Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/07/2026, 22:45
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
- Size 8.6MB
- Sample260726-2phnrasdmd
- SHA256 684723415b6e56c87b4b7e99df4e6f012e3977599364e04306941ba5f68f76dc
- MD5 6b0a6548e1c1c574504ad138d89214cc
- SHA1 c9e29d55f5c86807ccacd19d867688556d29427a
- SHA512 584afeddf1b08685c4ab92cc9e75ac2aadd5a6bc6964cd1dad58de21ec277afc97efb8074151f92fecd7ce3f662914dd69fff5958d738f8de0c725d3e5745ea0
- SSDEEP 49152:EvnPh++ioosvZdi++CpYAbkP6r4oEw3+JIHqfoXZhZybXUDlQ+pwOgx9sk/IRUnR:adzHMwQb4fNm3AaI8qGviRHQThB5
- TLSH T113968C06A3E400A9E467D678CA268333DAB17C926734C68F0195F6561F73EA18F7F325
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 5 raw.githubusercontent.com 6 raw.githubusercontent.com 8 raw.githubusercontent.com 3 raw.githubusercontent.com - Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 api.ipify.org 14 api.ipify.org 21 api.ipify.org 22 ipinfo.io 23 ipinfo.io - Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 4312 netsh.exe 4772 powershell.exe - Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 4772 powershell.exe 4772 powershell.exe 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe Token: SeIncreaseQuotaPrivilege 2972 WMIC.exe Token: SeSecurityPrivilege 2972 WMIC.exe Token: SeTakeOwnershipPrivilege 2972 WMIC.exe Token: SeLoadDriverPrivilege 2972 WMIC.exe Token: SeSystemProfilePrivilege 2972 WMIC.exe Token: SeSystemtimePrivilege 2972 WMIC.exe Token: SeProfSingleProcessPrivilege 2972 WMIC.exe Token: SeIncBasePriorityPrivilege 2972 WMIC.exe Token: SeCreatePagefilePrivilege 2972 WMIC.exe Token: SeBackupPrivilege 2972 WMIC.exe Token: SeRestorePrivilege 2972 WMIC.exe Token: SeShutdownPrivilege 2972 WMIC.exe Token: SeDebugPrivilege 2972 WMIC.exe Token: SeSystemEnvironmentPrivilege 2972 WMIC.exe Token: SeRemoteShutdownPrivilege 2972 WMIC.exe Token: SeUndockPrivilege 2972 WMIC.exe Token: SeManageVolumePrivilege 2972 WMIC.exe Token: 33 2972 WMIC.exe Token: 34 2972 WMIC.exe Token: 35 2972 WMIC.exe Token: 36 2972 WMIC.exe Token: SeIncreaseQuotaPrivilege 2972 WMIC.exe Token: SeSecurityPrivilege 2972 WMIC.exe Token: SeTakeOwnershipPrivilege 2972 WMIC.exe Token: SeLoadDriverPrivilege 2972 WMIC.exe Token: SeSystemProfilePrivilege 2972 WMIC.exe Token: SeSystemtimePrivilege 2972 WMIC.exe Token: SeProfSingleProcessPrivilege 2972 WMIC.exe Token: SeIncBasePriorityPrivilege 2972 WMIC.exe Token: SeCreatePagefilePrivilege 2972 WMIC.exe Token: SeBackupPrivilege 2972 WMIC.exe Token: SeRestorePrivilege 2972 WMIC.exe Token: SeShutdownPrivilege 2972 WMIC.exe Token: SeDebugPrivilege 2972 WMIC.exe Token: SeSystemEnvironmentPrivilege 2972 WMIC.exe Token: SeRemoteShutdownPrivilege 2972 WMIC.exe Token: SeUndockPrivilege 2972 WMIC.exe Token: SeManageVolumePrivilege 2972 WMIC.exe Token: 33 2972 WMIC.exe Token: 34 2972 WMIC.exe Token: 35 2972 WMIC.exe Token: 36 2972 WMIC.exe Token: SeDebugPrivilege 4772 powershell.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2972 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 85 PID 1968 wrote to memory of 4772 1968 2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe 88 PID 4772 wrote to memory of 4312 4772 powershell.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" path softwarelicensingservice get OA3xOriginalProductKey2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" netsh wlan show profiles2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4312
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\FurLog_Admin\System\Others & Dev\Environment Variables.txt
- Size 2KB
- SHA256 d2faee60cc67bfeb13306b177fc489e6188fccea5c22ae4fc28e398f87943454
- MD5 d3dfcca356873e9074275c095f97f96a
- SHA1 80cac1e733ba1edaeb314573e526943309882599
- SHA512 c5c5bac2f17273fa117a55a7fc153887c84183222ddaa619600105e05cd47237f9cdcf7ccb27dd0add9e5c2a213cd4237ef1392316fb1b7663d7a339e63adad9
- TLSH T1E6415A52DDF1C2A0B8A318563B56AD25C3F8EE4B770461A433C46506EB51A2DFC743F9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vnwa50gx.433.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\gn0p0m0b.bb1.dll
- Size 1.7MB
- SHA256 4dcbb2ad197d893355efa004257e048f2c850feb1078158f4baab0f7b53ac45f
- MD5 112b1b7788e602229ee3ccff14f9936e
- SHA1 8c672384c19f3c226e59d5da2a1073afc0b85a7a
- SHA512 520ff432de7ac7cfa9d36c69bcc4b59f588fdd33b53312cb2cfdc2ae3fc7fcef737d1af8c0b0f8cc85235616aa2223611211d4fdea2eafb61fc543baa7bb4c3f
- SSDEEP 24576:D0QT9LAXxkXe4hCk8tmg82mhJhHE6+YPk1Ic1J+6K/H+gmnBaTpmIzgz7QThB5wY:DF9LAKCk8tTEHE3YcviCaTpmvHQThB5
- TLSH T1B6857D4BB2B900ACD8A782B8C517570BD7F274151764ABDB15908AA52F23FF61F7A330
- MD5 SHA1 SHA512 SSDEEP TLSH