39d2ebf968d083cdb01f8793402fb95aa75aee15c1f17e6327d0bd738b141279

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 11:20

Target
2026-09-30_805161852412ce55c03c500ba09bbe98_icedid_luca-stealer_njrat_stealc.exe
Size 5.2MB
Sample261001-nfph2ssvbt
SHA256 39d2ebf968d083cdb01f8793402fb95aa75aee15c1f17e6327d0bd738b141279
MD5 805161852412ce55c03c500ba09bbe98
SHA1 8702c0f06c813901b7590e9f108d39c485169894
SHA512 b561381c4d982cf9b7e829b5843edb109154ee6b975150edd5a20a5b398eeb7f1734fc096120c330be7d261c98a3ab7ac436adc4d3b24141defaca4c34207b71
SSDEEP 49152:8Aw0C0bwQVaXdUMM+eUBWxMUmBB806NkRzBEufpbksj2r4ceGQpsi+A6pEiDaWFM:Lra7BS4RjHceG86pFqdEX2/
TLSH
T16646AD0F71D51DA8F372C37D86A2A622E6723C010F3059CB16E1719D5FABAD09E7A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c596-5.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Executes dropped EXE 1 IoCs

pid	Process
4120	qc3uggumrkx8.tmp

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 4120	5016	2026-09-30_805161852412ce55c03c500ba09bbe98_icedid_luca-stealer_njrat_stealc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-30_805161852412ce55c03c500ba09bbe98_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_805161852412ce55c03c500ba09bbe98_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Local\Temp\qc3uggumrkx8.tmp
  "C:\Users\Admin\AppData\Local\Temp\qc3uggumrkx8.tmp" "C:\Users\Admin\AppData\Local\Temp\7bnhwzpipzjt.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4120

7bnhwzpipzjt.tmp

Path C:\Users\Admin\AppData\Local\Temp\7bnhwzpipzjt.tmp
Size 4.9MB
SHA256 b2c2f727e29ea80add22f7e5507dc95850579831a755531004777161f3ea4b7d
MD5 b91098979f69380095b77a6e69529481
SHA1 0a3a65f85b2cf346c06fbbba8a21a043d403578e
SHA512 d7de5364977496e777463f9a63f35d95061b6952bc97111844d4daf64208d0e3668d61ba409afb2061757488c0cce52161938a608fd48c9b9512654074bb1692
SSDEEP 49152:p0C0bwQVaXdUMM+eUBWxMUmBB806NkRzBEufpbksj2r4ceGQpsi+A6pEiDaWFAdv:Ca7BS4RjHceG86pFqdEX2/
TLSH
T1F136AD4F71D51EA8E372C37D86A6E622D6223C010F3059CB26E1719D5FABAC49F76702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qc3uggumrkx8.tmp

Path C:\Users\Admin\AppData\Local\Temp\qc3uggumrkx8.tmp
Size 219KB
SHA256 2f0af864970307c317a68c36049c5b2854e7fd3bd8173d40450012d174ae071a
MD5 05c91ce9a64ded74ce9a7228615ba79e
SHA1 6b141564401459181f67852ebeab39b97787ef02
SHA512 5b35d625d15fa12c136010665cb6f95ff6bf96a190c53c278cb6239544c7399e3b5dfd31002f6adc000ba6c6ce13bf5f7bcaef22c0a2d646f1d71ed7eac4f3b3
SSDEEP 3072:dF/LnUbJZJ3zmku/i6P5Ec1F2Ubh8iaJYUWcFQjdEhINxqN+YAf+LJK:dFDU7J3Ru//5EcKgR69/QdN12LJ
TLSH
T129248D19B7950CFAE5B78579CC414802DB73BC4A07B0DADF07904AA69F276E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download