04aff7e8874fe81f28ea2997ac0c883ef39596abae5fc214bfcf900702523a74

General

Target
2026-07-20_f6688256a093bb1147ff409187b134f6_icedid_luca-stealer_njrat.exe
Size 1.5MB
Sample260720-ctx7kacv4m
SHA256 04aff7e8874fe81f28ea2997ac0c883ef39596abae5fc214bfcf900702523a74
MD5 f6688256a093bb1147ff409187b134f6
SHA1 a149c317fd1ef51855d2c2f9624a0cd4550dd996
SHA512 19d372a681daeaf0d607d5ae774cea05932583fa5aee8b5b3132b2197347b46b8afe88e88a8cde6a5e6fb34e8b547c324bd8b0ce39ded1f29ae0b9133becb12a
SSDEEP 24576:dI7hTBcz7eE391letC9zjf6Axg4Y8FJdzLCX4XJgeXkO9GAAmHWlblusYGiC1P2q:dmmCE3JecdjxYAJCoXJ7yDlY7C1U
TLSH
T1A675021B66A400FCE1EBD278CE164547E7B2BC0A4B71A68F07E445D61F27BA09D3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery execution persistence privilege_escalation stealer

Malware Config

Signatures

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5472	cmd.exe
5392	cmd.exe
4908	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5928	netsh.exe
5392	cmd.exe
4936	netsh.exe
4908	cmd.exe
1724	netsh.exe
5472	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 4260	1184	2026-07-20_f6688256a093bb1147ff409187b134f6_icedid_luca-stealer_njrat.exe	89
PID 1184 wrote to memory of 4260	1184	2026-07-20_f6688256a093bb1147ff409187b134f6_icedid_luca-stealer_njrat.exe	89
PID 4260 wrote to memory of 5472	4260	chrome.exe	92
PID 5472 wrote to memory of 5928	5472	cmd.exe	94
PID 1184 wrote to memory of 5784	1184	2026-07-20_f6688256a093bb1147ff409187b134f6_icedid_luca-stealer_njrat.exe	95
PID 1184 wrote to memory of 5784	1184	2026-07-20_f6688256a093bb1147ff409187b134f6_icedid_luca-stealer_njrat.exe	95
PID 5784 wrote to memory of 5392	5784	msedge.exe	96
PID 5392 wrote to memory of 4936	5392	cmd.exe	98
PID 1184 wrote to memory of 4480	1184	2026-07-20_f6688256a093bb1147ff409187b134f6_icedid_luca-stealer_njrat.exe	99
PID 1184 wrote to memory of 4480	1184	2026-07-20_f6688256a093bb1147ff409187b134f6_icedid_luca-stealer_njrat.exe	99
PID 4480 wrote to memory of 4908	4480	firefox.exe	100
PID 4908 wrote to memory of 1724	4908	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-20_f6688256a093bb1147ff409187b134f6_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_f6688256a093bb1147ff409187b134f6_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profiles
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5472
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profiles
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5392
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4936
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profiles
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Network Configuration Discovery

1

T1016

Wi-Fi Discovery

1

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Electrum.txt

Path C:\Users\Admin\AppData\Local\Temp\output\Wallets\Electrum.txt
Size 73B
SHA256 0d44584b45475e9353f3ae220cf2eb9245aed3c72b6152e1d91321123896f799
MD5 4541962ad5e6d0b9d837543aa06c71aa
SHA1 286284224616fa31aac6aca7eb90f2acaa447b9a
SHA512 b822c2cf9d6d389018adb918e7dd5696932fb1679806e2f05e4ad91cebc157ad26094d5e6929dee4f15c4c25e014391e86aea6867778615fe70c8ee9d614e455
TLSH
T1F0A002E91BC5F70D74114A975AF2D0F8A474D9447F4C693BD74A444D2180CA4FC4105F
MD5 SHA1 SHA512 TLSH

Submit Download

Exodus.txt

Path C:\Users\Admin\AppData\Local\Temp\output\Wallets\Exodus.txt
Size 75B
SHA256 29cb643dd324fe6bac4263310c9b9f65dd089f8de278f6893459dd5665231d98
MD5 f8fb967abb0fe92feaee51f36085be58
SHA1 a103be3e824f3832121a779c5d0d4518b7affe1e
SHA512 699deae82e6a005b4ace8e2927a614f0c1a254de41a73a18401cd21b8e69807100af0b83a86f50b28e97ad4f104bf9ee532c3eced1f64e1e648e4c3db9cb3090
TLSH
T1ABA022B023C0830E380802CB8B33E0E800200A003F003E38C388FC082380C00BC00020
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads