Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 19:42
General
- Target 2026-09-24_e19ead6dba0086bbec704e56b323e73c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 15.0MB
- Sample260924-yet29aha84
- SHA256 4fbaa25cc544d31f362ed79811f537979192a2eb5df354eeee36c76c40432a8f
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 2 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 8 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_e19ead6dba0086bbec704e56b323e73c_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_e19ead6dba0086bbec704e56b323e73c_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WC365P_5556\run.exe"C:\Users\Admin\AppData\Local\Temp\WC365P_5556\run.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\WiseCare365.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\WiseCare365.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\WiseTray.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\WiseTray.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Chinese(Simplified).ini
English.ini
Themes_v7.txt
AutoShutdown.svg
DateRecovery.svg
DuplicateFinder.svg
FastSearch.svg
FolderHider.svg
ForceDeleter.svg
GameBooster.svg
Imagex.svg
MemoryOptimizer.svg
Note.svg
ProgramUninstaller.svg
Reminder.svg
WJSLib.dll
WebView2Loader.dll
WiseCare365.exe
WiseTray.exe
config.ini
config_tray.ini
dc_native.dll
exclusions.dat
sqlite3.dll
toolsv6.ini
run.exe
memory/3932-310-0x00007FF984A20000-0x00007FF984BB3000-memory.dmp
memory/3932-309-0x0000000000400000-0x0000000001965000-memory.dmp
memory/4332-311-0x0000000000400000-0x0000000000FE6000-memory.dmp
memory/5556-308-0x00007FF602C80000-0x00007FF602CBD000-memory.dmp