7650821185661c85453cc2027ca6241ed6ff5e4610760caa7412ea9c1457b12a

Analysis

max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_5140fb63c1de794e3ae1270360c7fa5e_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 5.3MB
Sample260819-c2t5wavfph
SHA256 7650821185661c85453cc2027ca6241ed6ff5e4610760caa7412ea9c1457b12a
MD5 5140fb63c1de794e3ae1270360c7fa5e
SHA1 fa4049b0366001bfeac69a520eab9d0e4f826993
SHA512 4ec8416332fc3c19d4a07ddeee61e5bf0b3976a0d2b8236899da1833ec1fe8b53e3ade40c5f376ea6f293e0c0f112635994f478f2598ce4fe9643b41c83becb4
SSDEEP 98304:8KAQ58Eek+V0VyZG1vCqLfWrtX6FmrH9HTk1hlWcsrpyPVb7pG:8o+kYZenotX6IrH9HTwbWub7pG
TLSH
T195462349E7A405FDE4A3D1B8DD820A17F7717C9907A19BDF13A0A9A21F233905E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\DriverData\patch.exe	cmd.exe
File created	C:\Windows\System32\drivers\DriverData\patch.exe	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2388	patch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3472	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 3472	5032	2026-08-18_5140fb63c1de794e3ae1270360c7fa5e_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 3472 wrote to memory of 2388	3472	cmd.exe	91
PID 2388 wrote to memory of 6140	2388	patch.exe	92
PID 6140 wrote to memory of 5256	6140	csc.exe	94
PID 2388 wrote to memory of 1328	2388	patch.exe	95
PID 1328 wrote to memory of 988	1328	csc.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-18_5140fb63c1de794e3ae1270360c7fa5e_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_5140fb63c1de794e3ae1270360c7fa5e_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\setup123.bat" "
  2⤵
  - Drops file in Drivers directory
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Users\Admin\AppData\Local\Temp\patch.exe
    patch.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fpuyx3ew\fpuyx3ew.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6140
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1505.tmp" "c:\Users\Admin\AppData\Local\Temp\fpuyx3ew\CSCD1ED08FD37FC40D9855811671F29167.TMP"
        5⤵
        
        PID:5256
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fpuyx3ew\fpuyx3ew.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1328
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES166C.tmp" "c:\Users\Admin\AppData\Local\Temp\fpuyx3ew\CSC754D2B6CDEBF45D7A4282B66317F7EB.TMP"
        5⤵
        
        PID:988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES1505.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1505.tmp
Size 1KB
SHA256 9fc7717a57f0e04c5c9ea20c2bca5a9d1e142c7ffb854781c20192fd48571baf
MD5 7cd0f877b22616f359ab4de71b116541
SHA1 74be2c37453a30a2ecda52c54ae5b9cf7c3fee3b
SHA512 1d25f45480eb06be0515fbe1f5b573330aa80f596d4031e9f8c9a5af559032ea506eabcac1a0c582dbc0d962c9cdf89b9c5127caf5363d4b4f443461c965c404
TLSH
T1E0216A0593ED471FF0B34731B9FA172B9234FD65EEA2675A844142282C51548EEE1B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES166C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES166C.tmp
Size 1KB
SHA256 80edad00701582ce21cf6aaec6e1eed98dc0616ff95b9f10903d78180a8cc251
MD5 ca054157c8422729c52ddd55e85c48c1
SHA1 72cc2ddb040b80d85f84f6afec67ae01b382c921
SHA512 34ca9e46e31214cb1e6f98cbf36f4322c2e2c836401ba0cfbeede24d3a093f40579443586da773124b9b1d39444d16c6041097ed4dca52dbb2799a6df4b7ee25
TLSH
T13E218C0593ED471FF0B34731B9FA172FA234FD55EFA1675A844142282C41518EEE1B72
MD5 SHA1 SHA512 TLSH

Submit Download

fpuyx3ew.dll

Path C:\Users\Admin\AppData\Local\Temp\fpuyx3ew\fpuyx3ew.dll
Size 3KB
SHA256 a9ad5a9fbe0171ee3c7f832303270823610adba5233f24b5f054f691f2f3dda3
MD5 230ef8e8b7793771b918a44d4761856f
SHA1 f1f8935a0ae841215c5071bf7c9e853f19bfd37d
SHA512 d841830193909836fb0b6fd25af5b67fb28246ff28bb6dd8131de5827e2e04256e17c65e7bd4be8fcc1843a17a306c5b2c58f48a8357ceb50cf78620e3f4ec24
TLSH
T1E571CC16A7F8426FE0BB4731EEF397232674F860AB62577E598002286C902345D72FB0
MD5 SHA1 SHA512 TLSH

Submit Download

fpuyx3ew.dll

Path C:\Users\Admin\AppData\Local\Temp\fpuyx3ew\fpuyx3ew.dll
Size 4KB
SHA256 220bdd2a5e80e7e4149ddff03ab753b3a85e31cbdcd4a48a8bf914bf8c05f0cb
MD5 5063277f59c5dd27cc897234b647083a
SHA1 981bd0540cabb8efc0cc65034288448a25f74ae1
SHA512 5c5c80ae7fa834498ebcbc0ec568b4d93b6dd879bc1176ec57263b218a5cc4eaa7817f60e06c0c14310135d45fb075de37fc355ee352d77018ae8c1e544337df
TLSH
T13B81331667F84A27F47F4B74BAF3432623B4F964AF62976F5880021DAC612709D62F70
MD5 SHA1 SHA512 TLSH

Submit Download

fpuyx3ew.pdb

Path C:\Users\Admin\AppData\Local\Temp\fpuyx3ew\fpuyx3ew.pdb
Size 11KB
SHA256 fc07110499330a96ef7a2cfd784093efebad0034746c85a2d8932f49e05ea8a5
MD5 ae2ed0a4e4f4a702a9f9fadc3b7e1836
SHA1 fa64b990b709cd131891ac27d12deb6f0a868f5a
SHA512 c7bce0cb449f00a16805b1c323f0fa1e076413b0a2fbd2d2188f799696bc281985dd32bb20790463f27c9dc4c89f9b8598b97b6354f8ed4fc85d93e0ed5f37e7
SSDEEP 24:zZms1qwZj3wGx8wzB27u3NQDkUHXBnM7GhYkylteH2qztbU:zZ22AQ274paJM7TrlteH2qzt
TLSH
T1D232FB503781E631C4A652B98CD7CACC4770FC969EC61B0B3281370E3C7A5882E956C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fpuyx3ew.pdb

Path C:\Users\Admin\AppData\Local\Temp\fpuyx3ew\fpuyx3ew.pdb
Size 11KB
SHA256 b691793265edeb2fa6d7eeb6cac6ed7f1d27d0a111f60a650d2f9608e3a3da3d
MD5 57f0adec12889f2bef766da346448d6d
SHA1 f17025f0ec0bdd86fe9ffdcef5dff6cd668546c1
SHA512 dd175d9bb3ebfc605974153c3f655fbed2ff9cd8d2acb22c49c4aa77dd24517554cdef7e3b2c8dd0250af4556fc36eda64aa79940e76961b13958d8fe696ecbf
SSDEEP 24:zZmsn8Zj3wGx8fL27u3rQuoUBKnhwqpNPGGFaad8y9eH2qz5nU:zZMAp274DQnOqpNPP7z9eH2qz5
TLSH
T163321E423B86D931D42A86788CEBC7DD53A0FC96AFC6074B3242731E3C776885CD0690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patch.exe

Path C:\Users\Admin\AppData\Local\Temp\patch.exe
Size 13KB
SHA256 9b5ff51fc4b10f91ea4248f73359a5ce042f837dd424200bfab167b4fb5feb85
MD5 c1430dc38192984a989a9c13d2f54d49
SHA1 3e746eb2b388daf2fa3dda4a8e6d3594b3ccf6af
SHA512 352787e136350cef5d109dbc5c6730240d752e33de65b2fe2114a1f3f72c44973fa290b3c0e0f10710ba4a03e83e5e072f2d294de10ff509d220db9c2104b436
SSDEEP 384:tRDvO1Ycn+9lrShtLU0a0/HFTWrk7+BL6OMMW:/7wGAE0I4Cs
TLSH
T1AF522954BBE88737DAF71B765C33105407B6FA016E22CF9E9CC5204A99A2F044756B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup123.bat

Path C:\Users\Admin\AppData\Local\Temp\setup123.bat
Size 189B
SHA256 1ace23e9b1841a1feb78a164927f8a12fc4e698f1da5026d4a947cc9e760127e
MD5 7fce0ecd105c13c93cf42d762d649888
SHA1 5a4b6d973d8ff1b1b3eb30dca22404df82092fce
SHA512 6620045d69caa9659ca30683f6351f8761f24096c7877a1303e5a6b10593d2988f4e63451b0549c14eb0fa00dbeb4e5caf3d02da99e4fbf8889c6913ae516c3d
TLSH
T104C012F10FD08471D0650D40551BD365E751F68D67F5543413E33184F50580D3E90C7D
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD1ED08FD37FC40D9855811671F29167.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\fpuyx3ew\CSCD1ED08FD37FC40D9855811671F29167.TMP
Size 652B
SHA256 c24ed76c06dc8ba329138d342d68369214378b701f136fda37e50ff825bcb316
MD5 6ecebaa1d9473dc498e6cb10cee78b38
SHA1 7992b1f6b6768b475a79322dc5e355a0d0839ec1
SHA512 ef92e44c46c96b247f3cf96c432053d7d803d7f63fde3288935addfe42e917f686f92dd215dc8bd41438d10cb8e12f5ec15874327c2b61d3715d5a6d833dac3b
TLSH
T15BF05E0963F8020EF0F34B30BEF6436391A9BC65DE7293ED144003292CA45248962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

fpuyx3ew.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\fpuyx3ew\fpuyx3ew.0.cs
Size 82B
SHA256 dc4fe976865cf1f53de8f1f81206fbb0c1c562a96c90f57c4cd5bfb0ffecbcd9
MD5 9bc16e67b2cefd03bee7e7af74eb78f3
SHA1 de2d546df11efac03ef38c73a7662ac662cd0da5
SHA512 b45020fe02f6bc72c136cdfec49ad9844de9f9a9e60942fd2e785488e1277da73efc111c7bc3c096580f2091e3e3ea184844f0aa068e63b4bcd11619aa6a51df
TLSH
T1E5A012105E79D432564201D7A2240452B120C06442843400E8B01C9331020044438519
MD5 SHA1 SHA512 TLSH

Submit Download

fpuyx3ew.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\fpuyx3ew\fpuyx3ew.0.cs
Size 283B
SHA256 7f3b52e5000161d78b030777007a2451d0ed9faa665eed4f7efb5d50a9f3fa08
MD5 13af16a9bb03578b8e7c4b7388d15859
SHA1 d39f36b70a29d61dfadd05d672fd5c99fa485125
SHA512 216321225446b47ce4afd94fc20e762fb6c42a1b68e8df7e312bd9145b873ac234c84708564284d5a9bd8b62001b85c876a250d89fc5461f8840b7d6bd29c398
TLSH
T1B4D0EBC02236EA300AC6640224FAFEBAFAB093248038C030B0C69C0DD02C230BBB0C26
MD5 SHA1 SHA512 TLSH

Submit Download

fpuyx3ew.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\fpuyx3ew\fpuyx3ew.cmdline
Size 914B
SHA256 a9efd2a784074c3613a33308239277b0a96ef82bac16360cdce67922e8e1152a
MD5 81d74870a6a2c6e851f04e133d7a3ba6
SHA1 fb2984dec4980887cb9a501fccc5e99773d20689
SHA512 e0bfb1f05e79aabeb1185e67d0bd02a1bfe116dda1f75affdf8e695b51bcdd7620a4c2cf3ddc9222f05c7237edbe61595186e828dcb111e1ed1164fe35f6f6d2
TLSH
T16311E335033B86BBC6F73943589E5E5C9267635F3082DF2CBA9A8D1EE9938154E10B90
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2388-19-0x00007FFFDF070000-0x00007FFFDFA14000-memory.dmp

Download

memory/2388-35-0x0000019B34420000-0x0000019B34428000-memory.dmp

Download

memory/2388-23-0x00007FFFDF070000-0x00007FFFDFA14000-memory.dmp

Download

memory/2388-41-0x00007FFFDF070000-0x00007FFFDFA14000-memory.dmp

Download

memory/2388-18-0x00007FFFDF070000-0x00007FFFDFA14000-memory.dmp

Download

memory/2388-51-0x0000019B4CE40000-0x0000019B4CE48000-memory.dmp

Download

memory/2388-17-0x0000019B326D0000-0x0000019B326D8000-memory.dmp

Download

memory/2388-16-0x00007FFFDF1FF000-0x00007FFFDF200000-memory.dmp

Download

memory/2388-52-0x00007FFFDF070000-0x00007FFFDFA14000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads