Analysis
- max time kernel
149s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/10/2026, 17:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-10_37359432ad3d8156485d0ce9d37a3f23_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-10_37359432ad3d8156485d0ce9d37a3f23_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target 2026-10-10_37359432ad3d8156485d0ce9d37a3f23_icedid_luca-stealer_njrat_stealc.exe
- Size 4.2MB
- Sample261011-vkpsyadh44
- SHA256 f0ecec7fb2866384971ad9e683be8bb9453bf49ef76f782dd6e39f3ea9e3913a
- MD5 37359432ad3d8156485d0ce9d37a3f23
- SHA1 4051ac09baa9634b21c3a7baf43b5cbaf0ca269d
- SHA512 a43fa926390b948b606c436d6ea168cfbf951dd399ec7c8b58403a007f57a0b735ae6234cc3f27c82b053a074b59795be4b090e5a8a342d0b2023b500bd41f6c
- SSDEEP 24576:pfevRX76+bINZCAS/Xq9uYqZL8K2IDLub1huulkFX5TbiN28w97kCUQhsy3xo8e5:pWv56+kNZsjmhCFerew7Biu2sVFh+3q
- TLSH T1AB26B54BEA7641E5C4FAC03A9553612FF871349AC33097CBA6819A175B23BF5E93E340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-10_37359432ad3d8156485d0ce9d37a3f23_icedid_luca-stealer_njrat_stealc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-10_37359432ad3d8156485d0ce9d37a3f23_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4808 2026-10-10_37359432ad3d8156485d0ce9d37a3f23_icedid_luca-stealer_njrat_stealc.exe 4808 2026-10-10_37359432ad3d8156485d0ce9d37a3f23_icedid_luca-stealer_njrat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_37359432ad3d8156485d0ce9d37a3f23_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_37359432ad3d8156485d0ce9d37a3f23_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4808
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TY6HNOHQ\pixel[1].gif
- Size 42B
- SHA256 ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
- MD5 d89746888da2d9510b64a9f031eaecd5
- SHA1 d5fceb6532643d0d84ffe09c40c481ecdf59e15a
- SHA512 d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c
- MD5 SHA1 SHA512