Overview

overview

9

Static

static

3

2026-08-04...at.exe

windows10-2004-x64

9

2026-08-04...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 08:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_266f5e441ebfbf80f258699193c457ce_icedid_luca-stealer_njrat.exe
  • Size 2.1MB
  • Sample260804-jvycaaff92
  • SHA256 b3e68f36e0d75b64359dfd7e8de8cbeeae0378801aee2ecdb2fe1c63a61a253f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 16 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 1 IoCs
    defense_evasion
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_266f5e441ebfbf80f258699193c457ce_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_266f5e441ebfbf80f258699193c457ce_icedid_luca-stealer_njrat.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Looks for VMWare services registry key.
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1456
    • C:\Windows\System32\sihost.exe
      "C:\Windows\System32\sihost.exe"
      2⤵
      • Looks for VirtualBox Guest Additions in registry
      • Looks for VMWare Tools registry key
      • Creates a file in the Startup directory
      • Adds Run key to start application
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4056
      • C:\Windows\System32\schtasks.exe
        schtasks /create /tn "GoogleUpdateTaskMachineCore" /tr "C:\Users\Admin\AppData\Local\Microsoft\Update\chrome_update.exe" /sc ONLOGON /f /rl HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:396
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        3⤵
          PID:4892
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
          3⤵
            PID:5116
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c reg export "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\WinSCP\sessions.reg" /y
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1856
            • C:\Windows\system32\reg.exe
              reg export "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\WinSCP\sessions.reg" /y
              4⤵
                PID:4108
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c cmdkey /list
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2716
              • C:\Windows\system32\cmdkey.exe
                cmdkey /list
                4⤵
                  PID:1296
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c reg export "HKCU\Software\SimonTatham\PuTTY\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\PuTTY\sessions.reg" /y
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:3700
                • C:\Windows\system32\reg.exe
                  reg export "HKCU\Software\SimonTatham\PuTTY\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\PuTTY\sessions.reg" /y
                  4⤵
                    PID:4336
                • C:\Windows\System32\cmd.exe
                  cmd.exe /c ping 127.0.0.1 -n 3 >nul & del /f /q "C:\Windows\System32\sihost.exe"
                  3⤵
                  • Executes a command shell one-liner
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2348
                  • C:\Windows\system32\PING.EXE
                    ping 127.0.0.1 -n 3
                    4⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:3816
            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
              1⤵
                PID:4668
              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                1⤵
                  PID:2760
                • C:\Users\Admin\AppData\Local\Microsoft\Update\chrome_update.exe
                  C:\Users\Admin\AppData\Local\Microsoft\Update\chrome_update.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:3464
                  • C:\Windows\explorer.exe
                    explorer.exe /LOADSAVEDWINDOWS
                    2⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Enumerates connected drives
                    • Checks SCSI registry key(s)
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    PID:3732
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:3536
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:2192

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      1
                      T1059

                      Windows Command Shell

                      1
                      T1059.003

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Persistence

                      Boot or Logon Autostart Execution

                      3
                      T1547

                      Active Setup

                      1
                      T1547.014

                      Registry Run Keys / Startup Folder

                      2
                      T1547.001

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      3
                      T1547

                      Active Setup

                      1
                      T1547.014

                      Registry Run Keys / Startup Folder

                      2
                      T1547.001

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Defense Evasion

                      Modify Registry

                      2
                      T1112

                      Virtualization/Sandbox Evasion

                      4
                      T1497

                      Credential Access

                      Discovery

                      Peripheral Device Discovery

                      2
                      T1120

                      Query Registry

                      7
                      T1012

                      Remote System Discovery

                      1
                      T1018

                      System Information Discovery

                      3
                      T1082

                      System Network Configuration Discovery

                      2
                      T1016

                      Internet Connection Discovery

                      2
                      T1016.001

                      Virtualization/Sandbox Evasion

                      4
                      T1497

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      chrome_update.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Update\chrome_update.exe
                      • Size 109KB
                      • SHA256 8ee21a0ba8849d31c265b4090a9e2ebe8ba66f58a8f71d4e96509e8a78f7db00
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AppCache134303040275795901.txt
                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134303040275795901.txt
                      • Size 80KB
                      • SHA256 46fee82f6290e485066430f8d8cc05328fa01fed349aa447dd8137c4b8077d48
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CortanaUnifiedTileModelCache.dat
                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
                      • Size 18KB
                      • SHA256 22597c569884136a88191249f554b6280ea7e60e97ee313d70f21edbace6fdde
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2298976713.db
                      • Path C:\Users\Admin\AppData\Local\Temp\chromelev_data\.temp\2298976713.db
                      • Size 138KB
                      • SHA256 68ae58343025b358978d24a330415321e25d1828221e5fa707e37ca2b3ef3d33
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      4113007741.db
                      • Path C:\Users\Admin\AppData\Local\Temp\chromelev_data\.temp\4113007741.db
                      • Size 224KB
                      • SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      fingerprint.json
                      • Path C:\Users\Admin\AppData\Local\Temp\chromelev_data\Chrome\fingerprint.json
                      • Size 868B
                      • SHA256 e5e2947b3f32264448abb092964b903749ad8dc57cf463f2e15d2d0d8ffa0efa
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Chrome_Default.txt
                      • Path C:\Users\Admin\AppData\Local\Temp\chromelev_data\Cookies Browser\Chrome_Default.txt
                      • Size 283B
                      • SHA256 e6918ef0ef730f0ce1d3b8cfedc94c3952d60ed80c278562d27591e2b4528ee7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      fingerprint.json
                      • Path C:\Users\Admin\AppData\Local\Temp\chromelev_data\Edge\fingerprint.json
                      • Size 877B
                      • SHA256 1e25056280339185e5f5b21fffd81128925069f1ea677e12a20d9bd50a49ec50
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      spectrenx_debug.log
                      • Path C:\Users\Admin\AppData\Local\Temp\spectrenx_debug.log
                      • Size 629B
                      • SHA256 38d087c39939a619ee164668cbcce05608d440f967dccab9ee3d220f6ece9866
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/1456-0-0x0000026E634D0000-0x0000026E634D1000-memory.dmp
                      Download

                      memory/3536-115-0x00000201EB1D0000-0x00000201EB1F0000-memory.dmp
                      Download

                      memory/3536-93-0x00000201EAE00000-0x00000201EAE20000-memory.dmp
                      Download

                      memory/3536-88-0x00000201EA200000-0x00000201EA300000-memory.dmp
                      Download

                      memory/3536-104-0x00000201EABC0000-0x00000201EABE0000-memory.dmp
                      Download

                      memory/3732-87-0x00000000048D0000-0x00000000048D1000-memory.dmp
                      Download

                      memory/4056-17-0x0000000140000000-0x000000014024A000-memory.dmp
                      Download

                      memory/4056-18-0x0000000140000000-0x000000014024A000-memory.dmp
                      Download

                      memory/4056-12-0x0000000140000000-0x000000014024A000-memory.dmp
                      Download

                      memory/4056-14-0x0000000140000000-0x000000014024A000-memory.dmp
                      Download

                      memory/4056-9-0x0000000140000000-0x000000014024A000-memory.dmp
                      Download

                      memory/4056-11-0x0000000140000000-0x000000014024A000-memory.dmp
                      Download

                      memory/4056-13-0x0000000140000000-0x000000014024A000-memory.dmp
                      Download

                      memory/4056-15-0x0000000140000000-0x000000014024A000-memory.dmp
                      Download

                      memory/4056-16-0x0000000140000000-0x000000014024A000-memory.dmp
                      Download

                      memory/4056-10-0x0000000140000000-0x000000014024A000-memory.dmp
                      Download

                      memory/4056-19-0x0000000140000000-0x000000014024A000-memory.dmp
                      Download

                      memory/4056-21-0x0000000140000000-0x000000014024A000-memory.dmp
                      Download

                      memory/4056-23-0x00007FFDBC6D0000-0x00007FFDBC8C5000-memory.dmp
                      Download

                      memory/4056-22-0x0000000140000000-0x000000014024A000-memory.dmp
                      Download

                      memory/4056-20-0x0000000140000000-0x000000014024A000-memory.dmp
                      Download

                      memory/4056-1-0x0000000140000000-0x000000014024A000-memory.dmp
                      Download

                      memory/4056-275-0x0000000140000000-0x000000014024A000-memory.dmp
                      Download