Analysis
- max time kernel
150s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 03:20
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
General
- Target 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe
- Size 3.2MB
- Sample260815-dv6e1ade99
- SHA256 d529e2c78d01e4b1e69eb9da2500387137dea01941feb9432574b8889181909a
- MD5 bc6f628db1c6df1c0857e5673d6966ad
- SHA1 2fa84ffb5c9ac071b5b11f7d8dfd98360bb73785
- SHA512 1dc6a33587ce2173a08beeca31cf4a81546c2f9c8b18a6ab9f851ff1d2517df9a68a81c03d6b30d3773803ba3818a7c1f7a31a862b43c1228c5ec47f4bef31b0
- SSDEEP 49152:pxBv/zkGo+SBPpjhC1ZZ7Y2qUZ81wr8me1xInN3T9E28Zy:3YqqUdrF1T9nm
- TLSH T118F52A4BE6A641E8C5B6C038E643622FFA327846833497D7A7D01F574B637E0A97E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 4 IoCs
description ioc Process File created C:\Windows\System32\drivers\.dsvc.dat 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\drivers\.dsvc.dat 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe File created C:\Windows\System32\drivers\.dsvc.dat:metadata 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\drivers\.dsvc.dat:metadata 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3332 cmd.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F47AC10B-58CC-4372-A567-0E02B2C3D479}\InstallProperties 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F47AC10B-58CC-4372-A567-0E02B2C3D479} 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F47AC10B-58CC-4372-A567-0E02B2C3D479}\InstallProperties\Token = "957E118549D5580026D9493B7BB83D33BD90853B8530A04EE876EB52954A0D3D5519B8B982897F6CF28C7E8BDEC4D1D0" 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2412 wrote to memory of 3332 2412 2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Drops file in Drivers directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
- Executes a command shell one-liner
PID:3332
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System32\drivers\.dsvc.dat
- Size 48B
- SHA256 4760f45715a9fbfa7506d56ffc6e55901d38fa8a09b13cfaa43b18b6f2d78981
- MD5 2a22bc7265b6ffa7dbb3043c2d6c5c80
- SHA1 732c6aad97d1b67c61e146aef91a967781f55419
- SHA512 6ac73d6358dad4ea2f7e0e27f0985eb05c74f815dc2e7769b8e5266b92016565cfb7a2b026cb40b0a7bce42a3b17ad27021ca33366a0c10b06bb76872f9dbd1e
- MD5 SHA1 SHA512