4d161f0033be00b2e896dc566838d02113a1becc9f87a3a183bd27176c69d02e

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 14:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_fc59ec0928be6bd4718f2d81d91c897c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 19.3MB
Sample260930-r5fh8atvbw
SHA256 4d161f0033be00b2e896dc566838d02113a1becc9f87a3a183bd27176c69d02e
MD5 fc59ec0928be6bd4718f2d81d91c897c
SHA1 18f0cbb11956af0a97703af1b20f07ab38a9e51a
SHA512 81d220133fd35a220a245d5a684038feb113f608cc51503f64714d8340ce2dd40cbe12954e824f666ea0adcff0c7ae7aa68f76f642d66804133fa5f6a8517c51
SSDEEP 393216:2CeC98RAN/NyYqG1g8rtqfr5ojnKh19wUn+iYzPhbw4YhxcbU5ypY:dH9eA1NUGiCjk8A+PZLRb2ypY
TLSH
T1B0172303A65B4D69E03357FC5501C7B996632F88F627879606F49C63F9DA8834E2E3E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5036	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 5036	4560	2026-09-29_fc59ec0928be6bd4718f2d81d91c897c_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-29_fc59ec0928be6bd4718f2d81d91c897c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_fc59ec0928be6bd4718f2d81d91c897c_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\bat.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:5036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bat.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bat.bat
Size 2KB
SHA256 e7a31c525091d9924a7e0425b7bedda6ab1a9fce74437bb0d4bb3213836dbd67
MD5 ae898054fb466397eb729a51eb58334d
SHA1 1e62227c6d4730c1b2a23bbe8d17eb300eecf70b
SHA512 eee1738c97ab635dd66a409ae64090d9d1179aca50c352b57a8ad4e904b4e0e0babdf0d82d111426742b6683327d852580d7916257218f1cd299e6d29967e229
TLSH
T148519BAFCEF30B5E71CA837B924345171E8AD47F6E25BDE686A93D39C9C224C4127048
MD5 SHA1 SHA512 TLSH

Submit Download

xxx.dllc

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\xxx.dllc
Size 19.7MB
SHA256 eba1877f0e254278c6a5acb1f0db5e009f8b71861990e967edbfa16d22cdbbde
MD5 51d5fbf8f9081755c2479e2ae5b5063f
SHA1 21280ab5c3def97d3833708f1b9f5fc2f49caa16
SHA512 bc124a45606995d92bff5e375084cfa550255ba40ed311724c9aa70034ed22316b23eb7b4f02a22e1e1afbfeb65e4826be93f43d751749d626111565cd14438b
SSDEEP 393216:J8/HZiAGQYXg+AYrrJjjVL2eV3+b8UDH2PZ:JQ5iAp+ASjfPUDH2x
TLSH
T1FD27339A3CCB41F6D9C108E4EB1B37E713F2B55649C548346AC538C5F0E2FB6206E9A6
MD5 SHA1 SHA512 SSDEEP TLSH