Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 01:53
General
- Target 2026-08-19_2a3ebc56406c56e39c9b349afa2a88d9_icedid_luca-stealer_njrat_stealc.exe
- Size 3.5MB
- Sample260820-cbhddsxhkf
- SHA256 d9ed22419c433199f97e54585865dad01d11ddb58376319ca12059014dffea81
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Discovers running processes 1 TTPs 5 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_2a3ebc56406c56e39c9b349afa2a88d9_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_2a3ebc56406c56e39c9b349afa2a88d9_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\~fp01dd3046dfc4b528.exe"C:\Users\Admin\AppData\Local\~fp01dd3046dfc4b528.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist.exe /fo csv /nh3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
~fp01dd3046c70a3b32.dll
~fp01dd3046dfc4b528.exe
memory/424-45-0x000001D73DD60000-0x000001D73DD7A000-memory.dmp
memory/424-47-0x00007FF6A7880000-0x00007FF6A7B96000-memory.dmp
memory/424-14-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/424-34-0x000001D73D1D0000-0x000001D73D1DA000-memory.dmp
memory/424-35-0x00007FF6A7880000-0x00007FF6A7B96000-memory.dmp
memory/424-36-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/424-37-0x000001D756840000-0x000001D756B16000-memory.dmp
memory/424-38-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/424-39-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/424-40-0x000001D756B20000-0x000001D756D50000-memory.dmp
memory/424-41-0x000001D73DDF0000-0x000001D73DEB2000-memory.dmp
memory/424-42-0x000001D73DC00000-0x000001D73DC28000-memory.dmp
memory/424-43-0x000001D73D270000-0x000001D73D27A000-memory.dmp
memory/424-44-0x000001D73DD50000-0x000001D73DD58000-memory.dmp
memory/424-11-0x00007FFE8B8FF000-0x00007FFE8B900000-memory.dmp
memory/424-4-0x00007FFEAE560000-0x00007FFEAE7C3000-memory.dmp
memory/424-50-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/424-48-0x000001D73D2A0000-0x000001D73D503000-memory.dmp
memory/424-46-0x000001D73DD80000-0x000001D73DD8A000-memory.dmp
memory/424-49-0x000001D73DC30000-0x000001D73DC38000-memory.dmp
memory/424-51-0x000001D73D280000-0x000001D73D28A000-memory.dmp
memory/424-52-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/424-53-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/424-54-0x000001D73DD90000-0x000001D73DDA8000-memory.dmp
memory/424-55-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/424-56-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/424-57-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/424-58-0x00007FF6A7880000-0x00007FF6A7B96000-memory.dmp
memory/424-60-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/424-61-0x00007FF6A7880000-0x00007FF6A7B96000-memory.dmp
memory/424-63-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp