Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 01:33
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-09-08_f7528a51d406a812d495ec4047ce7748_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-08_f7528a51d406a812d495ec4047ce7748_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-09-08_f7528a51d406a812d495ec4047ce7748_icedid_luca-stealer_njrat_stealc.exe
- Size 2.1MB
- Sample260910-byncgsee66
- SHA256 68b5be1df6d6e770e5d421848a8685a74dfb932965ed17270550fc073802b26c
- MD5 f7528a51d406a812d495ec4047ce7748
- SHA1 dc3092584ca80407030240603cbc78e2e5f8cba4
- SHA512 625f3ea1b56908dc4a1b962a32f98222d920845b6f3f8610b710de765f5e7f237c8bba64da432f969d8b157b43c40e4592baef1c57f9d915c10cd05e47162aba
- SSDEEP 24576:njeTSqWOf4EhIQ+ogNwcGdOqFiNhckmxUmuSh5Mv/HZwVJXz8PqkRHBHjvUJ5uh:njeTSW4SP9gA4BSUmMMDYdzUXYoOn4q
- TLSH T1F7A5AF47B2B901FCC4A7C078C9566517EAF3740527759ADB06E089AA6F23EF11B7E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3476 2026-09-08_f7528a51d406a812d495ec4047ce7748_icedid_luca-stealer_njrat_stealc.exe 3476 2026-09-08_f7528a51d406a812d495ec4047ce7748_icedid_luca-stealer_njrat_stealc.exe 3476 2026-09-08_f7528a51d406a812d495ec4047ce7748_icedid_luca-stealer_njrat_stealc.exe 3476 2026-09-08_f7528a51d406a812d495ec4047ce7748_icedid_luca-stealer_njrat_stealc.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3476 2026-09-08_f7528a51d406a812d495ec4047ce7748_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 3476 2026-09-08_f7528a51d406a812d495ec4047ce7748_icedid_luca-stealer_njrat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_f7528a51d406a812d495ec4047ce7748_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_f7528a51d406a812d495ec4047ce7748_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3476