643c3aa46a916b9ccf6b5bafa7db6f1298c489be75f62a5e2b9d90b3991b1276

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 00:58

Target
2026-07-24_3405a4cf7d06d7d599c973f7c872c13f_icedid_luca-stealer_njrat_stealc.exe
Size 1.2MB
Sample260724-bbtwraea26
SHA256 643c3aa46a916b9ccf6b5bafa7db6f1298c489be75f62a5e2b9d90b3991b1276
MD5 3405a4cf7d06d7d599c973f7c872c13f
SHA1 263546bde733120d49f23e17d1c74c735f4add65
SHA512 f0b943f682a40aa06b9fa2f098cb6a831faf64a9f9c16dc4b1127e0efe8df8cd9163bc0414523e9754223d8f0be77c6d538cdf0c62e00f57ad5b7c89e6ebcf9d
SSDEEP 24576:YIrXckfDzHGCH5oWQDAYxx9SftjUUEgbie:YgckfDzHGCHyWQnJSlwFgbT
TLSH
T1E9459F1BA6BC42F9E0BBC175C646580BEBB2744A1334E59F03E08A566F375209F7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
4624	{8927D09F-312D-4837-BB80-FEF975BE20CB}.hhdsetup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4624	{8927D09F-312D-4837-BB80-FEF975BE20CB}.hhdsetup.exe
4624	{8927D09F-312D-4837-BB80-FEF975BE20CB}.hhdsetup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4624	{8927D09F-312D-4837-BB80-FEF975BE20CB}.hhdsetup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 4624	5800	2026-07-24_3405a4cf7d06d7d599c973f7c872c13f_icedid_luca-stealer_njrat_stealc.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-24_3405a4cf7d06d7d599c973f7c872c13f_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_3405a4cf7d06d7d599c973f7c872c13f_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Users\Admin\AppData\Local\Temp\{8927D09F-312D-4837-BB80-FEF975BE20CB}.hhdsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\{8927D09F-312D-4837-BB80-FEF975BE20CB}.hhdsetup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4624

{8927D09F-312D-4837-BB80-FEF975BE20CB}.hhdsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\{8927D09F-312D-4837-BB80-FEF975BE20CB}.hhdsetup.exe
Size 1.2MB
SHA256 643c3aa46a916b9ccf6b5bafa7db6f1298c489be75f62a5e2b9d90b3991b1276
MD5 3405a4cf7d06d7d599c973f7c872c13f
SHA1 263546bde733120d49f23e17d1c74c735f4add65
SHA512 f0b943f682a40aa06b9fa2f098cb6a831faf64a9f9c16dc4b1127e0efe8df8cd9163bc0414523e9754223d8f0be77c6d538cdf0c62e00f57ad5b7c89e6ebcf9d
SSDEEP 24576:YIrXckfDzHGCH5oWQDAYxx9SftjUUEgbie:YgckfDzHGCHyWQnJSlwFgbT
TLSH
T1E9459F1BA6BC42F9E0BBC175C646580BEBB2744A1334E59F03E08A566F375209F7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download