Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
31/05/2026, 15:00
General
- Target 2026-05-31_25f15d72195c1a7bc8a9eac1d46b7ec5_icedid_luca-stealer_njrat_stealc.exe
- Size 2.4MB
- Sample260531-sdaz4acz5q
- SHA256 3515f8e0495f7f1f8ee257809494d2b5f7993915254c21b92c0e8444c4d2713c
Malware Config
Signatures
- Detects executables packed with ASPack 1 IoCs
- Detects executables packed with Enigma 1 IoCs
- Detects executables packed with Themida 1 IoCs
- Detects executables packed with VMProtect. 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-31_25f15d72195c1a7bc8a9eac1d46b7ec5_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-31_25f15d72195c1a7bc8a9eac1d46b7ec5_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\WinTelemetry\WinTelemetry.exeC:\Users\Admin\AppData\Roaming\WinTelemetry\WinTelemetry.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_5zs2uymp.kpo.ps1
WinTelemetry.exe
memory/1160-46-0x0000018539480000-0x0000018539F42000-memory.dmp
memory/2480-0-0x0000025060070000-0x0000025060071000-memory.dmp
memory/4700-17-0x000001F1EDED0000-0x000001F1EDEEC000-memory.dmp
memory/4700-20-0x000001F1EDFE0000-0x000001F1EDFFC000-memory.dmp
memory/4700-19-0x000001F1EDEC0000-0x000001F1EDECA000-memory.dmp
memory/4700-29-0x000001F1EDFC0000-0x000001F1EDFCA000-memory.dmp
memory/4700-36-0x000001F1EE020000-0x000001F1EE03A000-memory.dmp
memory/4700-37-0x000001F1EDFD0000-0x000001F1EDFD8000-memory.dmp
memory/4700-38-0x000001F1EE000000-0x000001F1EE006000-memory.dmp
memory/4700-39-0x000001F1EE010000-0x000001F1EE01A000-memory.dmp
memory/4700-42-0x000001F1ECF00000-0x000001F1ED9C2000-memory.dmp
memory/4700-18-0x000001F1EDF00000-0x000001F1EDFB3000-memory.dmp
memory/4700-4-0x000001F1EDCA0000-0x000001F1EDCC2000-memory.dmp
memory/4700-3-0x000001F1ED6CA000-0x000001F1ED6CB000-memory.dmp