Overview

overview

7

Static

static

3

2026-08-03...lc.exe

windows10-2004-x64

7

2026-08-03...lc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 02:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_4c16446d42ee30bc3532420c442d1836_icedid_stealc.exe
  • Size 72.9MB
  • Sample260804-dftsnaca35
  • SHA256 7ff7d147e0a83dc74c159f3cd77c6b21beb0061df72503f5983c820e46b488d0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_4c16446d42ee30bc3532420c442d1836_icedid_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_4c16446d42ee30bc3532420c442d1836_icedid_stealc.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5100
    • C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\Update.exe
      "C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\Update.exe" ira-0d4103ce::default
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      PID:1952

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Update.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\Update.exe
        • Size 196KB
        • SHA256 b176befa444ac2b469658acd1724bb4c28bd1f5512da6f38846a99c3509e35e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\bin\java.dll
        • Size 119KB
        • SHA256 97a44d1648fad516c28304ea249b9bf4cf49c3be3b46b9df37b7f734feeac352
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jimage.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\bin\jimage.dll
        • Size 33KB
        • SHA256 f50044af136d67c5127f6dccb5028e8a2bab33286167eb037e05282549b1e8c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        management.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\bin\management.dll
        • Size 29KB
        • SHA256 03d51451386a6c286a76a4dca238f2e7a47c533472ca0a791265bfcafed8331a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        management_ext.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\bin\management_ext.dll
        • Size 35KB
        • SHA256 43bc3a629fc0e383c072ec79a0eb24dfaa3fca32327c81ecae7786a61e343d0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        net.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\bin\net.dll
        • Size 58KB
        • SHA256 5024678aeec581fe91498da4613495b3abcc006359ea135d2e42a4106d3bceea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nio.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\bin\nio.dll
        • Size 78KB
        • SHA256 addafe684203d39c4436aa80fe72d7ceae4d9c197e3579c3b4afd66e2b14bc09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jvm.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\bin\server\jvm.dll
        • Size 13.3MB
        • SHA256 8dc3b8569cef73567252b37fd49627f86e12deaab9a605fa3701c32c237d3d18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\bin\vcruntime140.dll
        • Size 117KB
        • SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\bin\vcruntime140_1.dll
        • Size 48KB
        • SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zip.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\bin\zip.dll
        • Size 87KB
        • SHA256 684484a561eb95244b51b33c64cd3da8c8b631e62c16c19f4ad65fa859860181
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logging.properties
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\conf\logging.properties
        • Size 2KB
        • SHA256 b62d2733ab99556b108a1951d894c5a8d76b1ac7a00c02c388f9eb9be046c56f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        net.properties
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\conf\net.properties
        • Size 7KB
        • SHA256 56dd1f6095c189c1052f6baa32e457efc09de4832e19cdb82bb236dc8abfee9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.security
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\conf\security\java.security
        • Size 68KB
        • SHA256 c60112fdfcd0ad928c40bf7dd2b76b1e8e802185e261c7019393634aa33cd064
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default_US_export.policy
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\conf\security\policy\unlimited\default_US_export.policy
        • Size 146B
        • SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        default_local.policy
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\conf\security\policy\unlimited\default_local.policy
        • Size 193B
        • SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ADDITIONAL_LICENSE_INFO
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\legal\java.net.http\ADDITIONAL_LICENSE_INFO
        • Size 49B
        • SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
        • MD5 SHA1 SHA512
        Submit Download

        ASSEMBLY_EXCEPTION
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\legal\java.net.http\ASSEMBLY_EXCEPTION
        • Size 44B
        • SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
        • MD5 SHA1 SHA512
        Submit Download

        LICENSE
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\legal\java.net.http\LICENSE
        • Size 33B
        • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
        • MD5 SHA1 SHA512
        Submit Download

        modules
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\lib\modules
        • Size 25.8MB
        • SHA256 9b7de13ed5aa3ab23f049e287488186210fac1f8359677beb3efa0b9f9b90c68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cacerts
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\lib\security\cacerts
        • Size 183KB
        • SHA256 c3ca801bfc5d9f9e50c69f55537e78dc83e4e50c1ddea30db81e4b672b5a8aee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tzdb.dat
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\lib\tzdb.dat
        • Size 100KB
        • SHA256 7be2a3adf10ff841579629f7725b15f0db41e8856527ec72847b5477073a3d29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tzmappings
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\lib\tzmappings
        • Size 21KB
        • SHA256 b41575b332809b37ad423bdca30c7c48cdef3d82f82fa9d534781a6f15d6a2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        release
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\jre\release
        • Size 235B
        • SHA256 501b3c966f781a6ff69788fc851fe94cffa19640f7fda51d8ab6ec3bccf761ff
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        runtime.jar
        • Path C:\Users\Admin\AppData\Local\Temp\ewa5100.tmp\app\runtime.jar
        • Size 23.2MB
        • SHA256 5be88186aa03aa2506c99090a08f7f97bf555f9250de5f639ed8d16734ff35cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qvm16090459754208255269.dll
        • Path C:\Users\Admin\AppData\Local\Temp\qvm16090459754208255269.dll
        • Size 163KB
        • SHA256 2424b1c0e0fd85051ed0b210fd58605243f67143794e8bc1767fd2cc1048675b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1952-204-0x000001EF70480000-0x000001EF706F0000-memory.dmp
        Download

        memory/1952-211-0x000001EF77F40000-0x000001EF781B0000-memory.dmp
        Download

        memory/1952-193-0x000001EF779B0000-0x000001EF77C20000-memory.dmp
        Download

        memory/1952-244-0x000001EF779B0000-0x000001EF77C20000-memory.dmp
        Download

        memory/1952-245-0x000001EF70480000-0x000001EF706F0000-memory.dmp
        Download

        memory/1952-246-0x000001EF77F40000-0x000001EF781B0000-memory.dmp
        Download