Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/08/2026, 03:39
General
- Target 2026-08-14_a0b794685345a738a135ea77ae1701d8_icedid_luca-stealer_njrat_stealc.exe
- Size 3.0MB
- Sample260814-d7p9jsbr71
- SHA256 94796fca278528c0cd3f22af9b84a1da2b562d562f5a8c9be3509371b0e0707b
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Discovers running processes 1 TTPs 10 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_a0b794685345a738a135ea77ae1701d8_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_a0b794685345a738a135ea77ae1701d8_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2332-0-0x00007FF973200000-0x00007FF973463000-memory.dmp
memory/2332-1-0x00007FF94F3AF000-0x00007FF94F3B0000-memory.dmp
memory/2332-2-0x000001F2CDAF0000-0x000001F2CDAF8000-memory.dmp
memory/2332-4-0x000001F2CDAF0000-0x000001F2CDAF2000-memory.dmp
memory/2332-3-0x000001F2CDAF0000-0x000001F2CDAF2000-memory.dmp
memory/2332-5-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp
memory/2332-6-0x000001F2E6CD0000-0x000001F2E6ED6000-memory.dmp
memory/2332-8-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-7-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-15-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp
memory/2332-19-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-17-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-34-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp
memory/2332-36-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-40-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-48-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-44-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-52-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp
memory/2332-51-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp
memory/2332-31-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-27-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-23-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-12-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-53-0x000001F2E70E0000-0x000001F2E72C2000-memory.dmp
memory/2332-57-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-65-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-81-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-104-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp
memory/2332-101-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-105-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp
memory/2332-97-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-93-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-89-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-85-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-125-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-141-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-173-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-169-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-165-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-161-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-157-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-153-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-149-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-145-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-137-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-133-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-129-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-121-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-117-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-113-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-109-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-107-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-77-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-73-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-69-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-61-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-205-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-225-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-245-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-241-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-237-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-233-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-229-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-221-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-217-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-213-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-209-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-201-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-197-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-194-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-189-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-185-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-181-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-177-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-250-0x000001F2E6CD0000-0x000001F2E6ED3000-memory.dmp
memory/2332-1734-0x000001F2E7370000-0x000001F2E7432000-memory.dmp
memory/2332-1967-0x000001F2E72C0000-0x000001F2E72E8000-memory.dmp
memory/2332-1968-0x000001F2E7440000-0x000001F2E744A000-memory.dmp
memory/2332-2033-0x000001F2E72F0000-0x000001F2E72FA000-memory.dmp
memory/2332-2032-0x000001F2E7310000-0x000001F2E732A000-memory.dmp
memory/2332-2031-0x000001F2E7300000-0x000001F2E7308000-memory.dmp
memory/2332-2034-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp
memory/2332-2035-0x000001F2E7330000-0x000001F2E7338000-memory.dmp
memory/2332-2036-0x000001F2CE340000-0x000001F2CE34A000-memory.dmp
memory/2332-2037-0x000001F2E7340000-0x000001F2E7358000-memory.dmp
memory/2332-2098-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp
memory/2332-2123-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp
memory/2332-2124-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp
memory/2332-2126-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp
memory/2332-2250-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp