2e41002e1f6848748f6afe28caea7f6d46675acf3de9157f6f8faf43f2ae1f76

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_10b055312e4c014c9117362249ef238f_icedid_luca-stealer_njrat.exe
Size 1.5MB
Sample260718-3xfd2aas9v
SHA256 2e41002e1f6848748f6afe28caea7f6d46675acf3de9157f6f8faf43f2ae1f76
MD5 10b055312e4c014c9117362249ef238f
SHA1 36b4ba8d140156d4c440bdb9598ea4ef1df1f933
SHA512 8dced7a1fa78e785cdfc9f840aaf44aaed6267405b4f819507498b62e1231445fd22d12fba2656cf077bf2c7776b962e29fd5d5e25f4e7134fb6ec7bac8749b9
SSDEEP 24576:uk7btrFBbfqN7tCbbK31erCqaVYyGBY4ThCd9fmzv/+sGMwXXC0zrU/Nxyz66:u8Vjy40eOqaeetdgDWsAyOrU/S
TLSH
T18675021F57A500FDD0EBC2B4CD564A07D6B2F80A4B71A69F03E549961F237A09E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 12 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	firefox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	firefox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	firefox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	firefox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	msedge.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	firefox.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	chrome.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	msedge.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	chrome.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	msedge.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	firefox.exe

Looks for VMWare services registry key. 1 TTPs 3 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	firefox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3452	chrome.exe
3452	chrome.exe
1484	msedge.exe
1484	msedge.exe
4092	firefox.exe
4092	firefox.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5764 wrote to memory of 3452	5764	2026-07-18_10b055312e4c014c9117362249ef238f_icedid_luca-stealer_njrat.exe	89
PID 5764 wrote to memory of 3452	5764	2026-07-18_10b055312e4c014c9117362249ef238f_icedid_luca-stealer_njrat.exe	89
PID 5764 wrote to memory of 1484	5764	2026-07-18_10b055312e4c014c9117362249ef238f_icedid_luca-stealer_njrat.exe	90
PID 5764 wrote to memory of 1484	5764	2026-07-18_10b055312e4c014c9117362249ef238f_icedid_luca-stealer_njrat.exe	90
PID 5764 wrote to memory of 4092	5764	2026-07-18_10b055312e4c014c9117362249ef238f_icedid_luca-stealer_njrat.exe	91
PID 5764 wrote to memory of 4092	5764	2026-07-18_10b055312e4c014c9117362249ef238f_icedid_luca-stealer_njrat.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-18_10b055312e4c014c9117362249ef238f_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_10b055312e4c014c9117362249ef238f_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Suspicious behavior: EnumeratesProcesses
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Suspicious behavior: EnumeratesProcesses
  PID:1484
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Suspicious behavior: EnumeratesProcesses
  PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads