953cf105e135a17c8dd0bd695d448ea02757027bd6f38efeda91de4488df8912

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 00:10

Target
2026-08-11_22972055a640a554f2a7692296daa3bb_icedid_luca-stealer_njrat_stealc.exe
Size 1.2MB
Sample260812-af98vsfl71
SHA256 953cf105e135a17c8dd0bd695d448ea02757027bd6f38efeda91de4488df8912
MD5 22972055a640a554f2a7692296daa3bb
SHA1 446a1e34397aab9a0d0769d173ac41c3066dbacb
SHA512 acbfc964522091efa8ac82390b8a5c9ff9e7b06c7c73d0824b7c4786bc78e8a1043fac603944a5980bcdd36aa8501664717cb102c17ff0133bf956b90b1c7486
SSDEEP 24576:NIrXckfDzHGCH5oWQDAYxx9SftjUUEgbui:NgckfDzHGCHyWQnJSlwFgbj
TLSH
T14C459F1BA6BC42F9E0BBC179C646580BEBB2744A1334E59F03E08A565F375209F7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
4368	{1A10D426-E22C-41C9-BFAC-7580D5BB8657}.hhdsetup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4368	{1A10D426-E22C-41C9-BFAC-7580D5BB8657}.hhdsetup.exe
4368	{1A10D426-E22C-41C9-BFAC-7580D5BB8657}.hhdsetup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4368	{1A10D426-E22C-41C9-BFAC-7580D5BB8657}.hhdsetup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 4368	1612	2026-08-11_22972055a640a554f2a7692296daa3bb_icedid_luca-stealer_njrat_stealc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-11_22972055a640a554f2a7692296daa3bb_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_22972055a640a554f2a7692296daa3bb_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\{1A10D426-E22C-41C9-BFAC-7580D5BB8657}.hhdsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\{1A10D426-E22C-41C9-BFAC-7580D5BB8657}.hhdsetup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4368

{1A10D426-E22C-41C9-BFAC-7580D5BB8657}.hhdsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\{1A10D426-E22C-41C9-BFAC-7580D5BB8657}.hhdsetup.exe
Size 1.2MB
SHA256 953cf105e135a17c8dd0bd695d448ea02757027bd6f38efeda91de4488df8912
MD5 22972055a640a554f2a7692296daa3bb
SHA1 446a1e34397aab9a0d0769d173ac41c3066dbacb
SHA512 acbfc964522091efa8ac82390b8a5c9ff9e7b06c7c73d0824b7c4786bc78e8a1043fac603944a5980bcdd36aa8501664717cb102c17ff0133bf956b90b1c7486
SSDEEP 24576:NIrXckfDzHGCH5oWQDAYxx9SftjUUEgbui:NgckfDzHGCHyWQnJSlwFgbj
TLSH
T14C459F1BA6BC42F9E0BBC179C646580BEBB2744A1334E59F03E08A565F375209F7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download