Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 19:39
General
- Target 2026-07-20_2ee2cace168c84bd57de77f641cbc0dd_icedid_luca-stealer_njrat_stealc.exe
- Size 9.9MB
- Sample260720-ydf41aez7w
- SHA256 109accf45c6e9945e756c501315612bd82086e65c8bdc4fde0bf47f0a0842c46
Malware Config
Signatures
- Detects executables packed with Themida 13 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Themida packer 13 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_2ee2cace168c84bd57de77f641cbc0dd_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_2ee2cace168c84bd57de77f641cbc0dd_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\winldr_ice.exe"C:\Users\Admin\AppData\Local\Temp\winldr_ice.exe" 2026-07-20_2ee2cace168c84bd57de77f641cbc0dd_icedid_luca-stealer_njrat_stealc.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Deletes itself
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exe3⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
winldr_ice.exe
memory/3260-8-0x00007FF7691C0000-0x00007FF76A5AF700-memory.dmp
memory/3260-9-0x00007FF7691C0000-0x00007FF76A5AF700-memory.dmp
memory/3260-10-0x00007FF7691C0000-0x00007FF76A5AF700-memory.dmp
memory/3260-12-0x00007FF7691C0000-0x00007FF76A5AF700-memory.dmp
memory/3260-14-0x00007FF7691C0000-0x00007FF76A5AF700-memory.dmp
memory/3260-15-0x00007FF7691F6000-0x00007FF7691F7000-memory.dmp
memory/3260-13-0x00007FF7691C0000-0x00007FF76A5AF700-memory.dmp
memory/3260-16-0x00007FF7691C0000-0x00007FF76A5AF700-memory.dmp
memory/3260-11-0x00007FF7691C0000-0x00007FF76A5AF700-memory.dmp
memory/3260-18-0x00007FF7691C0000-0x00007FF76A5AF700-memory.dmp
memory/3260-41-0x00007FF7691C0000-0x00007FF76A5AF700-memory.dmp
memory/3260-39-0x00007FF7691C0000-0x00007FF76A5AF700-memory.dmp
memory/3260-35-0x00007FF7691C0000-0x00007FF76A5AF700-memory.dmp
memory/6084-21-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-30-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-20-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-19-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-29-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-26-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-28-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-25-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-31-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-24-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-32-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-33-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-17-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-38-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-37-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-22-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-23-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-42-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-46-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp
memory/6084-47-0x000001CD8E420000-0x000001CD8F5E4000-memory.dmp