0ee1a1689312803d3fcb1b5d07988c3e4329cd7d235ddf2554fe7092db53acbd

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_4391029aedcebab4bc1cb6e353912e53_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 56.2MB
Sample260928-tspbpsyapg
SHA256 0ee1a1689312803d3fcb1b5d07988c3e4329cd7d235ddf2554fe7092db53acbd
MD5 4391029aedcebab4bc1cb6e353912e53
SHA1 4cc40b5eb2b2caed4693b4338ee5a74647e58b5c
SHA512 09d99e976b0ce7253a12deba3d2e98afd6d9ecf557d9c07da5e92fbd5a55f13239d3d42c92faf5d0aebd856ec9866a73fe5bc4fbf88ef92e1897be6e7aabab8e
SSDEEP 1572864:FPj68vwHZ2BVBD3ySu8gUbbQfkvUmslFi5HqTtwv:FP7vw5oVBGZMMfkcwqTtU
TLSH
T12AD7338BD264876FC1112230D844E736A6B67CEC0661C3BBB6EA3D47B71A7419DB9331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	2026-09-28_4391029aedcebab4bc1cb6e353912e53_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4624	mspaint.exe
4624	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4624	mspaint.exe
4624	mspaint.exe
4624	mspaint.exe
4624	mspaint.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 4624	4548	2026-09-28_4391029aedcebab4bc1cb6e353912e53_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-28_4391029aedcebab4bc1cb6e353912e53_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_4391029aedcebab4bc1cb6e353912e53_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\discord-anime-pfp-re5dxo8af5nfj2od.jpg"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

discord-anime-pfp-re5dxo8af5nfj2od.jpg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\discord-anime-pfp-re5dxo8af5nfj2od.jpg
Size 26KB
SHA256 e68da4eecdf9e0506afa625bb2ddeaa16e9bfd8439fe4c7c28ad8b8d03033acd
MD5 8d114b4587c4b51a5bcb774aae604e99
SHA1 6d77292afab64cc91b0c5317297130f5c602ce9c
SHA512 cc798658bcb7440ae7b8ea6ee2244da57c6c71327e8d1d6f10deaccd8a1246fff4b3f1f7696d61b12b117c8eccd14a61ce316d455e7f7ef904528c4f8fcf7686
SSDEEP 768:OKGp/mMMOtxoXR06kmc2CQkBlpHoXrm+RIPgjbMy/IBO:TGpfMk2Q2CBjIX/YgF/Is
TLSH
T190C2CFBB6F60E983E094933096DB1B463BB34C3EC2A5C219C596673C60B53699CC8C32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download