d03324b32ccc786f9dbb2c7fbcff8219fcef0e60b655aac5b80bcfca7ca90d88

General

Target
2026-08-18_207de7e9dc0c9e9b3c847e1408064a57_icedid_luca-stealer_njrat.exe
Size 65.4MB
Sample260818-1bpdpsbe85
SHA256 d03324b32ccc786f9dbb2c7fbcff8219fcef0e60b655aac5b80bcfca7ca90d88
MD5 207de7e9dc0c9e9b3c847e1408064a57
SHA1 130baef2f7e69f9e23414fe44d322745df881aaf
SHA512 470d40cfab267bcfb4e213d5c5cb2f6741e2d0f111abe5f7043ab3c9f958a23131978244b168c7a4198d0be7d70044b83aedac060e7dc3069799aa29a0be1854
SSDEEP 786432:WFEgqKkvwC3G2+PcIhcQ2pimDiX6q0+l40cQR5MMMgnw+DaqfkQ:WsKkvRW2M1hL2Ymf+lNcQYFgwz3Q
TLSH
T104E78689D7453E826025F5DAE01F224B4D8CFA884F5B01C2EBB64EA71D1E074D3DBB66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1504	~pt_payload.exe
1120	chromelevator.exe
5772	chromelevator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5932	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	~pt_payload.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	~pt_payload.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5576 wrote to memory of 1504	5576	2026-08-18_207de7e9dc0c9e9b3c847e1408064a57_icedid_luca-stealer_njrat.exe	90
PID 1504 wrote to memory of 1120	1504	~pt_payload.exe	91
PID 1120 wrote to memory of 3248	1120	chromelevator.exe	93
PID 1120 wrote to memory of 3248	1120	chromelevator.exe	93
PID 1504 wrote to memory of 5772	1504	~pt_payload.exe	96
PID 5772 wrote to memory of 5792	5772	chromelevator.exe	98
PID 5772 wrote to memory of 5792	5772	chromelevator.exe	98
PID 1504 wrote to memory of 5932	1504	~pt_payload.exe	99
PID 5932 wrote to memory of 3392	5932	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-18_207de7e9dc0c9e9b3c847e1408064a57_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_207de7e9dc0c9e9b3c847e1408064a57_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5576
- C:\Users\Admin\AppData\Local\Temp\~pt_payload.exe
  "C:\Users\Admin\AppData\Local\Temp\~pt_payload.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" chrome
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3248
- - C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" edge
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5792
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c reg export "HKCU\Software\Ankama\Dofus" "C:\Users\Admin\AppData\Local\Temp\B7aafd-f9cdedDD\dofus_ankama_data\dofus_shield.reg" /y
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5932
  - - C:\Windows\system32\reg.exe
      reg export "HKCU\Software\Ankama\Dofus" "C:\Users\Admin\AppData\Local\Temp\B7aafd-f9cdedDD\dofus_ankama_data\dofus_shield.reg" /y
      4⤵
      PID:3392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3964

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
Size 1.4MB
SHA256 3ede96af87cdcd799f87e9f3def0b42ce4c5e37b9aa488f45d5c357dc2dd147a
MD5 2d0811cf7c53709960970ad2145de0da
SHA1 d62cea234c5f4a5d2e91eb39af22ed7cf614fc5f
SHA512 711d332cfcee351b8a56a5e3de502080d788684e0d7a7c849a95a8ca4ceff330901b1c5aabdab9685e2885d7fbb0149e0a401176baea29ac207dba5f06bd6d64
SSDEEP 24576:wr8XOrkshL+EMsrN5x1/CPznl2RDMkJt4MjYIBrf6hr3qFt:wrPphLEs7x1/CzlMb4eFyhz4
TLSH
T1CE650216A6A501F9E2B7D678C9525906DA33FC124F61B7DF03984A9A1F337E08E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bane_debug.log

Path C:\Users\Admin\AppData\Local\Temp\bane_debug.log
Size 2KB
SHA256 f81597d700a6cd0e66e06dacb9dd43cbd5d1c750b96880db45a5299ea1f0bd18
MD5 d7c6fb961723c6c0b353c83c01d48419
SHA1 b30be2bbda243daed2b7556061f6ac158711d67d
SHA512 db44a80c3fb1de245f2ed6f8a5958ef7f024c7dd5834509902eb44ee2a1174bc12eaba7655411d860df8ad60f224bf4b46cf01dfc55d46381c04016c17c9f88d
TLSH
T1C151C0E23EEBC13F2ECA488F816E5FDA61D0342BD7952E62273A56047DD0909F857711
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5576-0-0x00007FFD04CE0000-0x00007FFD04F43000-memory.dmp

Download

Analysis

Sharing