0a3de314738aab30f7e53acb56bc25ef1de1fbcb8398e25a9e0c7cc936fdf038

General

Target
2026-09-29_b5df3fe7bc0f8f645d99aa89dc672399_icedid_luca-stealer_njrat_stealc.exe
Size 7.7MB
Sample260930-vr54hatfpa
SHA256 0a3de314738aab30f7e53acb56bc25ef1de1fbcb8398e25a9e0c7cc936fdf038
MD5 b5df3fe7bc0f8f645d99aa89dc672399
SHA1 fc3005d6d9fc6a961282ce347f33a8c6e4ac62b1
SHA512 7dac13a714b7b543d4aa0632854968147ff896bf98b13f8973723fa3f225eb23faf9b9574b90c1c85a93d0bc918073c3ee7b3a0cefa60d0cef5ee26bd3457122
SSDEEP 98304:1pk/qXoEBG2vr41wI4iUMiMKT3qWreNRM+/1Kml8Z:1psaoWNr4N8LeWroF9zlM
TLSH
T1E5869C6261CCABADF022F0B9DD43622793F67C4C2360CFA752D40DF3591B998BB65609
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1720	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\0C1D9FA1.sys	6489e92c2b.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\0C1D9FA1\ImagePath = "\\??\\C:\\Windows\\System32\\drivers\\0C1D9FA1.sys"	6489e92c2b.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	2026-09-29_b5df3fe7bc0f8f645d99aa89dc672399_icedid_luca-stealer_njrat_stealc.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1720	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1348	6489e92c2b.exe

Loads dropped DLL 2 IoCs

pid	Process
1348	6489e92c2b.exe
1348	6489e92c2b.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1720	powershell.exe
1720	powershell.exe
1720	powershell.exe
1720	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1348	6489e92c2b.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	powershell.exe
Token: SeLoadDriverPrivilege	1348	6489e92c2b.exe
Token: SeLoadDriverPrivilege	1348	6489e92c2b.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 1720	4716	2026-09-29_b5df3fe7bc0f8f645d99aa89dc672399_icedid_luca-stealer_njrat_stealc.exe	87
PID 4716 wrote to memory of 1348	4716	2026-09-29_b5df3fe7bc0f8f645d99aa89dc672399_icedid_luca-stealer_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-29_b5df3fe7bc0f8f645d99aa89dc672399_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_b5df3fe7bc0f8f645d99aa89dc672399_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Wait-Process -Id 4716 -ErrorAction SilentlyContinue; Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\2026-09-29_b5df3fe7bc0f8f645d99aa89dc672399_icedid_luca-stealer_njrat_stealc.exe' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Deletes itself
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1720
- C:\Users\Admin\AppData\Local\Temp\6489e92c2b.exe
  "C:\Users\Admin\AppData\Local\Temp\6489e92c2b.exe" --deadstar-morphed
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:1348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6489e92c2b.exe

Path C:\Users\Admin\AppData\Local\Temp\6489e92c2b.exe
Size 7.7MB
SHA256 a72ff9cfde9d41f55f196ef4523d4cb15b82b5a50c7be72cf2ef25493fbb8835
MD5 0669a59345e4a9595f8da0b8792f358a
SHA1 e2e9f5a01045f34d65853bc79c0b319930eb12c1
SHA512 72ea27d7bf880f9a5b861c7549129118428985b1348091d3a092cd96a96836e99c8c0cb5f0c67dc390460aaa6ae1239bd8a6e0340f505ac0697324b47639ef4d
SSDEEP 98304:1pk/qXoEBG2vr41wI4iUMiMKT3qWreNRM+/1Kml8w:1psaoWNr4N8LeWroF9zl7
TLSH
T19B869C6261CCABADF022F0B9DD43622793F67C4C2360CFA752D40DF3591B998BB65609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecureEngineSDK64.dll

Path C:\Users\Admin\AppData\Local\Temp\Deadstar\SecureEngineSDK64.dll
Size 28KB
SHA256 175a75ca524b269b25fb5144dc0abb4ac9b1673852df3abfbd4f6c449e01827d
MD5 6d8722b257230e3f691197715ec2b4b1
SHA1 bf141f3aff5b5e1cd2f02a5d81125931ba4a842d
SHA512 b6d077c57780ab6d58649cee36a1016573adfcafcfa8c823297a19f8bb1d1ea0c1b613044076bcd805a0c18dc37a78208ebaa4d0e19c192b65415028355f1069
SSDEEP 192:3Mi08s5GvuxBdzbNEQaSpqX5xS5haVWUcSAfMVIBizxhv:cdZxBhaHfSsA0V
TLSH
T148D2ACAF04B56EFBF91D1CF4059F3A9822C3F3D22DF4866D636E418401EA81B655F289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VehHandler.dll

Path C:\Users\Admin\AppData\Local\Temp\Deadstar\VehHandler.dll
Size 101KB
SHA256 db8c85ecf5d7e9e0045575c26f24f0a8f83a63243c9a441aafbdc399e67c5270
MD5 a793dae9294874b77d332a900a32aebb
SHA1 764612eb7915b4bc35b5c9b4216903339dc51771
SHA512 efffee14495e18e6ae4e1fcaa77def7d8dc1be84d44c4b7ad7d582c5de505c8ad0bc15d60768e28c729e2114682e4a219a951eee91427eda37ed35dbd9dcbbc4
SSDEEP 3072:HwVy7MlsCAWl2sMLN1Mt9l0edb+B9LX6:Qw7Kk22sMJEklX
TLSH
T133A34A5777E500BBE1B78678C8670E46D7B2F81507619BEF03A0429A2F237E14D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_qroj0yvf.1j1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qroj0yvf.1j1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1720-8-0x0000023B39B40000-0x0000023B39B50000-memory.dmp

Download

memory/1720-25-0x0000023B39A50000-0x0000023B39A72000-memory.dmp

Download

memory/1720-9-0x0000023B39B40000-0x0000023B39B50000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads