f515e9e0e84c39b5e8ef4b831c597af693cbaaa8f2f10a4f4ddda71908d6c97d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/07/2026, 21:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-26_a21cbd516d8aabcb1aef17afa2bcb15e_icedid_luca-stealer_njrat.exe
Size 1.4MB
Sample260726-1ngvdssamd
SHA256 f515e9e0e84c39b5e8ef4b831c597af693cbaaa8f2f10a4f4ddda71908d6c97d
MD5 a21cbd516d8aabcb1aef17afa2bcb15e
SHA1 9201e4f4c69222580508d6d41898ff942eb61d8f
SHA512 68ef8a549a35dd0df54a5b33cad5cabad3b7faaf8f7c9847bc79a0e8293c5e00d7929ea6cdb973fe7c3bbbba77232d01a0f66f486844e845887f5d01484fa421
SSDEEP 24576:RxwSRH7cHhpCRy9dcnc81rePXEdFrbJL+pSNF7SULRWbXu24Eyi/jWmr:RMpCRy9dcZ1reIbJapBULEdrhj
TLSH
T1E7659E4FA76800F9D0B7C6B5CE465507D7B2B8060231A79F17E18BE62F276615E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-07-26_a21cbd516d8aabcb1aef17afa2bcb15e_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	2026-07-26_a21cbd516d8aabcb1aef17afa2bcb15e_icedid_luca-stealer_njrat.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-07-26_a21cbd516d8aabcb1aef17afa2bcb15e_icedid_luca-stealer_njrat.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2648	2026-07-26_a21cbd516d8aabcb1aef17afa2bcb15e_icedid_luca-stealer_njrat.exe
2648	2026-07-26_a21cbd516d8aabcb1aef17afa2bcb15e_icedid_luca-stealer_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-26_a21cbd516d8aabcb1aef17afa2bcb15e_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-26_a21cbd516d8aabcb1aef17afa2bcb15e_icedid_luca-stealer_njrat.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads