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4356-8-0x00007FF844B9F000-0x00007FF844BA0000-memory.dmp

Download

memory/4356-16-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4356-18-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4356-19-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4356-11-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4356-28-0x0000020568F60000-0x0000020569012000-memory.dmp

Download

memory/4356-29-0x0000020568F30000-0x0000020568F3A000-memory.dmp

Download

memory/4356-27-0x0000020568F40000-0x0000020568F5E000-memory.dmp

Download

memory/4356-31-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download