Analysis
- max time kernel
149s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 04:46
General
- Target 2026-08-04_fc9e6f64622a65434e9bf0d048a619ee_icedid_luca-stealer_njrat.exe
- Size 3.0MB
- Sample260804-fd8vxadb73
- SHA256 c543cb88c866e85cc25193de4a5f27889c4b1deabeeaf2cf1f96baa905b61618
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_fc9e6f64622a65434e9bf0d048a619ee_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_fc9e6f64622a65434e9bf0d048a619ee_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveUpdater.exeC:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveUpdater.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
OneDriveUpdater.exe
memory/4832-12-0x000002BAF7160000-0x000002BAF7190000-memory.dmp
memory/4832-3-0x000002BAF7160000-0x000002BAF7190000-memory.dmp
memory/4832-4-0x000002BAF7160000-0x000002BAF7190000-memory.dmp
memory/4832-0-0x000002BAF7160000-0x000002BAF7190000-memory.dmp
memory/4832-2-0x000002BAF7160000-0x000002BAF7190000-memory.dmp
memory/4832-1-0x000002BAF7160000-0x000002BAF7190000-memory.dmp
memory/4832-7-0x000002BAF7190000-0x000002BAF7191000-memory.dmp
memory/4832-5-0x000002BAF7160000-0x000002BAF7190000-memory.dmp
memory/4832-6-0x000002BAF7160000-0x000002BAF7190000-memory.dmp
memory/4832-13-0x000002BAF7160000-0x000002BAF7190000-memory.dmp
memory/5672-17-0x000001D295C10000-0x000001D295C40000-memory.dmp
memory/5672-21-0x000001D295C10000-0x000001D295C40000-memory.dmp
memory/5672-20-0x000001D295C10000-0x000001D295C40000-memory.dmp
memory/5672-19-0x000001D295C10000-0x000001D295C40000-memory.dmp
memory/5672-16-0x000001D295C10000-0x000001D295C40000-memory.dmp
memory/5672-15-0x000001D295C10000-0x000001D295C40000-memory.dmp
memory/5672-18-0x000001D295C10000-0x000001D295C40000-memory.dmp
memory/5672-23-0x000001D295C10000-0x000001D295C40000-memory.dmp
memory/5672-24-0x000001D295C10000-0x000001D295C40000-memory.dmp