e2eec1ff13393cd2d1ab54112271026a546c04051177d14565739df3426af553

General

Target
2026-07-18_bf6d2b84544f6d40277bd810bf3e3a04_icedid_luca-stealer_njrat.exe
Size 1.5MB
Sample260718-3qgnhsft8j
SHA256 e2eec1ff13393cd2d1ab54112271026a546c04051177d14565739df3426af553
MD5 bf6d2b84544f6d40277bd810bf3e3a04
SHA1 956cab2dd0667300c9dcd56f2cc16cd09acd5a98
SHA512 be350e47db6e1fbc670ab5ce885ecfa3aa89412875da3c3d4bfe2ac86198e457794c7478c352951f39c38bb949b6fa721fb614ffb7c4c2bca4dcb0098a3b66ee
SSDEEP 49152:aSBdIA0/SDfthWX/j8gRHL+4eOkOomsQs0RLIjqySc:DBLZhWXL8g5L+POVkG
TLSH
T1E175011BA7A401FCE1E7C275CD475947D6B2B80A4B71A68F03E44A961F337609E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery execution persistence privilege_escalation stealer

Malware Config

Signatures

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4140	cmd.exe
5556	cmd.exe
3112	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5556	cmd.exe
3284	netsh.exe
3112	cmd.exe
2644	netsh.exe
4140	cmd.exe
3184	netsh.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 5044	2836	2026-07-18_bf6d2b84544f6d40277bd810bf3e3a04_icedid_luca-stealer_njrat.exe	90
PID 2836 wrote to memory of 5044	2836	2026-07-18_bf6d2b84544f6d40277bd810bf3e3a04_icedid_luca-stealer_njrat.exe	90
PID 5044 wrote to memory of 4140	5044	chrome.exe	93
PID 4140 wrote to memory of 3184	4140	cmd.exe	95
PID 2836 wrote to memory of 3940	2836	2026-07-18_bf6d2b84544f6d40277bd810bf3e3a04_icedid_luca-stealer_njrat.exe	96
PID 2836 wrote to memory of 3940	2836	2026-07-18_bf6d2b84544f6d40277bd810bf3e3a04_icedid_luca-stealer_njrat.exe	96
PID 3940 wrote to memory of 5556	3940	msedge.exe	97
PID 5556 wrote to memory of 3284	5556	cmd.exe	99
PID 2836 wrote to memory of 3756	2836	2026-07-18_bf6d2b84544f6d40277bd810bf3e3a04_icedid_luca-stealer_njrat.exe	100
PID 2836 wrote to memory of 3756	2836	2026-07-18_bf6d2b84544f6d40277bd810bf3e3a04_icedid_luca-stealer_njrat.exe	100
PID 3756 wrote to memory of 3112	3756	firefox.exe	101
PID 3112 wrote to memory of 2644	3112	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-07-18_bf6d2b84544f6d40277bd810bf3e3a04_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_bf6d2b84544f6d40277bd810bf3e3a04_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profiles
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profiles
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5556
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3284
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profiles
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Network Configuration Discovery

1

T1016

Wi-Fi Discovery

1

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Electrum.txt

Path C:\Users\Admin\AppData\Local\Temp\output\Wallets\Electrum.txt
Size 73B
SHA256 0d44584b45475e9353f3ae220cf2eb9245aed3c72b6152e1d91321123896f799
MD5 4541962ad5e6d0b9d837543aa06c71aa
SHA1 286284224616fa31aac6aca7eb90f2acaa447b9a
SHA512 b822c2cf9d6d389018adb918e7dd5696932fb1679806e2f05e4ad91cebc157ad26094d5e6929dee4f15c4c25e014391e86aea6867778615fe70c8ee9d614e455
TLSH
T1F0A002E91BC5F70D74114A975AF2D0F8A474D9447F4C693BD74A444D2180CA4FC4105F
MD5 SHA1 SHA512 TLSH

Submit Download

Exodus.txt

Path C:\Users\Admin\AppData\Local\Temp\output\Wallets\Exodus.txt
Size 75B
SHA256 29cb643dd324fe6bac4263310c9b9f65dd089f8de278f6893459dd5665231d98
MD5 f8fb967abb0fe92feaee51f36085be58
SHA1 a103be3e824f3832121a779c5d0d4518b7affe1e
SHA512 699deae82e6a005b4ace8e2927a614f0c1a254de41a73a18401cd21b8e69807100af0b83a86f50b28e97ad4f104bf9ee532c3eced1f64e1e648e4c3db9cb3090
TLSH
T1ABA022B023C0830E380802CB8B33E0E800200A003F003E38C388FC082380C00BC00020
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads