15ad2a2120de2f3f2c117e603fed18a13b7474c79cac081f6406fa6192caf124

General

Target
2026-08-20_a4158b693442d1e558834d839c454563_icedid_luca-stealer_njrat.exe
Size 65.4MB
Sample260820-yyasqaaj71
SHA256 15ad2a2120de2f3f2c117e603fed18a13b7474c79cac081f6406fa6192caf124
MD5 a4158b693442d1e558834d839c454563
SHA1 a73546b33e3bfa101945fa6f76deed535f7e2243
SHA512 3b3adcb5d716fe139e88304247401442910aced3a28208819951d0adcc7ae492d04ba090afbb9b52d05939fd41fdc7db8c0265ad1c739517f0e47daf56a17e7f
SSDEEP 786432:bUZ58OuXhaAJ/5OsfE5fjcRpbsE5m/yhrBojtxrZBZjZm:bcu9s+EZjcRp55m/yg
TLSH
T1BCE7861E1AFEBC45048C3A9EAF5F22A93AC5951209FC5559A028F57E9F28C02CD53F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4936	~pt_payload.exe
4432	chromelevator.exe
2720	chromelevator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3564	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	~pt_payload.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	~pt_payload.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 4936	4400	2026-08-20_a4158b693442d1e558834d839c454563_icedid_luca-stealer_njrat.exe	89
PID 4936 wrote to memory of 4432	4936	~pt_payload.exe	90
PID 4432 wrote to memory of 812	4432	chromelevator.exe	92
PID 4432 wrote to memory of 812	4432	chromelevator.exe	92
PID 4936 wrote to memory of 2720	4936	~pt_payload.exe	95
PID 2720 wrote to memory of 4696	2720	chromelevator.exe	97
PID 2720 wrote to memory of 4696	2720	chromelevator.exe	97
PID 4936 wrote to memory of 3564	4936	~pt_payload.exe	98
PID 3564 wrote to memory of 3044	3564	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-20_a4158b693442d1e558834d839c454563_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_a4158b693442d1e558834d839c454563_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Local\Temp\~pt_payload.exe
  "C:\Users\Admin\AppData\Local\Temp\~pt_payload.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" chrome
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:812
- - C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" edge
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4696
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c reg export "HKCU\Software\Ankama\Dofus" "C:\Users\Admin\AppData\Local\Temp\B56839-647dfeDD\dofus_ankama_data\dofus_shield.reg" /y
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Windows\system32\reg.exe
      reg export "HKCU\Software\Ankama\Dofus" "C:\Users\Admin\AppData\Local\Temp\B56839-647dfeDD\dofus_ankama_data\dofus_shield.reg" /y
      4⤵
      PID:3044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
Size 1.4MB
SHA256 3ede96af87cdcd799f87e9f3def0b42ce4c5e37b9aa488f45d5c357dc2dd147a
MD5 2d0811cf7c53709960970ad2145de0da
SHA1 d62cea234c5f4a5d2e91eb39af22ed7cf614fc5f
SHA512 711d332cfcee351b8a56a5e3de502080d788684e0d7a7c849a95a8ca4ceff330901b1c5aabdab9685e2885d7fbb0149e0a401176baea29ac207dba5f06bd6d64
SSDEEP 24576:wr8XOrkshL+EMsrN5x1/CPznl2RDMkJt4MjYIBrf6hr3qFt:wrPphLEs7x1/CzlMb4eFyhz4
TLSH
T1CE650216A6A501F9E2B7D678C9525906DA33FC124F61B7DF03984A9A1F337E08E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bane_debug.log

Path C:\Users\Admin\AppData\Local\Temp\bane_debug.log
Size 2KB
SHA256 9a082f2d039622a6e93d890e70fa49381853b8594aed85fe37f00ffaf3975568
MD5 5adcfa9c81b989c6472d77781b55a10e
SHA1 194df165ed7586342eaf9a18c2f2959eb75248ba
SHA512 a92b74e591303b97cc7993a6390743c0e07dd54ebebc60b3f94642edb88747a723e3cee7c838bc89fe359335a8b843df5d5f67c2787ccdfdabecaf1476a7cb1b
TLSH
T122516C5727FDC13F1DC790699E107DF964903E0E9B613E24A7189504B99280ABEFB331
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4400-0-0x00007FFB2E180000-0x00007FFB2E3E3000-memory.dmp

Download

Analysis

Sharing