005a4154750bc54d3d204f3f8e912a12f117eb692b5d67c0c6f4b79b05080f0f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 03:19

Target
2026-08-17_616bb6b96ce60f85556677651500ad52_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 4.8MB
Sample260818-dvbkmavfjf
SHA256 005a4154750bc54d3d204f3f8e912a12f117eb692b5d67c0c6f4b79b05080f0f
MD5 616bb6b96ce60f85556677651500ad52
SHA1 6b40125b5f7b36c0c2d1f5befa7594101e5e3c37
SHA512 c53ced59bd9fbd3cd2aa3d6100c26e4ed88fd71dbac74134aa9d22b118e950acf708e96272aff9ad0185264b366d5751289b077071821b33398cff2b8a457b99
SSDEEP 49152:VQEP1yqBDFntk0KbDYvOUTDSXM7/lAmewtCTUyTT5rfXzzfs0:XyGeAS8rSmuTUyTTlfM0
TLSH
T16736F147B2A405FCC47B92399646A61BFB36785913209BCF13E085662F933E09FBE711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
756	ET.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
756	ET.exe
756	ET.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
756	ET.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 756	3480	2026-08-17_616bb6b96ce60f85556677651500ad52_icedid_luca-stealer_njrat_stealc_vidar.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-17_616bb6b96ce60f85556677651500ad52_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_616bb6b96ce60f85556677651500ad52_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\ET.exe
  ET.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:756

ET.exe

Path C:\Users\Admin\AppData\Local\Temp\ET.exe
Size 4.8MB
SHA256 d4a588f002461b563ca20a79737f469a6c22ae273d077fbc9872729d1ff7a26b
MD5 58ef1c51bcd6bbb5a29b436da05d77dd
SHA1 19dfc39d310e882743ccbdf9bd138985bcf9f616
SHA512 95cfe1c1845026b90dd3d8812d0d32e137c2f36111c8be4c61a08b2bb7e0a02b4659b77a2aa65f657c19abee1f480c2cfca1c07930f90c97166c73ed7519f8a7
SSDEEP 49152:VQEP1yqBDFntk0KbDYvOUTDSXM7/lAmewtCTUyTT5rfXzzfsX:XyGeAS8rSmuTUyTTlfMX
TLSH
T1C936F147B2A405FCC47B92399646A61BFB36785913209BCF13E085662F933E09FBE711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VVL.ini

Path C:\Users\Admin\AppData\Local\Temp\VVL.ini
Size 104B
SHA256 4bbf79a162e7dbe6547edaa7be600254c7aa4109718c99717df566da9eea2e60
MD5 47a56ce58f29cc0cadb82fb630e74184
SHA1 f9279e6e7ba3d78634eafcb431a9f702fd3309fa
SHA512 139dfa39f34d3b39d75df584405371767c9b55eb4b958f24a840994343ce398b33b540d09fae2d70c4b0fc6d0caa8eb38b0339a61cf1681caa8b88ba3c9aa05a
TLSH
T15BB012580351B9B05803104F222C0273D00974DB0E189595A2893B16295812C29416D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/756-8-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/756-10-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3480-2-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3480-9-0x0000000140000000-0x00000001404D7000-memory.dmp

Download