1ae079d029ec642943d3044889ff63a6cfa02588576ed5cb551f9e6ae99db363

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 03:22

Target
2026-08-03_16f4530340c7b7247b73996b681cf666_icedid_luca-stealer_njrat_stealc.exe
Size 1.7MB
Sample260804-dw6r6acc36
SHA256 1ae079d029ec642943d3044889ff63a6cfa02588576ed5cb551f9e6ae99db363
MD5 16f4530340c7b7247b73996b681cf666
SHA1 0e4d4905f8bab5e42abf6c73a56ef277812fe1d4
SHA512 57d4c55cfefb9ebe23aaed42baa60fb41254b88f99bd6a96a0d6e11f5fd1756366354856e5583bf6626539393942490db65ff5ea2c56366f22f182ef93a9bcd3
SSDEEP 24576:VjmzfRZRUft29XK7mIYubTmXwjEA90RbpshLWTBeAN9fTn0eIXtXFF:V0+WETmcExphn0ptV
TLSH
T186858E17A6A801FCD1A7C178CA56560BEB7274060770DBDF16D08AA66F23EE11F7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x001000000001c323-1.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Executes dropped EXE 1 IoCs

pid	Process
4568	dosvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 4568	4208	2026-08-03_16f4530340c7b7247b73996b681cf666_icedid_luca-stealer_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_16f4530340c7b7247b73996b681cf666_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_16f4530340c7b7247b73996b681cf666_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DoSvcs\2e697c29\dosvc.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DoSvcs\2e697c29\dosvc.exe"
  2⤵
  - Executes dropped EXE
  PID:4568

dosvc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DoSvcs\2e697c29\dosvc.exe
Size 1.7MB
SHA256 1ae079d029ec642943d3044889ff63a6cfa02588576ed5cb551f9e6ae99db363
MD5 16f4530340c7b7247b73996b681cf666
SHA1 0e4d4905f8bab5e42abf6c73a56ef277812fe1d4
SHA512 57d4c55cfefb9ebe23aaed42baa60fb41254b88f99bd6a96a0d6e11f5fd1756366354856e5583bf6626539393942490db65ff5ea2c56366f22f182ef93a9bcd3
SSDEEP 24576:VjmzfRZRUft29XK7mIYubTmXwjEA90RbpshLWTBeAN9fTn0eIXtXFF:V0+WETmcExphn0ptV
TLSH
T186858E17A6A801FCD1A7C178CA56560BEB7274060770DBDF16D08AA66F23EE11F7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download