Overview

overview

3

Static

static

3

2026-11-01...at.exe

windows10-2004-x64

1

2026-11-01...at.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 12:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe
  • Size 1.9MB
  • Sample261102-pavcsabw8j
  • SHA256 7499b743f0c485bbd70a34f179d19cc52585bb76cbdceb9c491dbb2529f3c5d6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3332
    • C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe
      C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe --worker=0 --no-exec --no-summary --verbose=2 --color=always -- "test_uc_ctl_mode"
      2⤵
        PID:4892
      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe
        C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe --worker=1 --no-exec --no-summary --verbose=2 --color=always -- "test_uc_ctl_page_size"
        2⤵
          PID:4532
        • C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe
          C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe --worker=2 --no-exec --no-summary --verbose=2 --color=always -- "test_uc_ctl_arch"
          2⤵
            PID:3180
          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe
            C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe --worker=3 --no-exec --no-summary --verbose=2 --color=always -- "test_uc_ctl_time_out"
            2⤵
              PID:4420
            • C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe
              C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe --worker=4 --no-exec --no-summary --verbose=2 --color=always -- "test_uc_ctl_exits"
              2⤵
                PID:2476
              • C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe
                C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe --worker=5 --no-exec --no-summary --verbose=2 --color=always -- "test_uc_ctl_tb_cache"
                2⤵
                  PID:1812
                • C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe
                  C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe --worker=6 --no-exec --no-summary --verbose=2 --color=always -- "test_uc_hook_cached_uaf"
                  2⤵
                    PID:2512
                  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe --worker=7 --no-exec --no-summary --verbose=2 --color=always -- "test_uc_emu_stop_set_ip"
                    2⤵
                      PID:3188
                    • C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe
                      C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe --worker=8 --no-exec --no-summary --verbose=2 --color=always -- "test_tlb_clear"
                      2⤵
                        PID:6040
                      • C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe --worker=9 --no-exec --no-summary --verbose=2 --color=always -- "test_noexec"
                        2⤵
                          PID:3244
                        • C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe
                          C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe --worker=10 --no-exec --no-summary --verbose=2 --color=always -- "test_add_block_hook"
                          2⤵
                            PID:5228
                          • C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-11-01_ab0da109b605eb8864f1fc72a72a3aa7_coinminer_icedid_luca-stealer_njrat.exe --worker=11 --no-exec --no-summary --verbose=2 --color=always -- "test_add_block_icount_hook"
                            2⤵
                              PID:1500

                          Network

                                MITRE ATT&CK Matrix

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                memory/1812-2-0x000002260E080000-0x000002260E081000-memory.dmp
                                Download

                                memory/1812-3-0x000002260E1E0000-0x000002260E5E0000-memory.dmp
                                Download

                                memory/2476-1-0x000002F4499E0000-0x000002F4499E1000-memory.dmp
                                Download

                                memory/2512-4-0x000002DBBEDD0000-0x000002DBBF1D0000-memory.dmp
                                Download

                                memory/3188-5-0x0000027B8AFC0000-0x0000027B8B3C0000-memory.dmp
                                Download

                                memory/4532-0-0x000001BFBE1D0000-0x000001BFBE1D1000-memory.dmp
                                Download