a2eed98cf82fc9c28f9884a2ece5407af66378bf4476be20b7007d3993fb77e0

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_6f2af7d628cca6a534cb424f2ae8e101_icedid_luca-stealer_njrat_stealc.exe
Size 5.1MB
Sample261104-v4e3vaea85
SHA256 a2eed98cf82fc9c28f9884a2ece5407af66378bf4476be20b7007d3993fb77e0
MD5 6f2af7d628cca6a534cb424f2ae8e101
SHA1 c2d7b98505c1b546621be3a1069535d624814444
SHA512 16b1eb25311cdbf3e7e7ef7ee2d568f3cde9cba211182fbf8e5ab8424f41e29cab7d99a15e6d178c6b383def3c3846aa942225e9a13091676ae63ed94820c083
SSDEEP 49152:19bBf9bjD9bHFuJxQXwlK1wxHUrGg2OtC9WiGzZl5giBMtVs2rwQw0er:1dN9XLuJGO8OHUrJbtgYH5giBCzwQSr
TLSH
T19746334577E222ECE077427989910752EAB9BC612B24B9E707D406B17F732C09E7FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-03_6f2af7d628cca6a534cb424f2ae8e101_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-03_6f2af7d628cca6a534cb424f2ae8e101_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5032	2026-11-03_6f2af7d628cca6a534cb424f2ae8e101_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5032	2026-11-03_6f2af7d628cca6a534cb424f2ae8e101_icedid_luca-stealer_njrat_stealc.exe
5032	2026-11-03_6f2af7d628cca6a534cb424f2ae8e101_icedid_luca-stealer_njrat_stealc.exe
5032	2026-11-03_6f2af7d628cca6a534cb424f2ae8e101_icedid_luca-stealer_njrat_stealc.exe
5032	2026-11-03_6f2af7d628cca6a534cb424f2ae8e101_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
5032	2026-11-03_6f2af7d628cca6a534cb424f2ae8e101_icedid_luca-stealer_njrat_stealc.exe
5032	2026-11-03_6f2af7d628cca6a534cb424f2ae8e101_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4264	5032	2026-11-03_6f2af7d628cca6a534cb424f2ae8e101_icedid_luca-stealer_njrat_stealc.exe	90
PID 5032 wrote to memory of 4264	5032	2026-11-03_6f2af7d628cca6a534cb424f2ae8e101_icedid_luca-stealer_njrat_stealc.exe	90
PID 5032 wrote to memory of 6020	5032	2026-11-03_6f2af7d628cca6a534cb424f2ae8e101_icedid_luca-stealer_njrat_stealc.exe	91
PID 5032 wrote to memory of 6020	5032	2026-11-03_6f2af7d628cca6a534cb424f2ae8e101_icedid_luca-stealer_njrat_stealc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-11-03_6f2af7d628cca6a534cb424f2ae8e101_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_6f2af7d628cca6a534cb424f2ae8e101_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --browser=chrome --no-first-run --no-default-browser-check --no-startup-window
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --browser=edge --no-first-run --no-default-browser-check --no-startup-window
  2⤵
  PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Process Injection

T1055

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5032-0-0x0000000140000000-0x00000001402BD000-memory.dmp

Download

memory/5032-1210-0x000001D987020000-0x000001D987021000-memory.dmp

Download

memory/5032-1217-0x0000000140000000-0x00000001402BD000-memory.dmp

Download

memory/5032-1219-0x0000000140000000-0x00000001402BD000-memory.dmp

Download