10cb7af2668c184d64a0133779bbfa9faaccb98e08ee09f17e4b364039416373

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_86b6416940cf778fceafcc0e16ee5ce7_icedid_konni_luca-stealer_njrat_stealc.exe
Size 7.9MB
Sample261012-vlbmpsec36
SHA256 10cb7af2668c184d64a0133779bbfa9faaccb98e08ee09f17e4b364039416373
MD5 86b6416940cf778fceafcc0e16ee5ce7
SHA1 44fcfd189bb481483a6bd4a48c1f73348f9387a9
SHA512 17fd37b4eeb7b95410ea35fe705521e14446db65c0b09ce2f2cfc2829ec48149c4341c7856a759384bef9e93d5db6c4cd524bd272eaa8ea0412250f550a79e9f
SSDEEP 49152:42sFDKZQZAa9Pa6jgl2vUE6IhFFnosP10cVV4qMtriEuLhpyiqroQP7XWnsMfas/:nsOQp84yctSzxjEPHdovfDY1LyO
TLSH
T180867D1762E802FCE077D1798E86A903E7767C09077056EF06E0B5661F77AE05E7A322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	2026-10-11_86b6416940cf778fceafcc0e16ee5ce7_icedid_konni_luca-stealer_njrat_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-11_86b6416940cf778fceafcc0e16ee5ce7_icedid_konni_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-11_86b6416940cf778fceafcc0e16ee5ce7_icedid_konni_luca-stealer_njrat_stealc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4288	2026-10-11_86b6416940cf778fceafcc0e16ee5ce7_icedid_konni_luca-stealer_njrat_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-11_86b6416940cf778fceafcc0e16ee5ce7_icedid_konni_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_86b6416940cf778fceafcc0e16ee5ce7_icedid_konni_luca-stealer_njrat_stealc.exe"
1⤵
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app.json.tmp

Path C:\Users\Admin\AppData\Local\Pulse\app.json.tmp
Size 2KB
SHA256 e63a2b3e76d90c401415d5a4f2260860d1939a5f414da97a410f51e147da272b
MD5 0b4effa41197ae3c5c48723620c4ed7f
SHA1 47c1e60b71c1edd3e07748253a70d00cc5fbfa6b
SHA512 e3215761c420ea5f5a8c99abc7ae90f1bbeb6abbca3605d4d1cf915cfec17a824f6014b8af399e112f473937a51a749e3956c338c467b66d34e2ef6ad959a767
TLSH
T1A14159228860886963E18E238C5C6F1316A5CD1A54CEFC14A76F464C12FF7B777FA1D6
MD5 SHA1 SHA512 TLSH

Submit Download