2766d55a3b57b47824278aeab6b99985988db1d6c9bebdf406f6196bd1edb735

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_78d7e6d21fd18b52435291060a2a2f02_icedid_luca-stealer_njrat_stealc.exe
Size 2.2MB
Sample260907-atjcasea33
SHA256 2766d55a3b57b47824278aeab6b99985988db1d6c9bebdf406f6196bd1edb735
MD5 78d7e6d21fd18b52435291060a2a2f02
SHA1 1a915bfff8c6f05ac1d26a589f438ef1aa0b9f7b
SHA512 e82fa2ac7fc964c395702aad7bf123d300eb8aa4ed475bb1b5d3156324b10f13f5b46f5d01b443634c1ae084ed638e7459b681ff1bbd3177325f6db5106c47f2
SSDEEP 49152:RhyhgQStDmoZDb1EpfpGX/Vcb25lSW/9eNO0:noM0pGX3aO
TLSH
T162A58F07A7A512E8E1B3C17CC9574A06EBB2BC151731D7CF12A4469A1F272E14EBE722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4904	unst1788741015486-copied.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 4904	2196	2026-09-06_78d7e6d21fd18b52435291060a2a2f02_icedid_luca-stealer_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-06_78d7e6d21fd18b52435291060a2a2f02_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_78d7e6d21fd18b52435291060a2a2f02_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\unst1788741015486-copied.exe
  "C:\Users\Admin\AppData\Local\Temp\unst1788741015486-copied.exe" --source_path="C:\Users\Admin\AppData\Local\Temp\2026-09-06_78d7e6d21fd18b52435291060a2a2f02_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  - Executes dropped EXE
  PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Doubao-uninstaller.log

Path C:\Users\Admin\AppData\Local\Temp\Doubao\User Data\sdk_storage\log\Doubao-uninstaller.log
Size 1KB
SHA256 fef7a1959135d734db4394585a4c5a265d33ec9f60952bd666eb69d91fc201e7
MD5 fa312795037a5bb8fed0d864d66334b2
SHA1 3562bb6d8bd959528a5f548e47a115f1c0c5f2bc
SHA512 5f8c9a54f5b58663f3f0eaed232a1dadbbca8884e57e0aa7431ed57a4d02b0728c905fe3d336e340c90c02d82eb65212570cc25946d1faea1378b0ea8e227d3d
TLSH
T15A31F7C35C1490B4BC2E8408760A2DCFE4D1F76B4AD86F1533BB3355988661A6D1F46A
MD5 SHA1 SHA512 TLSH

Submit Download

unst1788741015486-copied.exe

Path C:\Users\Admin\AppData\Local\Temp\unst1788741015486-copied.exe
Size 2.2MB
SHA256 2766d55a3b57b47824278aeab6b99985988db1d6c9bebdf406f6196bd1edb735
MD5 78d7e6d21fd18b52435291060a2a2f02
SHA1 1a915bfff8c6f05ac1d26a589f438ef1aa0b9f7b
SHA512 e82fa2ac7fc964c395702aad7bf123d300eb8aa4ed475bb1b5d3156324b10f13f5b46f5d01b443634c1ae084ed638e7459b681ff1bbd3177325f6db5106c47f2
SSDEEP 49152:RhyhgQStDmoZDb1EpfpGX/Vcb25lSW/9eNO0:noM0pGX3aO
TLSH
T162A58F07A7A512E8E1B3C17CC9574A06EBB2BC151731D7CF12A4469A1F272E14EBE722
MD5 SHA1 SHA512 SSDEEP TLSH