1f21f0439bc4c48ae89a7bd11e2b4751fbd5ac9c6ac383736d2cffeaf9ccf7e8

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-12_6733d8bc1db830b2a28e95de00d6b95d_cryptbot_icedid_njrat_stealc.exe
Size 1.2MB
Sample261113-bsfqfset7z
SHA256 1f21f0439bc4c48ae89a7bd11e2b4751fbd5ac9c6ac383736d2cffeaf9ccf7e8
MD5 6733d8bc1db830b2a28e95de00d6b95d
SHA1 5088d5255b7ac6d2f6b40578e9bfa33797e88b49
SHA512 c496f9068cdfd19f94bc20047b576c32aa8aa41f3dc39da22c31828d2a4475f13ad2ff4be639a18178b2f8084a5f4197ffc03c510044d1b0b33ef2a46eef60ec
SSDEEP 24576:tCCyMIQYnjtCPJ8K350TLlp4NM6iWIrxo+2ikURzbGkeyy:cQYnjtCPOKJGuMMIrb0URzbGd
TLSH
T15545F119E7E400F9E0B7D9B8CA524807E7767C8D5771D6CF03A92A991F336908D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	2026-11-12_6733d8bc1db830b2a28e95de00d6b95d_cryptbot_icedid_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2796	mspaint.exe
2796	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2796	mspaint.exe
2796	mspaint.exe
2796	mspaint.exe
2796	mspaint.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 2796	4888	2026-11-12_6733d8bc1db830b2a28e95de00d6b95d_cryptbot_icedid_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-12_6733d8bc1db830b2a28e95de00d6b95d_cryptbot_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-12_6733d8bc1db830b2a28e95de00d6b95d_cryptbot_icedid_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sass.png"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:2984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sass.png

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\sass.png
Size 38KB
SHA256 1682e437c64a4b87806a242b60d6a086b57f1c6bb4daea2e18148827dc06f501
MD5 8e97de73d0b1efa7241124621bec3a7b
SHA1 97e3dcec186ef1302348b1bfc67e9be422cbb37c
SHA512 ad919cefef9038181c386ccd150809eb39e06fc0acf8a1fe60b53bcd2336675f9e754134f5a1251b9aaf9f015375910587eb0eb4365175bfc3c2b78006506011
SSDEEP 768:jr2F9C3BrBjkv5qO7ZYI4RAKxug64h2cCFilmkxqi3LsqsAsK:32Fel9S5zYI4DUg68IFi/ZYYsK
TLSH
T16203F1CD1F4611B69A52A44F824B05F3E677BA9EE41BB632DD346FFF84044418328D2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2796-11-0x000002D7CF580000-0x000002D7CF58D000-memory.dmp

Download