7ebc7c64aa39399dc1c9063243e196306cb5211c8ae952f0197639a3a84414f3

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 01:05

Target
2026-07-13_a3e02f13f0cc28f1def6215f9adba4c8_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc.exe
Size 1.9MB
Sample260713-bfpgtsaw2m
SHA256 7ebc7c64aa39399dc1c9063243e196306cb5211c8ae952f0197639a3a84414f3
MD5 a3e02f13f0cc28f1def6215f9adba4c8
SHA1 182b57b02f62448edde5ad1fa499b6ee98120f88
SHA512 0ce570f457e616c32066d78270573f702c5318f18a909cab83d3a3c3dc94da00429ae4d5bb9ae9a067a5da14027ea17d4567133eeff3936342163c1e5583df54
SSDEEP 24576:WcC8etlElfhMpAN4WIq1Bid+ju0C5FrgrjETOzTjC/s7DjkDZddLHC2ybA+G+GV:WcTetylSGBM+r1nDYD5LHbd+Gp
TLSH
T1F2956C26E3B610F8E8B7D134C9A29662FBB17805477897DF1790455A0F33BE09A3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4680	2026-07-13_a3e02f13f0cc28f1def6215f9adba4c8_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc.exe
4680	2026-07-13_a3e02f13f0cc28f1def6215f9adba4c8_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	2026-07-13_a3e02f13f0cc28f1def6215f9adba4c8_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 3464	4680	2026-07-13_a3e02f13f0cc28f1def6215f9adba4c8_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-13_a3e02f13f0cc28f1def6215f9adba4c8_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_a3e02f13f0cc28f1def6215f9adba4c8_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Users\Admin\AppData\Local\Temp\2026-07-13_a3e02f13f0cc28f1def6215f9adba4c8_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-13_a3e02f13f0cc28f1def6215f9adba4c8_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc.exe" --cleanup-payload "C:\Users\Admin\AppData\Local\Temp" 4680
  2⤵
  PID:3464