Analysis
- max time kernel
149s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
13/07/2026, 01:02
General
- Target 2026-07-13_d55e2d7cd941e51dd301bf32dd030c82_icedid_luca-stealer_njrat_ryuk_stealc.exe
- Size 3.0MB
- Sample260713-bdv7lacw21
- SHA256 5615533ffacb69baf0d87194bb19a9a95dbc5a269d6a7315010c905c3f5f7909
Malware Config
Signatures
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs
- Detects executables manipulated with Fody 2 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Costura .NET executable packer 2 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Drops file in Program Files directory 2 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Modifies registry class 6 IoCs
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-13_d55e2d7cd941e51dd301bf32dd030c82_icedid_luca-stealer_njrat_ryuk_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-13_d55e2d7cd941e51dd301bf32dd030c82_icedid_luca-stealer_njrat_ryuk_stealc.exe"1⤵
- Accesses Microsoft Outlook profiles
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C chcp 65001 && netsh wlan show profiles | findstr All2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\system32\findstr.exefindstr All3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\xaitx.exe"C:\Program Files (x86)\Microsoft\Edge\Application\xaitx.exe" edge2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\MsEdgeUpdate.exeC:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\MsEdgeUpdate.exe1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\cmd.exe"cmd" /C chcp 65001 && netsh wlan show profiles | findstr All2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\system32\findstr.exefindstr All3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c tasklist2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\xaitx.exe"C:\Program Files (x86)\Microsoft\Edge\Application\xaitx.exe" edge2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
xaitx.exe
[Unknown]e79f7438e273e70615984aea487e8563.zip
sx41B7.tmp.dll
tmp83E7.tmp.dat
tmp85DF.tmp.dat
MsEdgeUpdate.exe
memory/2640-7-0x000000001B410000-0x000000001B61A000-memory.dmp
memory/2640-15-0x000000001CC80000-0x000000001CCD0000-memory.dmp
memory/2640-16-0x000000001B750000-0x000000001B760000-memory.dmp
memory/2640-20-0x000000001CE00000-0x000000001CE22000-memory.dmp
memory/2640-8-0x000000001B750000-0x000000001B760000-memory.dmp
memory/2640-1-0x00000000023D0000-0x00000000025D6000-memory.dmp
memory/2640-6-0x0000000002160000-0x0000000002168000-memory.dmp
memory/2640-5-0x0000000002150000-0x0000000002158000-memory.dmp
memory/2640-3-0x0000000000410000-0x0000000000411000-memory.dmp
memory/2788-14-0x0000000001FD0000-0x0000000001FE0000-memory.dmp
memory/2788-17-0x0000000001FD0000-0x0000000001FE0000-memory.dmp