Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/08/2026, 01:53
General
- Target 2026-08-19_2a3ebc56406c56e39c9b349afa2a88d9_icedid_luca-stealer_njrat_stealc.exe
- Size 3.5MB
- Sample260820-cbhddsxhkf
- SHA256 d9ed22419c433199f97e54585865dad01d11ddb58376319ca12059014dffea81
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Discovers running processes 1 TTPs 5 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_2a3ebc56406c56e39c9b349afa2a88d9_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_2a3ebc56406c56e39c9b349afa2a88d9_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\~fp01dd3046c15554d2.exe"C:\Users\Admin\AppData\Local\~fp01dd3046c15554d2.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
~fp01dd3046cfaff550.dll
~fp01dd3046c15554d2.exe
memory/1584-41-0x000001EC48F90000-0x000001EC48F98000-memory.dmp
memory/1584-37-0x000001EC48D60000-0x000001EC48F90000-memory.dmp
memory/1584-33-0x000001EC2ED90000-0x000001EC2ED9A000-memory.dmp
memory/1584-34-0x000001EC47CC0000-0x000001EC47CD0000-memory.dmp
memory/1584-35-0x00007FF779510000-0x00007FF779826000-memory.dmp
memory/1584-36-0x000001EC48A80000-0x000001EC48D56000-memory.dmp
memory/1584-42-0x000001EC490B0000-0x000001EC490CA000-memory.dmp
memory/1584-38-0x000001EC48FA0000-0x000001EC49062000-memory.dmp
memory/1584-39-0x000001EC49080000-0x000001EC490A8000-memory.dmp
memory/1584-40-0x000001EC49110000-0x000001EC4911A000-memory.dmp
memory/1584-32-0x000001EC47CC0000-0x000001EC47CD0000-memory.dmp
memory/1584-4-0x00007FFB7CFF0000-0x00007FFB7D1E5000-memory.dmp
memory/1584-47-0x000001EC47CC0000-0x000001EC47CD0000-memory.dmp
memory/1584-44-0x000001EC490D0000-0x000001EC490D8000-memory.dmp
memory/1584-45-0x000001EC490E0000-0x000001EC490EA000-memory.dmp
memory/1584-46-0x000001EC490F0000-0x000001EC49108000-memory.dmp
memory/1584-43-0x000001EC2F660000-0x000001EC2F66A000-memory.dmp
memory/1584-48-0x000001EC47CC0000-0x000001EC47CD0000-memory.dmp
memory/1584-49-0x00007FF779510000-0x00007FF779826000-memory.dmp
memory/1584-50-0x000001EC2EDD0000-0x000001EC2EFC5000-memory.dmp
memory/1584-51-0x000001EC47CC0000-0x000001EC47CD0000-memory.dmp
memory/1584-52-0x000001EC47CC0000-0x000001EC47CD0000-memory.dmp
memory/1584-53-0x000001EC47CC0000-0x000001EC47CD0000-memory.dmp
memory/1584-55-0x00007FF779510000-0x00007FF779826000-memory.dmp