Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 03:20

General

  • Target
    2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe
  • Size 3.2MB
  • Sample260815-dv6e1ade99
  • SHA256 d529e2c78d01e4b1e69eb9da2500387137dea01941feb9432574b8889181909a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 4 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Drops file in Drivers directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      2⤵
      • Executes a command shell one-liner
      PID:3332

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .dsvc.dat

        • Path C:\Windows\System32\drivers\.dsvc.dat
        • Size 48B
        • SHA256 4760f45715a9fbfa7506d56ffc6e55901d38fa8a09b13cfaa43b18b6f2d78981
        • MD5 SHA1 SHA512