0131631d83fedd5969e818e8a430da590d47439dd593178ab7a1d119be0c4a09

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 09:19

Target
2026-07-23_31146e951f4d49d86805d266c65463ea_icedid_luca-stealer_njrat.exe
Size 1.4MB
Sample260723-laeesaba69
SHA256 0131631d83fedd5969e818e8a430da590d47439dd593178ab7a1d119be0c4a09
MD5 31146e951f4d49d86805d266c65463ea
SHA1 17aab80cc3ea4daf2ef0e09879197f11bc16359a
SHA512 3d8cf15588ae34c775e860129b6eb8d31912998023bc36464656af502b8fd8c3f6a97ca82a64bbbb0dfd093a2e346cb790d6a2d8594a18ae64bd51920bee524d
SSDEEP 24576:N8pQbmiPpbcOLRXljdce85LEk0wo+hzAXA2ZipIXW4Jx+RPinGz+R0wyJuA:5mcxLlljdUwklhzYA0i7/RPUQN
TLSH
T13465025A6BA401F9D1A7D174CD42590BDBB2FC060F64AB8F03E449960F376B09E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 4944	3796	2026-07-23_31146e951f4d49d86805d266c65463ea_icedid_luca-stealer_njrat.exe	88
PID 3796 wrote to memory of 4944	3796	2026-07-23_31146e951f4d49d86805d266c65463ea_icedid_luca-stealer_njrat.exe	88
PID 3796 wrote to memory of 5112	3796	2026-07-23_31146e951f4d49d86805d266c65463ea_icedid_luca-stealer_njrat.exe	91
PID 3796 wrote to memory of 5112	3796	2026-07-23_31146e951f4d49d86805d266c65463ea_icedid_luca-stealer_njrat.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-23_31146e951f4d49d86805d266c65463ea_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_31146e951f4d49d86805d266c65463ea_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4688

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\output\Chrome\Default\cookies.json
Size 338B
SHA256 9ac33520535081108633ae54a0286ede8aa7b977037248476c4e04d722ac5b07
MD5 51f1fa43a78de20c6547e6858136c1cf
SHA1 0ef272c9016532c694c5f33d8ecb650f65905905
SHA512 93ae6d8c5ba61a3c534a3d8573ff08dd1e276501fb1ba03823317bca8f787f45ccc00ac7b289d8f33f60b3adda64270d0b88b2a632a7630c369fe12c48629786
TLSH
T1B5E0C08638D2C42B88128610D84007387C182772512DED984694A018B52063F7554AAA
MD5 SHA1 SHA512 TLSH

Submit Download