1d5ae22fa1cdd0a9d2ff0316930eed0929f113938578145134a7a066dd6d34de

General

Target
2026-08-12_2ff4c9eaa23347cfc8d7c0ba93bf8541_icedid_luca-stealer_njrat_stealc.exe
Size 1.8MB
Sample260812-thd3zsyshs
SHA256 1d5ae22fa1cdd0a9d2ff0316930eed0929f113938578145134a7a066dd6d34de
MD5 2ff4c9eaa23347cfc8d7c0ba93bf8541
SHA1 eb2a002c475961558d1db4951feb869a2665e24d
SHA512 4d44f318ee1b08eab42dc84e670f1efec0c763a5791057bdf33cbd46caec6f1b068a4cc2198aa1d1ac91216ff0268696969d20c051090c826e44f7a38e2820bf
SSDEEP 24576:39S0IXLMf76QeGIyshw3iV3YhWJo8UrwY8UffT0JTF1mKn5wjywn6e2+im:t2Xu6BfypiVW8UrfrgbmAwdcm
TLSH
T1FA858F16A3A401F8D0ABC179C9465607EBB2744917B09BDF17D04AAA6F23EF11F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024543-1.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024543-1.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024543-1.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables containing possible sandbox analysis VM names 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024543-1.dat	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024543-1.dat	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024543-1.dat	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024543-1.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Executes dropped EXE 1 IoCs

pid	Process
4984	RuntimeBroker.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CLRRuntime = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\CLR\\RuntimeBroker.exe"	2026-08-12_2ff4c9eaa23347cfc8d7c0ba93bf8541_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CLRRuntime = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\CLR\\RuntimeBroker.exe"	RuntimeBroker.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	api.ipify.org
20	api.ipify.org
33	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1472	2026-08-12_2ff4c9eaa23347cfc8d7c0ba93bf8541_icedid_luca-stealer_njrat_stealc.exe
1472	2026-08-12_2ff4c9eaa23347cfc8d7c0ba93bf8541_icedid_luca-stealer_njrat_stealc.exe
1472	2026-08-12_2ff4c9eaa23347cfc8d7c0ba93bf8541_icedid_luca-stealer_njrat_stealc.exe
1472	2026-08-12_2ff4c9eaa23347cfc8d7c0ba93bf8541_icedid_luca-stealer_njrat_stealc.exe
4984	RuntimeBroker.exe
4984	RuntimeBroker.exe
4984	RuntimeBroker.exe
4984	RuntimeBroker.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-12_2ff4c9eaa23347cfc8d7c0ba93bf8541_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_2ff4c9eaa23347cfc8d7c0ba93bf8541_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1472

C:\Users\Admin\AppData\Local\Microsoft\CLR\RuntimeBroker.exe
C:\Users\Admin\AppData\Local\Microsoft\CLR\RuntimeBroker.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

1

T1217

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Local\Microsoft\CLR\RuntimeBroker.exe
Size 1.8MB
SHA256 1d5ae22fa1cdd0a9d2ff0316930eed0929f113938578145134a7a066dd6d34de
MD5 2ff4c9eaa23347cfc8d7c0ba93bf8541
SHA1 eb2a002c475961558d1db4951feb869a2665e24d
SHA512 4d44f318ee1b08eab42dc84e670f1efec0c763a5791057bdf33cbd46caec6f1b068a4cc2198aa1d1ac91216ff0268696969d20c051090c826e44f7a38e2820bf
SSDEEP 24576:39S0IXLMf76QeGIyshw3iV3YhWJo8UrwY8UffT0JTF1mKn5wjywn6e2+im:t2Xu6BfypiVW8UrfrgbmAwdcm
TLSH
T1FA858F16A3A401F8D0ABC179C9465607EBB2744917B09BDF17D04AAA6F23EF11F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crcookies.txt

Path C:\Users\Admin\AppData\Local\Temp\crcookies.txt
Size 52B
SHA256 44b9a275eaba9747d15ad6d8a5e3e071ecdfdc7ce2f2a3347c538cc22053978a
MD5 9f707459187997fc61e8425306d4add2
SHA1 b26a600950d0fcc99f2afe8085c72595f232b63b
SHA512 fb244a061ba1ed77cdaad39a1a43761f1f274d332ec4d64865ead2611fab9e542c2a6a5feee3105d9c8a2c2f691277190bf2b239edd46a654fbe551a4ac66823
TLSH
T1F690024BF56281531D5DA02114E5416D0D200D1531A6D798661015155244D96E5448DA
MD5 SHA1 SHA512 TLSH

Submit Download

crmlqqvvsp.db

Path C:\Users\Admin\AppData\Local\Temp\crmlqqvvsp.db
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crupigxbcp.db

Path C:\Users\Admin\AppData\Local\Temp\crupigxbcp.db
Size 138KB
SHA256 571d574ad4378fe909fed1f4c7ae210b180e511c727d91aa4b5dfc036c699ae8
MD5 dc4f4d463b1c67707f927b72c0f042ce
SHA1 382b802cf3ae4b520bd3430ff502e8feebd5c446
SHA512 c1ceda188b537c3d68113beb0945878279c0d262d493f90529e846cb939b2dd0c9d9a42436386864fb7e46f580dc709576bc578b069d257f7413bab940e65ed3
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OhpX6QAdqEVumawkh:zeuvBnhJsueMEGvIW1DcP2OvUfVumanh
TLSH
T116D3874B3A743102EDE59A722CE051BB5E3CB17D8F55A5D4287620588EF2863A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads