320272d03f3b9fe871893d73c2f3a4c5d9221b384fc5a12e7814a836c6df36d4

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_90f4c1e60a9842f1da1c4062fced6b22_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 1.9MB
Sample260820-pehjsadb59
SHA256 320272d03f3b9fe871893d73c2f3a4c5d9221b384fc5a12e7814a836c6df36d4
MD5 90f4c1e60a9842f1da1c4062fced6b22
SHA1 dcbfe2762de25692441269723cc279855d715e15
SHA512 d788d40bc8e8aa009fcac81954f21280ecda99cb856497db32b7b15e55bca19292d6c16243c9bdfc5fbefad2cb3b09ab1d57276922db2929242cc6ef87e2d0c0
SSDEEP 49152:JKA5/fBtBEzsjw3I3g9ROcpqDFnmSFDGcUkpZ9:JKAt0sjwY3g9RfmRFFDG9o9
TLSH
T12E95F109D7E405F9E0B3A7748DA38916D7777C4A1B71E68F03A8B5A61F332908D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	2026-08-20_90f4c1e60a9842f1da1c4062fced6b22_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5100	mspaint.exe
5100	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5100	mspaint.exe
5100	mspaint.exe
5100	mspaint.exe
5100	mspaint.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 5100	1468	2026-08-20_90f4c1e60a9842f1da1c4062fced6b22_cryptbot_icedid_luca-stealer_njrat_stealc.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-20_90f4c1e60a9842f1da1c4062fced6b22_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_90f4c1e60a9842f1da1c4062fced6b22_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\rtx3070.jpg"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rtx3070.jpg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\rtx3070.jpg
Size 341KB
SHA256 f1f36774a535a89e41d602c2e4da50d11067ada2d0c4f53f2bb179cdf20f9d16
MD5 8df2173e282a4ca8229ec9f2d4cd9d84
SHA1 5574b7025d017c6c9631ce596b7d6f3180089b56
SHA512 445a9d0e2e5accfeb0d9ec58ebc80734b7846bafecc4b850d1510ca58b32282c658d68f8a123a69ed47ba1174e75a678520256784e5dda9e1034139872438561
SSDEEP 6144:XniwUL/cuzbQOjZGslZa8/CVYwggqxc5+JO3wvvjmp9/hE1BtkW3lv7S/QjMIU:XnU/kOosLa8ampcgZvvCSBuW3lKcM9
TLSH
T1CB74120A219ABAEDFF0F1063428BC777F46E337432B5C5412E5D04D7AE62B62158A787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download