b6469b32b0e53bdc2b4b88ef5e30e6a47308ded6867788b4623439bb6c58ec6d

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe
Size 54.4MB
Sample260818-fxb1aafe45
SHA256 b6469b32b0e53bdc2b4b88ef5e30e6a47308ded6867788b4623439bb6c58ec6d
MD5 0d1f0c67790bf8e224514cb808b5105a
SHA1 ec43cf4728c44d92a085254ef215f4e07ace76e4
SHA512 5de03e5ae7bf75bfe89889078c934796f302406a4b4bf06e3a400d1c1ac6fb1481853e477e3bd1c3d5d74bd78e51af08e8f39cb74857bc0f30061ce94dac28ad
SSDEEP 98304:6oZC399XCU0gl/MvLV9FaGpIFeBv7ksszfza:v439sm/MESB8r
TLSH
T103C70E98C6CB123FCD762CB85F3CE34EDA5A579893245785687E6E8413312A51BE0EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
18	discord.com
21	api.gofile.io
22	api.gofile.io
17	discord.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
15	api.ipify.org
16	api.ipify.org

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 1600	4704	2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe	87
PID 4704 wrote to memory of 1600	4704	2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe	87
PID 4704 wrote to memory of 2492	4704	2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe	90
PID 4704 wrote to memory of 2492	4704	2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4028

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4708

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\K7_XU7MGGJZ\Chrome\Default\cookies.json
Size 339B
SHA256 6f875b968afebb71ce5ad91fc257eece437803664c0d30a9cf14ed411cc67ed7
MD5 ffa791e9f0c929f6294fb41eec1e0503
SHA1 161020a5f89e1f47a47aa63cf92e2a618b051fe9
SHA512 d3cc8ce7a09bc125aff86ac73d571227c3412b758392eb19f7a7713be45841a96b95228406d7d248db68590ba9b8610c777aba21e111cafb4c648408e49a17ff
TLSH
T107E02D67889A3E12C43746EB1D14198EBF266B8BE13FEECAC0368A00769480B6521083
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\K7_XU7MGGJZ\Chrome\Default\cookies.txt
Size 282B
SHA256 f3b5e93645805c146ae5d23f60cc622aaa5709ab517bb5e585b735f08b42931e
MD5 93036cced938e6e23f12efaa9f5618d5
SHA1 368d77ec1bf9656b0369fa0962e8ed4314eff2de
SHA512 908cf26d17892f968f3e4595ae83900a750ec04b82eb7c1a691fe30cae4c2a609cc43148a6232879c14e45f4a1e7a7534a57a72a74d03c2d668d321251761bcd
TLSH
T12ED02B53092B6B8411B581AB2AB440A75F976E8FA23F9BC980525E00324D81A6EB4266
MD5 SHA1 SHA512 TLSH