8f2a008d3bf8ed94255c280237808e2e5ce56c2b9712acf4988d3972e18a7dff

General

Target
2026-08-27_0c421d674f830dbe12c4429655ae16dd_icedid_luca-stealer_njrat.exe
Size 65.4MB
Sample260827-26jblsbc48
SHA256 8f2a008d3bf8ed94255c280237808e2e5ce56c2b9712acf4988d3972e18a7dff
MD5 0c421d674f830dbe12c4429655ae16dd
SHA1 c7e17810a4548b037d7bcb42f8d8979acb7297c9
SHA512 dc2f979e72df45411dc8d26ad80970e4a08774111bcc9842881838d5a2bfb263ae158587106d5f529a0fb0558f3e8129f64464d742b119e9d4cbb0df42d5b310
SSDEEP 786432:56c1+XF/0hFOA+d6BSmsF1CM05s+F85vXLQCxmVB4EQhu2mmg:5QXi+6BSmfM05sXvXMCQkEQhu2A
TLSH
T1E4E74CA7464D43BFE73F27AA15AE09B6C3591832E3A80150D2D19E760F6DDE1316AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2260	~pt_payload.exe
456	chromelevator.exe
4412	chromelevator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1552	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	~pt_payload.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	~pt_payload.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 2260	1592	2026-08-27_0c421d674f830dbe12c4429655ae16dd_icedid_luca-stealer_njrat.exe	90
PID 2260 wrote to memory of 456	2260	~pt_payload.exe	91
PID 456 wrote to memory of 2336	456	chromelevator.exe	93
PID 456 wrote to memory of 2336	456	chromelevator.exe	93
PID 2260 wrote to memory of 4412	2260	~pt_payload.exe	96
PID 4412 wrote to memory of 3352	4412	chromelevator.exe	98
PID 4412 wrote to memory of 3352	4412	chromelevator.exe	98
PID 2260 wrote to memory of 1552	2260	~pt_payload.exe	99
PID 1552 wrote to memory of 1416	1552	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-27_0c421d674f830dbe12c4429655ae16dd_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_0c421d674f830dbe12c4429655ae16dd_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Users\Admin\AppData\Local\Temp\~pt_payload.exe
  "C:\Users\Admin\AppData\Local\Temp\~pt_payload.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" chrome
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:2336
- - C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" edge
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3352
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c reg export "HKCU\Software\Ankama\Dofus" "C:\Users\Admin\AppData\Local\Temp\B64907-8825c8DD\dofus_ankama_data\dofus_shield.reg" /y
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Windows\system32\reg.exe
      reg export "HKCU\Software\Ankama\Dofus" "C:\Users\Admin\AppData\Local\Temp\B64907-8825c8DD\dofus_ankama_data\dofus_shield.reg" /y
      4⤵
      PID:1416

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3408

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
Size 1.4MB
SHA256 3ede96af87cdcd799f87e9f3def0b42ce4c5e37b9aa488f45d5c357dc2dd147a
MD5 2d0811cf7c53709960970ad2145de0da
SHA1 d62cea234c5f4a5d2e91eb39af22ed7cf614fc5f
SHA512 711d332cfcee351b8a56a5e3de502080d788684e0d7a7c849a95a8ca4ceff330901b1c5aabdab9685e2885d7fbb0149e0a401176baea29ac207dba5f06bd6d64
SSDEEP 24576:wr8XOrkshL+EMsrN5x1/CPznl2RDMkJt4MjYIBrf6hr3qFt:wrPphLEs7x1/CzlMb4eFyhz4
TLSH
T1CE650216A6A501F9E2B7D678C9525906DA33FC124F61B7DF03984A9A1F337E08E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bane_debug.log

Path C:\Users\Admin\AppData\Local\Temp\bane_debug.log
Size 2KB
SHA256 4f97c34ade7857ed934ab2bd8c9db2adf45068b30ae6f2c43727e285aafc831d
MD5 301bde16a9a1d3025e48d4c1d6b88227
SHA1 ad777bd1e02e2ed9398be8422726ee8222122440
SHA512 0477397bb347f25372de6c50c226e3f9c331aa88e9bfc51cbb0cd5e51f2466d1bea4d5e490ecb8c40e34d747dffe67406ee373fa2a38b9296f4a4610c4af101f
TLSH
T101514C5639FEC13B0DC6958E99655DDDE090340F97A22A3EE73A4414B69880DFFE7301
MD5 SHA1 SHA512 TLSH

Submit Download

bane_debug.log

Path C:\Users\Admin\AppData\Local\Temp\bane_debug.log
Size 2KB
SHA256 211799354e50d4e94de9d622f86f9abae44409b3a6d618016ab23d5170837ba2
MD5 23a4b837ded914efacc40d4373e7c13a
SHA1 7d722a6681047b5e99b058a2aa8e9cf202e5e576
SHA512 3ca5c01dc799219486633c98145e02c4d65c84f14b1735cd0295647f11387fe96a4cf648f3460027712514c482b3ee8a28ddae5735ce12b3fe946bed50c9694b
TLSH
T100513A5539FEC13B0DC6648D99655DDDE190340F97A12A3AE73B4814B69880AFFE3701
MD5 SHA1 SHA512 TLSH

Submit Download

bane_debug.log

Path C:\Users\Admin\AppData\Local\Temp\bane_debug.log
Size 1KB
SHA256 bab7d1c3c1f135286be772f92ab3b0e8cb363d4a18c1122c71caf5fbc7338613
MD5 e364719d938b68870db3cf3ff866d48b
SHA1 d42cfce591371d6a6817695d1075b834d16916d2
SHA512 60b6adcf00a02fb6baf367d676fa98e095023c97343aa443e2e6deb5cf7e3177d1b4fc9ed5dbc84d1aee9346da27cb0542162c32a3f7fb8251804988710fb530
TLSH
T1D3316F553DFDC13B1DC6998AA6615DCDE0D0380FA6A52D2AD73A4414B68880EBFE3351
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1592-0-0x00007FFBD5080000-0x00007FFBD52E3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads