Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/07/2026, 22:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260710-en
4 signatures
150 seconds
General
- Target 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe
- Size 11.1MB
- Sample260719-182ejadz3l
- SHA256 83ce0383c224b3e95e5365a7c8c975b6a21b1be5ebf7da28c52d7d0d1b9d5a09
- MD5 6b31a039c4dd0a300d45e80e3d9b5370
- SHA1 e9e24d187f7e424a4834a73c55485d0ec8b56505
- SHA512 ab1b2742515a0cba31a7ed9813c5182782ae8342ec5f22631cb1b3afe6d5b6ef23c4b8f08f25caa685cb0f60d19db6d73d0ee0879cd8c005988ccce86e8f52cc
- SSDEEP 98304:aa6fiCHkhEo4MxLaZbGTwCNt8JCwiQc+4EX2Q5VHz5N:aa6fgAmaZbGTwCNt8JCwiQcVoT
- TLSH T1ADC6BF4563A500D8D067C078CB976947E371385203B16AEF2AE4A5796F33BE05F7BB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe - Modifies registry class 42 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Snes9x.Win32\shell 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Snes9x.Win32\shell\ = "open" 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Snes9x.Win32\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe\" \"%L\"" 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.smc\OpenWithList\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.smc\OpenWithList 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.swc 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.sfc 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Snes9x.Win32\DefaultIcon 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Snes9x.Win32\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe,0" 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Applications 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Applications\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe\shell 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.fig\OpenWithList 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.bs 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.jma\OpenWithList\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Applications\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.bs\OpenWithList 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Snes9x.Win32\ = "Snes9x ROM" 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.fig 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.gz 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Snes9x.Win32 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.smc 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.zip 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.sfc\OpenWithList\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.bs\OpenWithList\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.jma 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.jma\OpenWithList 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Snes9x.Win32\shell\open\command 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Snes9x.Win32\shell\open 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Applications\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe\shell\open\command 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Applications\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe\shell\open 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.msu1\OpenWithList 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.gz\OpenWithList\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.sfc\OpenWithList 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Applications\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe\" \"%L\"" 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.zip\OpenWithList\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.gz\OpenWithList 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.swc\OpenWithList 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.msu1\OpenWithList\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.msu1 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.swc\OpenWithList\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.fig\OpenWithList\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.zip\OpenWithList 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5844 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5844 2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_6b31a039c4dd0a300d45e80e3d9b5370_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5844