f0db25f16eb7bd2fbd68a305a4f9c79d5de98af308c80d76f9475af1f4ea29f8

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe
Size 1.5MB
Sample260718-3vsxcaas51
SHA256 f0db25f16eb7bd2fbd68a305a4f9c79d5de98af308c80d76f9475af1f4ea29f8
MD5 34769deda5790264a12cd1291e3e70df
SHA1 f99b419ef6c63b6cc39110e65a6f959b62eb75b5
SHA512 78bb3469c64bf77c571001611c82af57fbed66a5b79e5e0bb7ddbf78ca1a697516a05b2bfc6e7dd73c2eb18ead2cc8b2f32fe366523149e6eac02c36f2d09ace
SSDEEP 24576:YtF5Pae92VZ/CLW5Q62xCMMf6YoqKqU2jkPWrQ1llRsZjW+ZlpqZaa1q:4F5CCIZ5R2xVtqnp4uE17Wt3Zlpqh
TLSH
T10E75F11AA2A401FCE1E7D174CD674903DA72F84A4B71A64F07E459D61F237A09E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	firefox.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	chrome.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	msedge.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	firefox.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	msedge.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	firefox.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	chrome.exe

Looks for VMWare services registry key. 1 TTPs 3 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	firefox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4868	chrome.exe
4868	chrome.exe
4604	msedge.exe
4604	msedge.exe
5096	firefox.exe
5096	firefox.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 4868	724	2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe	86
PID 724 wrote to memory of 4868	724	2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe	86
PID 724 wrote to memory of 4604	724	2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe	95
PID 724 wrote to memory of 4604	724	2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe	95
PID 724 wrote to memory of 5096	724	2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe	96
PID 724 wrote to memory of 5096	724	2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Suspicious behavior: EnumeratesProcesses
  PID:4604
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Suspicious behavior: EnumeratesProcesses
  PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads