643c3aa46a916b9ccf6b5bafa7db6f1298c489be75f62a5e2b9d90b3991b1276

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 00:58

Target
2026-07-24_3405a4cf7d06d7d599c973f7c872c13f_icedid_luca-stealer_njrat_stealc.exe
Size 1.2MB
Sample260724-bbtwraea26
SHA256 643c3aa46a916b9ccf6b5bafa7db6f1298c489be75f62a5e2b9d90b3991b1276
MD5 3405a4cf7d06d7d599c973f7c872c13f
SHA1 263546bde733120d49f23e17d1c74c735f4add65
SHA512 f0b943f682a40aa06b9fa2f098cb6a831faf64a9f9c16dc4b1127e0efe8df8cd9163bc0414523e9754223d8f0be77c6d538cdf0c62e00f57ad5b7c89e6ebcf9d
SSDEEP 24576:YIrXckfDzHGCH5oWQDAYxx9SftjUUEgbie:YgckfDzHGCHyWQnJSlwFgbT
TLSH
T1E9459F1BA6BC42F9E0BBC175C646580BEBB2744A1334E59F03E08A566F375209F7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
3376	{842DE3D6-AC66-4311-B16B-E9A1783FB72D}.hhdsetup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3376	{842DE3D6-AC66-4311-B16B-E9A1783FB72D}.hhdsetup.exe
3376	{842DE3D6-AC66-4311-B16B-E9A1783FB72D}.hhdsetup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3376	{842DE3D6-AC66-4311-B16B-E9A1783FB72D}.hhdsetup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 3376	4720	2026-07-24_3405a4cf7d06d7d599c973f7c872c13f_icedid_luca-stealer_njrat_stealc.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-24_3405a4cf7d06d7d599c973f7c872c13f_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_3405a4cf7d06d7d599c973f7c872c13f_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Local\Temp\{842DE3D6-AC66-4311-B16B-E9A1783FB72D}.hhdsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\{842DE3D6-AC66-4311-B16B-E9A1783FB72D}.hhdsetup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3376

{842DE3D6-AC66-4311-B16B-E9A1783FB72D}.hhdsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\{842DE3D6-AC66-4311-B16B-E9A1783FB72D}.hhdsetup.exe
Size 1.2MB
SHA256 643c3aa46a916b9ccf6b5bafa7db6f1298c489be75f62a5e2b9d90b3991b1276
MD5 3405a4cf7d06d7d599c973f7c872c13f
SHA1 263546bde733120d49f23e17d1c74c735f4add65
SHA512 f0b943f682a40aa06b9fa2f098cb6a831faf64a9f9c16dc4b1127e0efe8df8cd9163bc0414523e9754223d8f0be77c6d538cdf0c62e00f57ad5b7c89e6ebcf9d
SSDEEP 24576:YIrXckfDzHGCH5oWQDAYxx9SftjUUEgbie:YgckfDzHGCHyWQnJSlwFgbT
TLSH
T1E9459F1BA6BC42F9E0BBC175C646580BEBB2744A1334E59F03E08A566F375209F7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download