Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 13:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-21_6b6d609f1a8b3816239464decb359ee8_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_6b6d609f1a8b3816239464decb359ee8_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-21_6b6d609f1a8b3816239464decb359ee8_icedid_luca-stealer_njrat_stealc.exe
- Size 6.3MB
- Sample260822-ql4ahafb43
- SHA256 96fe7b13be7588e4456fd03ae8c8bf17db7199d77e25af8da069520e81ba1885
- MD5 6b6d609f1a8b3816239464decb359ee8
- SHA1 d6b47f97a29061ef6cda4e93ddcb25ad7605df60
- SHA512 a15d3e703627039cc4999e49cb5ae542e6c2640f3ac7bb63298421a7fc9242d93990a3934a38101ab488d7a2523db342b0c74844aaac2eec1dcde7f72f2a1643
- SSDEEP 98304:/kHbbXEOvcsWiO6voSVzTj+h/KTNi/wfpnF4jP/iiCT6SDTVuWve1VC5:/mPXEOvBvoSdqMIwfpFkhCrVuWWVW
- TLSH T1626622A5609281BDC457E779C52598B9F0273F4E5E71AA0F6F4AFD9A2F33280C934B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1188 ~fp01dd3239353cd611.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2056 2026-08-21_6b6d609f1a8b3816239464decb359ee8_icedid_luca-stealer_njrat_stealc.exe 2056 2026-08-21_6b6d609f1a8b3816239464decb359ee8_icedid_luca-stealer_njrat_stealc.exe 2056 2026-08-21_6b6d609f1a8b3816239464decb359ee8_icedid_luca-stealer_njrat_stealc.exe 2056 2026-08-21_6b6d609f1a8b3816239464decb359ee8_icedid_luca-stealer_njrat_stealc.exe 2056 2026-08-21_6b6d609f1a8b3816239464decb359ee8_icedid_luca-stealer_njrat_stealc.exe 2056 2026-08-21_6b6d609f1a8b3816239464decb359ee8_icedid_luca-stealer_njrat_stealc.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2056 wrote to memory of 1188 2056 2026-08-21_6b6d609f1a8b3816239464decb359ee8_icedid_luca-stealer_njrat_stealc.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_6b6d609f1a8b3816239464decb359ee8_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_6b6d609f1a8b3816239464decb359ee8_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\~fp01dd3239353cd611\~fp01dd3239353cd611.exe"C:\Users\Admin\AppData\Local\~fp01dd3239353cd611\~fp01dd3239353cd611.exe"2⤵
- Executes dropped EXE
PID:1188
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\~fp01dd3239353cd611\~fp01dd3239353cd611.exe
- Size 4.6MB
- SHA256 24a0856d09b29b218fb5146c8fcc4835826310c1a25bce693e8a220d658cd6c8
- MD5 a3b2ddf46df3f9e768b1c02f7e22af22
- SHA1 419520b22e44fc43b05a3ade33dcbd25492b4075
- SHA512 3f341c2345903ead76af2be07992461f94e225ce47793e22bbe16936486d8bc9b4c3f21e16ef780a46eb82877b121872a8d5ca1f2428d2f54a88d37d1ca5eeb0
- SSDEEP 98304:pbbXEOvcsWiO6voSVzTj+h/KTNi/wfpnF4jP/iiCT6SD:pPXEOvBvoSdqMIwfpFkhCr
- TLSH T1AE2622B434E28ABEC017E771C21969BCF16B7F4A9D70990BAF5BBD466E32541C831E10
- MD5 SHA1 SHA512 SSDEEP TLSH