f0db25f16eb7bd2fbd68a305a4f9c79d5de98af308c80d76f9475af1f4ea29f8

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe
Size 1.5MB
Sample260718-3vsxcaas51
SHA256 f0db25f16eb7bd2fbd68a305a4f9c79d5de98af308c80d76f9475af1f4ea29f8
MD5 34769deda5790264a12cd1291e3e70df
SHA1 f99b419ef6c63b6cc39110e65a6f959b62eb75b5
SHA512 78bb3469c64bf77c571001611c82af57fbed66a5b79e5e0bb7ddbf78ca1a697516a05b2bfc6e7dd73c2eb18ead2cc8b2f32fe366523149e6eac02c36f2d09ace
SSDEEP 24576:YtF5Pae92VZ/CLW5Q62xCMMf6YoqKqU2jkPWrQ1llRsZjW+ZlpqZaa1q:4F5CCIZ5R2xVtqnp4uE17Wt3Zlpqh
TLSH
T10E75F11AA2A401FCE1E7D174CD674903DA72F84A4B71A64F07E459D61F237A09E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	firefox.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	chrome.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	msedge.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	firefox.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	chrome.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	msedge.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	firefox.exe

Looks for VMWare services registry key. 1 TTPs 3 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	firefox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2940	chrome.exe
2940	chrome.exe
2440	msedge.exe
2440	msedge.exe
1120	firefox.exe
1120	firefox.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2940	2868	2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe	89
PID 2868 wrote to memory of 2940	2868	2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe	89
PID 2868 wrote to memory of 2440	2868	2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe	91
PID 2868 wrote to memory of 2440	2868	2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe	91
PID 2868 wrote to memory of 1120	2868	2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe	92
PID 2868 wrote to memory of 1120	2868	2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Suspicious behavior: EnumeratesProcesses
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Suspicious behavior: EnumeratesProcesses
  PID:2440
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Suspicious behavior: EnumeratesProcesses
  PID:1120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads