Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/04/2026, 03:42
Behavioral task
behavioral1
Sample
2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe
- Size 1.9MB
- Sample260417-d9d93aev7k
- SHA256 a6640d1b562df3b81f56fa6400974d4326d4f9badfa4b286134498508e41a814
- MD5 84d768e48a4e09383c51710dea1dc0f3
- SHA1 d4801426799efb051fff5643e21bc1e0d880ec0f
- SHA512 af9cd6a8897dac64b8362623bc79c7ee184d54cd4c0ea02ee0dbd5166993bbe77ad9c9b208b12443e0a34a364daec885741858c692c5632160b51cfd2bf0552d
- SSDEEP 24576:I6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqBj:ICqm2Jpr0nNM7Dus7Nx0
- TLSH T186952906BCEA14FBC67CF234496667213672346587336B871E8506AA5A36FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/files/0x000200000002a18e-5.dat UPX behavioral2/memory/4900-13460-0x0000000000400000-0x00000000005D5000-memory.dmp UPX - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\desktop.ini 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe -
resource yara_rule behavioral2/memory/4900-0-0x0000000000400000-0x00000000005D5000-memory.dmp upx behavioral2/files/0x000200000002a18e-5.dat upx behavioral2/memory/4900-1731-0x0000000000400000-0x00000000005D5000-memory.dmp upx behavioral2/memory/4900-13460-0x0000000000400000-0x00000000005D5000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\THMBNAIL.PNG 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\NewsAppList.targetsize-60_altform-unplated_contrast-white.png 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\SnipSketchLargeTile.scale-100.png 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-20_contrast-black.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\EmptyShare-Dark.scale-125.png 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-64_altform-lightunplated.png 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Pipes.AccessControl.dll.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\bg-BG\PAD.Console.Host.resources.dll.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\Selection.js 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\7-Zip\Lang\th.txt.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\WideLogo.scale-200.png 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\OrientationControlFrontIndicatorHover.png 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1909.12456.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.scale-125.png 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-64_altform-lightunplated_contrast-black.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_neutral_split.scale-100_8wekyb3d8bbwe\Images\PowerAutomateSquare71x71Logo.scale-100.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\SnipSketchAppList.targetsize-32_altform-unplated.png 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_scale-100.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\AppCS\Assets\DeviceNotFound.png 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadAppList.targetsize-16_altform-lightunplated.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\KeywordSpotters\ja-JP\Cortana.bin.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-lightunplated_contrast-white.png 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\resources.pri.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DetailsList\ShimmeredDetailsList.types.js.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\MSOINTL.DLL 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.21012.10511.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-125_contrast-black.png 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\NewsSmallTile.scale-200_contrast-white.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpAppList.targetsize-40_altform-lightunplated_contrast-black.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-64.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintAppList.targetsize-72.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Office365LogoWLockup.scale-100.png 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Illustration_Seasons_Summer_Right_Dark.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\d3dcompiler_47.dll.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SnipSketchAppList.targetsize-40.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.VBS 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-30_contrast-white.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\PeopleAppList.targetsize-96.png 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-30_altform-lightunplated_contrast-black.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\EntCommon.dll 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-30_altform-lightunplated.png 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-36_altform-lightunplated.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\FeedbackHubAppList.targetsize-36.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\DetailsList\DetailsRowFields.types.js.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\TipsSplashScreen.scale-200.png.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms.exe 2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_84d768e48a4e09383c51710dea1dc0f3_icedid_luca-stealer_njrat_snatch.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4900
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 1.9MB
- SHA256 886c276eea464e8b093a1c00a907c4a37ff88e0526dd56683e706312d0ce8550
- MD5 3fdc1eb440e853b91048abf2f514aa24
- SHA1 ec79ee2e80e1f3a9676e99e551f703beea39c1c6
- SHA512 4197ed45282e38acd58ccd6237fa96ab513a0f6626e26c39ca9194cd2b5bb671bae40ed19c6d0cb07355bd9cd0ad189b2369ee8e2cc7353a4ecf1fe9d621993a
- SSDEEP 24576:I6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqBK:ICqm2Jpr0nNM7Dus7Nx1
- TLSH T1E1952906BCEA14FBC67CF23449566B213672346587336B871E8506AA5A36FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH