0131631d83fedd5969e818e8a430da590d47439dd593178ab7a1d119be0c4a09

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 09:19

Target
2026-07-23_31146e951f4d49d86805d266c65463ea_icedid_luca-stealer_njrat.exe
Size 1.4MB
Sample260723-laeesaba69
SHA256 0131631d83fedd5969e818e8a430da590d47439dd593178ab7a1d119be0c4a09
MD5 31146e951f4d49d86805d266c65463ea
SHA1 17aab80cc3ea4daf2ef0e09879197f11bc16359a
SHA512 3d8cf15588ae34c775e860129b6eb8d31912998023bc36464656af502b8fd8c3f6a97ca82a64bbbb0dfd093a2e346cb790d6a2d8594a18ae64bd51920bee524d
SSDEEP 24576:N8pQbmiPpbcOLRXljdce85LEk0wo+hzAXA2ZipIXW4Jx+RPinGz+R0wyJuA:5mcxLlljdUwklhzYA0i7/RPUQN
TLSH
T13465025A6BA401F9D1A7D174CD42590BDBB2FC060F64AB8F03E449960F376B09E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2816	3056	2026-07-23_31146e951f4d49d86805d266c65463ea_icedid_luca-stealer_njrat.exe	90
PID 3056 wrote to memory of 2816	3056	2026-07-23_31146e951f4d49d86805d266c65463ea_icedid_luca-stealer_njrat.exe	90
PID 3056 wrote to memory of 1872	3056	2026-07-23_31146e951f4d49d86805d266c65463ea_icedid_luca-stealer_njrat.exe	93
PID 3056 wrote to memory of 1872	3056	2026-07-23_31146e951f4d49d86805d266c65463ea_icedid_luca-stealer_njrat.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-23_31146e951f4d49d86805d266c65463ea_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_31146e951f4d49d86805d266c65463ea_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3428