d03324b32ccc786f9dbb2c7fbcff8219fcef0e60b655aac5b80bcfca7ca90d88

General

Target
2026-08-18_207de7e9dc0c9e9b3c847e1408064a57_icedid_luca-stealer_njrat.exe
Size 65.4MB
Sample260818-1bpdpsbe85
SHA256 d03324b32ccc786f9dbb2c7fbcff8219fcef0e60b655aac5b80bcfca7ca90d88
MD5 207de7e9dc0c9e9b3c847e1408064a57
SHA1 130baef2f7e69f9e23414fe44d322745df881aaf
SHA512 470d40cfab267bcfb4e213d5c5cb2f6741e2d0f111abe5f7043ab3c9f958a23131978244b168c7a4198d0be7d70044b83aedac060e7dc3069799aa29a0be1854
SSDEEP 786432:WFEgqKkvwC3G2+PcIhcQ2pimDiX6q0+l40cQR5MMMgnw+DaqfkQ:WsKkvRW2M1hL2Ymf+lNcQYFgwz3Q
TLSH
T104E78689D7453E826025F5DAE01F224B4D8CFA884F5B01C2EBB64EA71D1E074D3DBB66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	2026-08-18_207de7e9dc0c9e9b3c847e1408064a57_icedid_luca-stealer_njrat.exe

Executes dropped EXE 3 IoCs

pid	Process
1884	~pt_payload.exe
4244	chromelevator.exe
4400	chromelevator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1512	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	~pt_payload.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	~pt_payload.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2026-08-18_207de7e9dc0c9e9b3c847e1408064a57_icedid_luca-stealer_njrat.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 1884	2652	2026-08-18_207de7e9dc0c9e9b3c847e1408064a57_icedid_luca-stealer_njrat.exe	86
PID 1884 wrote to memory of 4244	1884	~pt_payload.exe	87
PID 4244 wrote to memory of 4720	4244	chromelevator.exe	89
PID 4244 wrote to memory of 4720	4244	chromelevator.exe	89
PID 1884 wrote to memory of 4400	1884	~pt_payload.exe	92
PID 4400 wrote to memory of 4500	4400	chromelevator.exe	94
PID 4400 wrote to memory of 4500	4400	chromelevator.exe	94
PID 1884 wrote to memory of 1512	1884	~pt_payload.exe	95
PID 1512 wrote to memory of 2920	1512	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-18_207de7e9dc0c9e9b3c847e1408064a57_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_207de7e9dc0c9e9b3c847e1408064a57_icedid_luca-stealer_njrat.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\~pt_payload.exe
  "C:\Users\Admin\AppData\Local\Temp\~pt_payload.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" chrome
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4720
- - C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" edge
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4500
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c reg export "HKCU\Software\Ankama\Dofus" "C:\Users\Admin\AppData\Local\Temp\Bbd318-c5dfcfDD\dofus_ankama_data\dofus_shield.reg" /y
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Windows\system32\reg.exe
      reg export "HKCU\Software\Ankama\Dofus" "C:\Users\Admin\AppData\Local\Temp\Bbd318-c5dfcfDD\dofus_ankama_data\dofus_shield.reg" /y
      4⤵
      PID:2920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge\Chrome\Default\cookies.json
Size 338B
SHA256 b0e7fc86fe02892359d4a7c7f4677454139dce1135b676478cb41e6f6cbac04e
MD5 51ee0aefbb44eeffc487e0534b6d1fc3
SHA1 cb6725402000f0c67e4d0b6e295e9c84bd036b44
SHA512 cb6c05b6f1b643988efceb304c9e483540aa4593186f326b9813d38108bb3f6d361224e7bced538e7239372625ad7d0f41a98c8b8865e9931e60c2421816fb82
TLSH
T123E02DE77EC00821CC164A346C807B1EBC312229907EDE872FEA01C8BC1078D22026CF
MD5 SHA1 SHA512 TLSH

Submit Download

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
Size 1.4MB
SHA256 3ede96af87cdcd799f87e9f3def0b42ce4c5e37b9aa488f45d5c357dc2dd147a
MD5 2d0811cf7c53709960970ad2145de0da
SHA1 d62cea234c5f4a5d2e91eb39af22ed7cf614fc5f
SHA512 711d332cfcee351b8a56a5e3de502080d788684e0d7a7c849a95a8ca4ceff330901b1c5aabdab9685e2885d7fbb0149e0a401176baea29ac207dba5f06bd6d64
SSDEEP 24576:wr8XOrkshL+EMsrN5x1/CPznl2RDMkJt4MjYIBrf6hr3qFt:wrPphLEs7x1/CzlMb4eFyhz4
TLSH
T1CE650216A6A501F9E2B7D678C9525906DA33FC124F61B7DF03984A9A1F337E08E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bane_debug.log

Path C:\Users\Admin\AppData\Local\Temp\bane_debug.log
Size 1KB
SHA256 b014dcb980d3e8de8dbde3c63048f57fb5e068b2274a0c8010544468688ff303
MD5 1fa89565c13414801ad4a58e72c5d411
SHA1 44670da95883578dfbae5be28d0818195252fd74
SHA512 593a8bed1a3ba63504f70c5f82eec20584412fc5f2d6fbf5d6836f8da41b41a8a60bd597f0a88e644193850bb178cdd52e0cc6ba932bbc2b8e2384520080a9e3
TLSH
T17731AE913DEFD13F2DD6548B8A7E6F5D50913817D78A2E22632D45846D88C0EBCA3315
MD5 SHA1 SHA512 TLSH

Submit Download

bane_debug.log

Path C:\Users\Admin\AppData\Local\Temp\bane_debug.log
Size 2KB
SHA256 914f1f7a84cc9a0131ec16c376c395df9d215c25b3e245d9d50516c2cb6eec95
MD5 df20c72f2c6ff99443da67850876f82a
SHA1 4e510f667282b71b57382e9fafd13c7bafffb0c8
SHA512 1765d1237e147de0cc452a2d4ce189b63c9bd05f6ba141a67c528e524845d373d2591dea91efb0d1a88a841b0fcda004ed222cf10d0b904a26af0099154d33e8
TLSH
T114517DD13DEFC13F2DC7548F897E6F9960903426D78A2E75672945847984C19BDA3301
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2652-0-0x00007FF804AB0000-0x00007FF804CA5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads