c3f42abe86cef939c3cfb348c50fe5cd07d93a9836be664fab1c134178ceb514

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:24

Target
2026-08-02_2aa989c90de36e5f039766be3f30381b_icedid_luca-stealer_njrat_stealc.exe
Size 2.1MB
Sample260802-dyc8matbrh
SHA256 c3f42abe86cef939c3cfb348c50fe5cd07d93a9836be664fab1c134178ceb514
MD5 2aa989c90de36e5f039766be3f30381b
SHA1 368d051115f5dc254e5d86675e85ff48dc3c1282
SHA512 2ee3e4427ae81513c5cd1f6fb1b5d52d1725c71e5ac006d1d4498558caa6d4f58f815fbb8b83c2c213a5d87910e9510b045b6dd93f88ab7e0889b69ca30ba3bd
SSDEEP 49152:nFH8ToFM9VsDbknFicgFevyVbX6Vx71tRn5nYNcOOX:FH+oFo+DeN10X4R1tR5nYSF
TLSH
T154A52359B7F150FDF036D23849718BD4E362BB1A4B208B9F437546812E22ADB5CBDB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process
PID 1032 set thread context of 0	1032	2026-08-02_2aa989c90de36e5f039766be3f30381b_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 3212	1032	2026-08-02_2aa989c90de36e5f039766be3f30381b_icedid_luca-stealer_njrat_stealc.exe	89
PID 1032 wrote to memory of 3212	1032	2026-08-02_2aa989c90de36e5f039766be3f30381b_icedid_luca-stealer_njrat_stealc.exe	89
PID 1032 wrote to memory of 3212	1032	2026-08-02_2aa989c90de36e5f039766be3f30381b_icedid_luca-stealer_njrat_stealc.exe	89
PID 1032 wrote to memory of 3212	1032	2026-08-02_2aa989c90de36e5f039766be3f30381b_icedid_luca-stealer_njrat_stealc.exe	89
PID 1032 wrote to memory of 3212	1032	2026-08-02_2aa989c90de36e5f039766be3f30381b_icedid_luca-stealer_njrat_stealc.exe	89
PID 1032 wrote to memory of 3212	1032	2026-08-02_2aa989c90de36e5f039766be3f30381b_icedid_luca-stealer_njrat_stealc.exe	89
PID 1032 wrote to memory of 3212	1032	2026-08-02_2aa989c90de36e5f039766be3f30381b_icedid_luca-stealer_njrat_stealc.exe	89
PID 1032 wrote to memory of 3212	1032	2026-08-02_2aa989c90de36e5f039766be3f30381b_icedid_luca-stealer_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_2aa989c90de36e5f039766be3f30381b_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_2aa989c90de36e5f039766be3f30381b_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3212

memory/1032-3-0x000000FD2EC00000-0x000000FD2ED00000-memory.dmp

Download

memory/1032-5-0x000000FD2EC00000-0x000000FD2ED00000-memory.dmp

Download

memory/1032-8-0x000000FD2EC00000-0x000000FD2ED00000-memory.dmp

Download

memory/1032-12-0x000000FD2EC00000-0x000000FD2ED00000-memory.dmp

Download