Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 02:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc.exe
Resource
win11-20260513-en
2 signatures
150 seconds
General
- Target 2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc.exe
- Size 1.3MB
- Sample260602-cys4eaby8z
- SHA256 277c44e1c18002b4fe51c0ba195b9ca67083023e18cb4c5e5f37319612685481
- MD5 6a10e49b55b6d133d9b934b715ce9efb
- SHA1 9ff8bfc6cc19b253c96b217eeba4f71ddff33ef7
- SHA512 a1bb016ccc6a0508c592d70304e2b1facc222630ca62f74e73b4f9baffe4690ef7aebad1dab779352c8868beb625e88afba28955f7463790b7d668b4d40c8ac3
- SSDEEP 24576:NPjjWXU8L4z+aKMv8SKkHNryYvty5JYubykU3WjhR+:ZHWkfz+aKMv8SKKuYvty5J1byvuhR
- TLSH T1255517D455B905ACE066D97C8A91CC8AE5EB7C0C033D7AFB02B036591F3EBE50A79E11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 3388 2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 3388 2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc.exe Token: SeChangeNotifyPrivilege 3388 2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc.exe Token: SeIncBasePriorityPrivilege 3388 2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc.exe Token: SeIncreaseQuotaPrivilege 3388 2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc.exe Token: SeProfSingleProcessPrivilege 3388 2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc.exe Token: SeCreateGlobalPrivilege 3388 2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc.exe Token: SeBackupPrivilege 3388 2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc.exe Token: SeRestorePrivilege 3388 2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3388