99fd931b897f7dca0ad7086b621a82769c60a02d5fde258cb63e678abe473de7

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_734eb1ab65ba6c7aee95267fbba7aabf_icedid_luca-stealer_njrat.exe
Size 1.6MB
Sample260720-llxeqsdt4k
SHA256 99fd931b897f7dca0ad7086b621a82769c60a02d5fde258cb63e678abe473de7
MD5 734eb1ab65ba6c7aee95267fbba7aabf
SHA1 6bcc8ac086639864bc6a1b195064fe9a63089508
SHA512 5071b39a7c9fa8bc85a4a1e2885e9f833ab18a65267f7c42bfa2619b8885829e9832193754868f21d9a4adef95cbb1efab869f587c06f38028f6d20f2429bad4
SSDEEP 24576:BNkc9Ysk2vqIx5mduxCmhUD3q1NbTJJVMWzqVxfLrBz7pjsY6Oj:Acq/2SIx5mduE0UD3OxtlzqVxf39
TLSH
T11775021696E401FCE1B7D1B8CD928D46EB72BC060BA05ADF13E045961F676E08E7E732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 12 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	firefox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	firefox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	firefox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	firefox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	chrome.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	chrome.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	msedge.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	firefox.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	chrome.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	msedge.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	firefox.exe

Looks for VMWare services registry key. 1 TTPs 3 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	firefox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4864	chrome.exe
4864	chrome.exe
2776	msedge.exe
2776	msedge.exe
3768	firefox.exe
3768	firefox.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 4864	1416	2026-07-20_734eb1ab65ba6c7aee95267fbba7aabf_icedid_luca-stealer_njrat.exe	90
PID 1416 wrote to memory of 4864	1416	2026-07-20_734eb1ab65ba6c7aee95267fbba7aabf_icedid_luca-stealer_njrat.exe	90
PID 1416 wrote to memory of 2776	1416	2026-07-20_734eb1ab65ba6c7aee95267fbba7aabf_icedid_luca-stealer_njrat.exe	92
PID 1416 wrote to memory of 2776	1416	2026-07-20_734eb1ab65ba6c7aee95267fbba7aabf_icedid_luca-stealer_njrat.exe	92
PID 1416 wrote to memory of 3768	1416	2026-07-20_734eb1ab65ba6c7aee95267fbba7aabf_icedid_luca-stealer_njrat.exe	93
PID 1416 wrote to memory of 3768	1416	2026-07-20_734eb1ab65ba6c7aee95267fbba7aabf_icedid_luca-stealer_njrat.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-20_734eb1ab65ba6c7aee95267fbba7aabf_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_734eb1ab65ba6c7aee95267fbba7aabf_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Suspicious behavior: EnumeratesProcesses
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Suspicious behavior: EnumeratesProcesses
  PID:2776
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Suspicious behavior: EnumeratesProcesses
  PID:3768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads