08b6b6729cd145e190f136693d0956a218c916fb368d27825b0f355b491b1542

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 14:03

Target
2026-10-30_e7a3f78e8649d9c9301405d5235bc8d8_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_stealc_tofsee.exe
Size 4.9MB
Sample261030-rc34taeg49
SHA256 08b6b6729cd145e190f136693d0956a218c916fb368d27825b0f355b491b1542
MD5 e7a3f78e8649d9c9301405d5235bc8d8
SHA1 e4cad8b4aedc1dde66b83383382cecc059480596
SHA512 6af4d3e18ecf4a545b594dd2eb0a17f9e57ad2246143899d95fa7b29615e316a17ef887958d5c1928a6707e9427e4676e05e001f5f517ac5b9836c9fc6da2e5e
SSDEEP 98304:T4Puyf4uHZd3poT9AhTZKqhfvH2BH4ChTZKqhfvH2BH:T44WZsT8
TLSH
T1293607E232653223C4C881768A4977EDB4906C84D325F4B66A377C1C0739BD47A7ABE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4300	2026-10-30_e7a3f78e8649d9c9301405d5235bc8d8_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_stealc_tofsee.exe
4300	2026-10-30_e7a3f78e8649d9c9301405d5235bc8d8_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 4212	4300	2026-10-30_e7a3f78e8649d9c9301405d5235bc8d8_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_stealc_tofsee.exe	89
PID 4300 wrote to memory of 4656	4300	2026-10-30_e7a3f78e8649d9c9301405d5235bc8d8_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_stealc_tofsee.exe	91
PID 4300 wrote to memory of 4476	4300	2026-10-30_e7a3f78e8649d9c9301405d5235bc8d8_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_stealc_tofsee.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-30_e7a3f78e8649d9c9301405d5235bc8d8_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_e7a3f78e8649d9c9301405d5235bc8d8_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_stealc_tofsee.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "OctopusEAX"
  2⤵
  PID:4212
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "MasonEAX"
  2⤵
  PID:4656
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "NawaF test"
  2⤵
  PID:4476

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact