005a4154750bc54d3d204f3f8e912a12f117eb692b5d67c0c6f4b79b05080f0f

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:19

Target
2026-08-17_616bb6b96ce60f85556677651500ad52_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 4.8MB
Sample260818-dvbkmavfjf
SHA256 005a4154750bc54d3d204f3f8e912a12f117eb692b5d67c0c6f4b79b05080f0f
MD5 616bb6b96ce60f85556677651500ad52
SHA1 6b40125b5f7b36c0c2d1f5befa7594101e5e3c37
SHA512 c53ced59bd9fbd3cd2aa3d6100c26e4ed88fd71dbac74134aa9d22b118e950acf708e96272aff9ad0185264b366d5751289b077071821b33398cff2b8a457b99
SSDEEP 49152:VQEP1yqBDFntk0KbDYvOUTDSXM7/lAmewtCTUyTT5rfXzzfs0:XyGeAS8rSmuTUyTTlfM0
TLSH
T16736F147B2A405FCC47B92399646A61BFB36785913209BCF13E085662F933E09FBE711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2520	WMSY.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2520	WMSY.exe
2520	WMSY.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2520	WMSY.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 2520	4892	2026-08-17_616bb6b96ce60f85556677651500ad52_icedid_luca-stealer_njrat_stealc_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_616bb6b96ce60f85556677651500ad52_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_616bb6b96ce60f85556677651500ad52_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Local\Temp\WMSY.exe
  WMSY.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2520

VVL.ini

Path C:\Users\Admin\AppData\Local\Temp\VVL.ini
Size 104B
SHA256 4bbf79a162e7dbe6547edaa7be600254c7aa4109718c99717df566da9eea2e60
MD5 47a56ce58f29cc0cadb82fb630e74184
SHA1 f9279e6e7ba3d78634eafcb431a9f702fd3309fa
SHA512 139dfa39f34d3b39d75df584405371767c9b55eb4b958f24a840994343ce398b33b540d09fae2d70c4b0fc6d0caa8eb38b0339a61cf1681caa8b88ba3c9aa05a
TLSH
T15BB012580351B9B05803104F222C0273D00974DB0E189595A2893B16295812C29416D1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSY.exe

Path C:\Users\Admin\AppData\Local\Temp\WMSY.exe
Size 4.8MB
SHA256 73a12eb5ba6a77acabf60e5a4e46bd38d553a8b51d471597164b8280504cb935
MD5 aaf19cf4cedc5ed944d38bda6dc5c108
SHA1 f172e7090498983c1f1b5c7ec2acacfe92a64e39
SHA512 ea5e0d7ed5e1e4ec847b9bf0124d2f8f0071bc6592f9c2d968d2ed5b221c700d239cb365722d7604cd1a8a583372b78b58a6eab756b4f52ab4dcab4fff127ebc
SSDEEP 49152:VQEP1yqBDFntk0KbDYvOUTDSXM7/lAmewtCTUyTT5rfXzzfsa:XyGeAS8rSmuTUyTTlfMa
TLSH
T1D436F147B2A405FCC47B92399646A61BFB36785913209BCF13E085662F933E09FBE711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2520-6-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/2520-11-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/4892-0-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/4892-9-0x0000000140000000-0x00000001404D7000-memory.dmp

Download