Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
07/09/2026, 07:25
General
- Target 2026-09-06_18488135c503a7019d87ee0770a3d81d_icedid_luca-stealer_njrat.exe
- Size 13.3MB
- Sample260907-h86eda1erg
- SHA256 55bb162c341ca204c1ad97e7d469d650c206e4b0c11a87ec029caa8df44c09b2
Malware Config
Signatures
- Detects executables packed with VMProtect. 10 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- VMProtect packed file 10 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-06_18488135c503a7019d87ee0770a3d81d_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-06_18488135c503a7019d87ee0770a3d81d_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FCLibBypass\bypass.exeC:\Users\Admin\AppData\Local\Temp\FCLibBypass\bypass.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
bypass.exe
fc_helper.dll
KxC.dll
memory/5036-13-0x00007FFAE0D80000-0x00007FFAE0D82000-memory.dmp
memory/5036-5-0x00007FF7AD68E000-0x00007FF7AE157000-memory.dmp
memory/5036-6-0x00007FFAE0D50000-0x00007FFAE0D52000-memory.dmp
memory/5036-12-0x00007FFAE0D70000-0x00007FFAE0D72000-memory.dmp
memory/5036-10-0x00007FFADEAF0000-0x00007FFADEAF2000-memory.dmp
memory/5036-9-0x00007FFADF1B0000-0x00007FFADF1B2000-memory.dmp
memory/5036-8-0x00007FFADF1A0000-0x00007FFADF1A2000-memory.dmp
memory/5036-7-0x00007FFAE0D60000-0x00007FFAE0D62000-memory.dmp
memory/5036-18-0x00007FF7AD650000-0x00007FF7AEE5B000-memory.dmp
memory/5036-11-0x00007FFADEB00000-0x00007FFADEB02000-memory.dmp
memory/5036-25-0x00007FF7AD650000-0x00007FF7AEE5B000-memory.dmp
memory/5036-28-0x00007FFAC43C0000-0x00007FFAC4EBD000-memory.dmp
memory/5036-27-0x00007FFAE0DA0000-0x00007FFAE0DA2000-memory.dmp
memory/5036-26-0x00007FFAE0D90000-0x00007FFAE0D92000-memory.dmp
memory/5036-32-0x00007FF7AD650000-0x00007FF7AEE5B000-memory.dmp
memory/5036-33-0x00007FF7AD68E000-0x00007FF7AE157000-memory.dmp
memory/5036-34-0x00007FF7AD650000-0x00007FF7AEE5B000-memory.dmp
memory/5036-35-0x00007FF7AD650000-0x00007FF7AEE5B000-memory.dmp
memory/5036-36-0x00007FF7AD650000-0x00007FF7AEE5B000-memory.dmp
memory/5036-37-0x00007FF7AD650000-0x00007FF7AEE5B000-memory.dmp