684723415b6e56c87b4b7e99df4e6f012e3977599364e04306941ba5f68f76dc

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
Size 8.6MB
Sample260726-2phnrasdmd
SHA256 684723415b6e56c87b4b7e99df4e6f012e3977599364e04306941ba5f68f76dc
MD5 6b0a6548e1c1c574504ad138d89214cc
SHA1 c9e29d55f5c86807ccacd19d867688556d29427a
SHA512 584afeddf1b08685c4ab92cc9e75ac2aadd5a6bc6964cd1dad58de21ec277afc97efb8074151f92fecd7ce3f662914dd69fff5958d738f8de0c725d3e5745ea0
SSDEEP 49152:EvnPh++ioosvZdi++CpYAbkP6r4oEw3+JIHqfoXZhZybXUDlQ+pwOgx9sk/IRUnR:adzHMwQb4fNm3AaI8qGviRHQThB5
TLSH
T113968C06A3E400A9E467D678CA268333DAB17C926734C68F0195F6561F73EA18F7F325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
9	raw.githubusercontent.com
1	raw.githubusercontent.com
3	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
6	raw.githubusercontent.com

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com
1	ipinfo.io
12	api.ipify.org
13	api.ipify.org
17	api.ipify.org
18	ipinfo.io
1	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4176	powershell.exe
3364	netsh.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
4100	WMIC.exe
4100	WMIC.exe
4100	WMIC.exe
4100	WMIC.exe
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
4176	powershell.exe
4176	powershell.exe
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
Token: SeIncreaseQuotaPrivilege	4100	WMIC.exe
Token: SeSecurityPrivilege	4100	WMIC.exe
Token: SeTakeOwnershipPrivilege	4100	WMIC.exe
Token: SeLoadDriverPrivilege	4100	WMIC.exe
Token: SeSystemProfilePrivilege	4100	WMIC.exe
Token: SeSystemtimePrivilege	4100	WMIC.exe
Token: SeProfSingleProcessPrivilege	4100	WMIC.exe
Token: SeIncBasePriorityPrivilege	4100	WMIC.exe
Token: SeCreatePagefilePrivilege	4100	WMIC.exe
Token: SeBackupPrivilege	4100	WMIC.exe
Token: SeRestorePrivilege	4100	WMIC.exe
Token: SeShutdownPrivilege	4100	WMIC.exe
Token: SeDebugPrivilege	4100	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4100	WMIC.exe
Token: SeRemoteShutdownPrivilege	4100	WMIC.exe
Token: SeUndockPrivilege	4100	WMIC.exe
Token: SeManageVolumePrivilege	4100	WMIC.exe
Token: 33	4100	WMIC.exe
Token: 34	4100	WMIC.exe
Token: 35	4100	WMIC.exe
Token: 36	4100	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4100	WMIC.exe
Token: SeSecurityPrivilege	4100	WMIC.exe
Token: SeTakeOwnershipPrivilege	4100	WMIC.exe
Token: SeLoadDriverPrivilege	4100	WMIC.exe
Token: SeSystemProfilePrivilege	4100	WMIC.exe
Token: SeSystemtimePrivilege	4100	WMIC.exe
Token: SeProfSingleProcessPrivilege	4100	WMIC.exe
Token: SeIncBasePriorityPrivilege	4100	WMIC.exe
Token: SeCreatePagefilePrivilege	4100	WMIC.exe
Token: SeBackupPrivilege	4100	WMIC.exe
Token: SeRestorePrivilege	4100	WMIC.exe
Token: SeShutdownPrivilege	4100	WMIC.exe
Token: SeDebugPrivilege	4100	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4100	WMIC.exe
Token: SeRemoteShutdownPrivilege	4100	WMIC.exe
Token: SeUndockPrivilege	4100	WMIC.exe
Token: SeManageVolumePrivilege	4100	WMIC.exe
Token: 33	4100	WMIC.exe
Token: 34	4100	WMIC.exe
Token: 35	4100	WMIC.exe
Token: 36	4100	WMIC.exe
Token: SeDebugPrivilege	4176	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4100	4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe	89
PID 4260 wrote to memory of 4176	4260	2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe	92
PID 4176 wrote to memory of 3364	4176	powershell.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-26_6b0a6548e1c1c574504ad138d89214cc_icedid_luca-stealer_vidar.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" path softwarelicensingservice get OA3xOriginalProductKey
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" netsh wlan show profiles
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Environment Variables.txt

Path C:\Users\Admin\AppData\Local\Temp\FurLog_Admin\System\Others & Dev\Environment Variables.txt
Size 2KB
SHA256 91e143f45ed9f0d4d78d3e665360da10350cdef966dcd7c899deb9dd6d4bc1ae
MD5 341546b4a063f873a9068e0355346f6f
SHA1 483747e592d499c0b0263c126724cba2fdc9200b
SHA512 bae10b4e21458fd373c2b85e22a70f5a26cafae072abaad24c603bb2e71169b0b7dfb9e768896707ebb448f84db5be2700432db35ec584aa5ffaae219dacefbe
TLSH
T14A417A82DDF1C2A0B8A318563B56AD25C3F8EE87770421A473C4650AEB51A2DFC743B9
MD5 SHA1 SHA512 TLSH

Submit Download

twaeupjt.qnw.dll

Path C:\Users\Admin\AppData\Local\Temp\twaeupjt.qnw.dll
Size 1.7MB
SHA256 4dcbb2ad197d893355efa004257e048f2c850feb1078158f4baab0f7b53ac45f
MD5 112b1b7788e602229ee3ccff14f9936e
SHA1 8c672384c19f3c226e59d5da2a1073afc0b85a7a
SHA512 520ff432de7ac7cfa9d36c69bcc4b59f588fdd33b53312cb2cfdc2ae3fc7fcef737d1af8c0b0f8cc85235616aa2223611211d4fdea2eafb61fc543baa7bb4c3f
SSDEEP 24576:D0QT9LAXxkXe4hCk8tmg82mhJhHE6+YPk1Ic1J+6K/H+gmnBaTpmIzgz7QThB5wY:DF9LAKCk8tTEHE3YcviCaTpmvHQThB5
TLSH
T1B6857D4BB2B900ACD8A782B8C517570BD7F274151764ABDB15908AA52F23FF61F7A330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4176-13-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/4176-10-0x000001D499970000-0x000001D499992000-memory.dmp

Download

memory/4176-11-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/4176-12-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/4176-7-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/4176-14-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/4176-15-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/4176-16-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/4176-17-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/4176-19-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/4176-6-0x00007FFEB9E9F000-0x00007FFEB9EA0000-memory.dmp

Download