Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/09/2026, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_020c61820c1db253db05a166a0abe663_icedid_stealc.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
General
- Target 2026-09-24_020c61820c1db253db05a166a0abe663_icedid_stealc.exe
- Size 1.5MB
- Sample260924-e8a2payfqa
- SHA256 4d27a04917709abf5db4a41cc9f8a0159ee4b98167bfec179422921630816c87
- MD5 020c61820c1db253db05a166a0abe663
- SHA1 c63b3c4b4079c2b5f082303fdedfcf4716f68e0d
- SHA512 29ebe43bc03281910f4737303bf9cac8cabd0f22db4fb2b533ed0c1a08bacd75668f09f187477260e42c30c01fa5b05432a53633e95c87dbbadc953f78e1f38d
- SSDEEP 24576:E4fHa5Jmb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:bfkEb5+Pl6bJTIZ5jdgpZ
- TLSH T13275020B67A521FEE1778634CD828E00FB727C558B61AAEF076009B69E367D46D3D702
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Stealc stealer Version 3 1 IoCs
resource yara_rule behavioral1/memory/4720-13-0x0000000140000000-0x0000000140192000-memory.dmp family_stealc_v3 - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-09-24_020c61820c1db253db05a166a0abe663_icedid_stealc.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4720 2026-09-24_020c61820c1db253db05a166a0abe663_icedid_stealc.exe