Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 17:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_f5943ffadcb5613b83619fe1baa32f21_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_f5943ffadcb5613b83619fe1baa32f21_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-08-04_f5943ffadcb5613b83619fe1baa32f21_icedid_luca-stealer_njrat.exe
- Size 1.7MB
- Sample260804-v2zdpsec93
- SHA256 50b6186a7bf18a27505e72f1b269090414f3972e7f87f03943118d6267dcd7f0
- MD5 f5943ffadcb5613b83619fe1baa32f21
- SHA1 4fd312c80c166561a93a2ec6ac0abbbace60cc9f
- SHA512 bebdd339def5b5ffdbd4484b34062781182d244b634fdaec9994d73ac056d952f966d99aa0f2249fff119c57392b118549824fc2be32e88c242e96d740be8597
- SSDEEP 24576:gfAyMCl1Ua612dFR76+X+t3Tatr0zAiX90z/F0jsFB3SQki:goyzka6kR725aB0zj0yjoB2
- TLSH T16985F12676E502F5D477D1388A864663F6B1B8211760EFDF06A88B561F336E20B3EF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-08-04_f5943ffadcb5613b83619fe1baa32f21_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-04_f5943ffadcb5613b83619fe1baa32f21_icedid_luca-stealer_njrat.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5320 2026-08-04_f5943ffadcb5613b83619fe1baa32f21_icedid_luca-stealer_njrat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_f5943ffadcb5613b83619fe1baa32f21_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f5943ffadcb5613b83619fe1baa32f21_icedid_luca-stealer_njrat.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:5320