Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 09:19
General
- Target 2026-07-01_7cbbdfa0bd5452b80fcd173366f19dd3_icedid_luca-stealer_njrat_stealc.exe
- Size 1.0MB
- Sample260701-lafmvaav2n
- SHA256 f362a35773465d504c8298a1a2093b2d5675bb77f9a338367703059645613110
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables containing bas64 encoded gzip files 1 IoCs
- Detects executables referencing combination of virtualization drivers 2 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 4 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Looks for VMWare services registry key. 1 TTPs 3 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_7cbbdfa0bd5452b80fcd173366f19dd3_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_7cbbdfa0bd5452b80fcd173366f19dd3_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TmpADBF.tmp
memory/5720-0-0x00007FF944AA0000-0x00007FF944D03000-memory.dmp
memory/5720-1-0x00007FF70C1A5000-0x00007FF70C1A6000-memory.dmp
memory/5720-3-0x00007FF70C1A0000-0x00007FF70C2B2000-memory.dmp
memory/5720-2-0x00007FF70C1A0000-0x00007FF70C2B2000-memory.dmp
memory/5720-4-0x00000230F8A30000-0x00000230F8A86000-memory.dmp
memory/5720-6-0x00000230F8BA0000-0x00000230F8BF4000-memory.dmp
memory/5720-7-0x00000230F8B50000-0x00000230F8B68000-memory.dmp
memory/5720-8-0x00000230F9570000-0x00000230F95BC000-memory.dmp
memory/5720-19-0x00007FF70C1A5000-0x00007FF70C1A6000-memory.dmp