56a2585b4c4334ce7c15ee1c163ac2e3e2bd736292bee4b3aca58333b19e3588

General

Target
2026-08-20_9c58313c9829b9073f3e74a58714e6a6_icedid_luca-stealer_njrat.exe
Size 65.4MB
Sample260820-v1ctbasbpa
SHA256 56a2585b4c4334ce7c15ee1c163ac2e3e2bd736292bee4b3aca58333b19e3588
MD5 9c58313c9829b9073f3e74a58714e6a6
SHA1 0a10a6baf5cf7def8a03af3bfb5d1ed7e1d8f30c
SHA512 69f886dbf09ee17df465e76001900ca98adc96e6a29c7434225546dd1b9aa2c72598fa7881899a900225f3510e874082f30eab42e9c66939b6b9df538e2b5f2e
SSDEEP 786432:/7609KX3xj7A1JJlvFbK63EvcE3ifT626n2//JNWxSp2S:/7peBcZlvtKMNE3qA2//JNWkp2S
TLSH
T15BE7D64E45399FE61C98F5AFB93CA222916DA3D238426CCD2148D973BF3C8739136D16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5036	~pt_payload.exe
4580	chromelevator.exe
1324	chromelevator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2800	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	~pt_payload.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	~pt_payload.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 5036	4772	2026-08-20_9c58313c9829b9073f3e74a58714e6a6_icedid_luca-stealer_njrat.exe	90
PID 5036 wrote to memory of 4580	5036	~pt_payload.exe	91
PID 4580 wrote to memory of 3960	4580	chromelevator.exe	93
PID 4580 wrote to memory of 3960	4580	chromelevator.exe	93
PID 5036 wrote to memory of 1324	5036	~pt_payload.exe	96
PID 1324 wrote to memory of 96	1324	chromelevator.exe	98
PID 1324 wrote to memory of 96	1324	chromelevator.exe	98
PID 5036 wrote to memory of 2800	5036	~pt_payload.exe	99
PID 2800 wrote to memory of 5444	2800	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-20_9c58313c9829b9073f3e74a58714e6a6_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_9c58313c9829b9073f3e74a58714e6a6_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\~pt_payload.exe
  "C:\Users\Admin\AppData\Local\Temp\~pt_payload.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" chrome
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3960
- - C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" edge
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:96
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c reg export "HKCU\Software\Ankama\Dofus" "C:\Users\Admin\AppData\Local\Temp\B866cb-b8a69dDD\dofus_ankama_data\dofus_shield.reg" /y
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Windows\system32\reg.exe
      reg export "HKCU\Software\Ankama\Dofus" "C:\Users\Admin\AppData\Local\Temp\B866cb-b8a69dDD\dofus_ankama_data\dofus_shield.reg" /y
      4⤵
      PID:5444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5488

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
Size 1.4MB
SHA256 3ede96af87cdcd799f87e9f3def0b42ce4c5e37b9aa488f45d5c357dc2dd147a
MD5 2d0811cf7c53709960970ad2145de0da
SHA1 d62cea234c5f4a5d2e91eb39af22ed7cf614fc5f
SHA512 711d332cfcee351b8a56a5e3de502080d788684e0d7a7c849a95a8ca4ceff330901b1c5aabdab9685e2885d7fbb0149e0a401176baea29ac207dba5f06bd6d64
SSDEEP 24576:wr8XOrkshL+EMsrN5x1/CPznl2RDMkJt4MjYIBrf6hr3qFt:wrPphLEs7x1/CzlMb4eFyhz4
TLSH
T1CE650216A6A501F9E2B7D678C9525906DA33FC124F61B7DF03984A9A1F337E08E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bane_debug.log

Path C:\Users\Admin\AppData\Local\Temp\bane_debug.log
Size 2KB
SHA256 e1d1bf93f29f1476df8c6d11957920af06053958d3dc6f77f2060b273b3fe9bd
MD5 1619513483d40d1bc533f25f9f739487
SHA1 bc971397edb9e99e97f5654aeb757d938a623507
SHA512 06065778e0189968d478fff1917f71e59e2eedfa03dd32a0a286cb0cedc20af02433c118966ebaf02e1bcc45782adf1682c64577d1ed2db57bfab43b420129dc
TLSH
T1F6416D9676FEC6BB0D4A889E8554DDBF60F03415A7CD2E40A35A9C1C76C280BBDD7321
MD5 SHA1 SHA512 TLSH

Submit Download

bane_debug.log

Path C:\Users\Admin\AppData\Local\Temp\bane_debug.log
Size 2KB
SHA256 69fc4889c97d1a2be22663d40e7a16d1b6ad115eceed71342e38a13db3aee5ea
MD5 0cc50ac9ee0d0d2b6a3cb0ae5be4ade3
SHA1 0c4b8aa2b599d8e6752e5911487e28dc8fca736f
SHA512 12be90e4be711b4c102dc91444fcff0d125bee04e5d38ac24ab5f40fcbebb2d895214ba6ec776577e7399648e4219d6337bf5f9e6d381e1fbae7d8bd7ab643e1
TLSH
T113518AD536FEC2BB0D4A589E8154DDFFA0F03409A7D96A80631A9C1CB6C280BBDD7721
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4772-0-0x00007FF8EA180000-0x00007FF8EA3E3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads