b6469b32b0e53bdc2b4b88ef5e30e6a47308ded6867788b4623439bb6c58ec6d

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 05:14

Target
2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe
Size 54.4MB
Sample260818-fxb1aafe45
SHA256 b6469b32b0e53bdc2b4b88ef5e30e6a47308ded6867788b4623439bb6c58ec6d
MD5 0d1f0c67790bf8e224514cb808b5105a
SHA1 ec43cf4728c44d92a085254ef215f4e07ace76e4
SHA512 5de03e5ae7bf75bfe89889078c934796f302406a4b4bf06e3a400d1c1ac6fb1481853e477e3bd1c3d5d74bd78e51af08e8f39cb74857bc0f30061ce94dac28ad
SSDEEP 98304:6oZC399XCU0gl/MvLV9FaGpIFeBv7ksszfza:v439sm/MESB8r
TLSH
T103C70E98C6CB123FCD762CB85F3CE34EDA5A579893245785687E6E8413312A51BE0EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

flow	ioc
9	api.ipify.org
1	api.ipify.org

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4840	4560	2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe	89
PID 4560 wrote to memory of 4840	4560	2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe	89
PID 4560 wrote to memory of 4304	4560	2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe	92
PID 4560 wrote to memory of 4304	4560	2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1848

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2672