fef9d362d067039aaa489b905ba9c9b0f2eba09785ea1913a41f990278d291ba

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_a13a5d437df68b4ae03e0d609f31e79a_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 7.6MB
Sample260823-d76arshc32
SHA256 fef9d362d067039aaa489b905ba9c9b0f2eba09785ea1913a41f990278d291ba
MD5 a13a5d437df68b4ae03e0d609f31e79a
SHA1 23c83ba15f53e18b7fa82421bb17006ef8d149ff
SHA512 cd95eeca9c7fb747f305022b524068f24f7aed42f5289344619e5f2afe75c2e6b971aaf2f32f7c395f9d33f4735a3e77ae444c8402cdb7b1b67dd51a60c746d6
SSDEEP 196608:70TrZyyMAWH7dfDgK1EMc8jCWThKRFoIfRl:mO7dfmMvCWlI
TLSH
T140862399B2E904E6D467C67C89728406E7B27C97072086DF0398B6E93FB37914C3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	2026-08-22_a13a5d437df68b4ae03e0d609f31e79a_icedid_luca-stealer_njrat_stealc_vidar.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-22_a13a5d437df68b4ae03e0d609f31e79a_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_a13a5d437df68b4ae03e0d609f31e79a_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Modifies registry class
PID:4408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads