Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/08/2026, 18:02
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 1.7MB
- Sample260825-wml1hatvft
- SHA256 ba0fa64c3ead32b9b88e41f98d1a38e0af1868196a9c3799e4d4246ec2f4d716
- MD5 1a9ccd2a86ecc36ec65df9cd632892f9
- SHA1 d4d668491ea52522ad688d871dd5074b62984a8b
- SHA512 4d97fbcc4db0a96bbda968fc7c6e66225e614a6e043576476b068cabd5cae10dc4787ed16fb83c577e7521de8f209d19ada12141ddcbdb6e8465ed642a3460c9
- SSDEEP 24576:nRSfrAEH9XIYpj0BEHBSXPGfjuIb1iN1Eob4z/hYmYqYoFFYXu93l39Nw1q:ngTbH94YxVV21k/aIO+93xw1q
- TLSH T191857C55A6A441B8E0A29578CB9EC933E7727CC60F70968F02D47DA73F332507A297D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/files/0x00070000000244b9-19.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "0" powershell.exe - Modifies Windows Defender notification settings 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications powershell.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" powershell.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" powershell.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" powershell.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation 2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation WScript.exe - Executes dropped EXE 2 IoCs
pid Process 5036 UnRAR.exe 2468 Yjzlxkdoi.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 4296 WScript.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files\WindowsOptions\Yjzlxkdoi.exe UnRAR.exe File opened for modification C:\Program Files\WindowsOptions\Yjzlxkdoi.exe UnRAR.exe File created C:\Program Files\WindowsOptions\1.txt UnRAR.exe File opened for modification C:\Program Files\WindowsOptions\1.txt UnRAR.exe File opened for modification C:\Program Files\WindowsOptions 2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\install.vbs 2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\run.ps1 2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\WindowsOptions\UnRAR.exe 2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\sfx.rar 2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\WindowsOptions\sfx.rar 2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\__tmp_rar_sfx_access_check_240654140 2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\WindowsOptions\install.vbs 2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\WindowsOptions\run.ps1 2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe File created C:\Program Files\WindowsOptions\UnRAR.exe 2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe -
pid Process 4876 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings 2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4876 powershell.exe 4876 powershell.exe 4876 powershell.exe 4876 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4876 powershell.exe Token: SeIncreaseQuotaPrivilege 4876 powershell.exe Token: SeSecurityPrivilege 4876 powershell.exe Token: SeTakeOwnershipPrivilege 4876 powershell.exe Token: SeLoadDriverPrivilege 4876 powershell.exe Token: SeSystemProfilePrivilege 4876 powershell.exe Token: SeSystemtimePrivilege 4876 powershell.exe Token: SeProfSingleProcessPrivilege 4876 powershell.exe Token: SeIncBasePriorityPrivilege 4876 powershell.exe Token: SeCreatePagefilePrivilege 4876 powershell.exe Token: SeBackupPrivilege 4876 powershell.exe Token: SeRestorePrivilege 4876 powershell.exe Token: SeShutdownPrivilege 4876 powershell.exe Token: SeDebugPrivilege 4876 powershell.exe Token: SeSystemEnvironmentPrivilege 4876 powershell.exe Token: SeRemoteShutdownPrivilege 4876 powershell.exe Token: SeUndockPrivilege 4876 powershell.exe Token: SeManageVolumePrivilege 4876 powershell.exe Token: 33 4876 powershell.exe Token: 34 4876 powershell.exe Token: 35 4876 powershell.exe Token: 36 4876 powershell.exe Token: SeIncreaseQuotaPrivilege 4876 powershell.exe Token: SeSecurityPrivilege 4876 powershell.exe Token: SeTakeOwnershipPrivilege 4876 powershell.exe Token: SeLoadDriverPrivilege 4876 powershell.exe Token: SeSystemProfilePrivilege 4876 powershell.exe Token: SeSystemtimePrivilege 4876 powershell.exe Token: SeProfSingleProcessPrivilege 4876 powershell.exe Token: SeIncBasePriorityPrivilege 4876 powershell.exe Token: SeCreatePagefilePrivilege 4876 powershell.exe Token: SeBackupPrivilege 4876 powershell.exe Token: SeRestorePrivilege 4876 powershell.exe Token: SeShutdownPrivilege 4876 powershell.exe Token: SeDebugPrivilege 4876 powershell.exe Token: SeSystemEnvironmentPrivilege 4876 powershell.exe Token: SeRemoteShutdownPrivilege 4876 powershell.exe Token: SeUndockPrivilege 4876 powershell.exe Token: SeManageVolumePrivilege 4876 powershell.exe Token: 33 4876 powershell.exe Token: 34 4876 powershell.exe Token: 35 4876 powershell.exe Token: 36 4876 powershell.exe Token: SeIncreaseQuotaPrivilege 4876 powershell.exe Token: SeSecurityPrivilege 4876 powershell.exe Token: SeTakeOwnershipPrivilege 4876 powershell.exe Token: SeLoadDriverPrivilege 4876 powershell.exe Token: SeSystemProfilePrivilege 4876 powershell.exe Token: SeSystemtimePrivilege 4876 powershell.exe Token: SeProfSingleProcessPrivilege 4876 powershell.exe Token: SeIncBasePriorityPrivilege 4876 powershell.exe Token: SeCreatePagefilePrivilege 4876 powershell.exe Token: SeBackupPrivilege 4876 powershell.exe Token: SeRestorePrivilege 4876 powershell.exe Token: SeShutdownPrivilege 4876 powershell.exe Token: SeDebugPrivilege 4876 powershell.exe Token: SeSystemEnvironmentPrivilege 4876 powershell.exe Token: SeRemoteShutdownPrivilege 4876 powershell.exe Token: SeUndockPrivilege 4876 powershell.exe Token: SeManageVolumePrivilege 4876 powershell.exe Token: 33 4876 powershell.exe Token: 34 4876 powershell.exe Token: 35 4876 powershell.exe Token: 36 4876 powershell.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3212 wrote to memory of 4296 3212 2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe 85 PID 4296 wrote to memory of 4876 4296 WScript.exe 86 PID 4876 wrote to memory of 5036 4876 powershell.exe 88 PID 4876 wrote to memory of 2468 4876 powershell.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_1a9ccd2a86ecc36ec65df9cd632892f9_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsOptions\install.vbs"2⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "run.ps1"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender notification settings
- UAC bypass
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Program Files\WindowsOptions\UnRAR.exe"C:\Program Files\WindowsOptions\UnRAR.exe" x -y -pByeFriend! "C:\Program Files\WindowsOptions\sfx.rar" "C:\Program Files\WindowsOptions\"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5036
-
-
C:\Program Files\WindowsOptions\Yjzlxkdoi.exe"C:\Program Files\WindowsOptions\Yjzlxkdoi.exe"4⤵
- Executes dropped EXE
PID:2468
-
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\WindowsOptions\UnRAR.exe
- Size 547KB
- SHA256 e785a0c0dcf79385f0483c1eb2242e3937d0447f6b21dd158906e92757b46542
- MD5 8d4630a7958517737dba1ab88045373b
- SHA1 5816798803373fd3dd7bd1823ab8c92a824c441c
- SHA512 99d44318285e53c720400041c2367cf5bc6d421d2cb6f8c0c5eb7478c4997f4e74aba85973fa4b00cb893da1821ecdd2c9c1b7fa04e010454ed15e214f25755b
- SSDEEP 6144:ViSm+owa1lGp1pN/hm7ifjDG0opa9wJEZoaiokUI+2GIqMvpCE4mODiUU9sbHAhi:QXPGp1j/k0SrICIio/KNzAiREOzb4P
- TLSH T1F8C47C5AA7E403BCE0B7D674C9914902FB77BC4907B1AA8F03E444B75F276518E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WindowsOptions\Yjzlxkdoi.exe
- Size 1.7MB
- SHA256 bb84ebe9bb129155a571e18a0906ffa14cc13e4888b38ef49bb78da93fc1b485
- MD5 e52d0265505c12925eae287d53405cc9
- SHA1 438e85ad9a686984d7ce0e465243f70a061bb63d
- SHA512 d0ca8724ccd56de6dcacba1a4ba92e4fa564389927c34e4a5a23bba185173df10ca08a272cb207198a619129079665ea0df41c4fc6770d529575268632c65041
- SSDEEP 12288:VO+r3JQTWlJXW3uK2HsusJFD/iIDv9v2O0TA2AqdRVbEVLkXh6uA5llmILiB:Vz3rXs2MusrDjz9v2g+RVbMLkfiRu
- TLSH T1F585C60BEAB551E1C1BAD039D143612FFC7134A683709BD7A6869B171B227F4E93EB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WindowsOptions\install.vbs
- Size 98B
- SHA256 a0110f07fe8d70b8c7f8d6d973f54a2cae6c8fbf09e7ae6b780f5598af903474
- MD5 b95bd766c9aa886726bcaf30577eeb23
- SHA1 ec53efe0d8a5d62d17e2609ed242e476982bcc1d
- SHA512 c27672412c356bbe6dbfb440141328f22f85754484ac9bdf66f0f64dd57f44137d319a4c674bf8af3b58fe5a8e8a0e7150f055590fe821c1364f7cfde631b5ff
- TLSH T17BB01218F504C3EC067BC4EE1175C42C8CA864A9A210875EB37092087248234D365146
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\WindowsOptions\run.ps1
- Size 23KB
- SHA256 4220408adec9f0ff9dd034efa7e71ffd0d6cdf229a147981de240d90f65bdf87
- MD5 b1339765214ee3f26067db1be03faeb7
- SHA1 e3b85c82531cf393ed5d37fbd9ac904f59d39d24
- SHA512 eceaae405c9f96e3698835b5a12110ba32860ed4685f81a42d854f7a92fea481e36e9fb831693ca3c106f744a4829e7c9cefe3027e11dd988fbaa39d44c2f031
- SSDEEP 384:+I43204WryHQ8YvPvF5xpmDCzFLZ0exEZBxy5HRp5lsFY5opRSyFTMrmyAD8PHb0:dA2Dynpxd0LZBxIPD0Voq2Ad
- TLSH T1AFB2D242A7FA0108F1F76B45EA7B08754A37BC55593AC90D519C688E0BF3E1498A2FF3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WindowsOptions\sfx.rar
- Size 439KB
- SHA256 e6f7776c3a6387e088b776e89cdc2681e6a048a933f9725f9a8245ed1c23408a
- MD5 72784e725c09e222788f1e77b657c775
- SHA1 86018e66e0b351d4a92bf5198100b9034fa04734
- SHA512 140eb44827ee139a4842062d4043a7119af1bc96e862232a230251e550152c96add276fcbddd61c584b9691f8e829f8f54dd0506a761eb8cc87cfdfabd7ae723
- SSDEEP 12288:QpphYmYS1quYoFP9P6naAN2Yu93l39tPw1HF:Q/hYmYqYoFFYXu93l39Nw1l
- TLSH T1D8A4236CECD135A1B926FD2998F432432C523B1571B4F72EBD4E3A728C5B28D64E6290
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pba5o5a3.d1t.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH