darksiderat | 6d5daea97acf82f1f388271e08403d1400faee4273033f280232e480c4b31a2c

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/11/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
Size 4.1MB
Sample261114-vba87afv2m
SHA256 6d5daea97acf82f1f388271e08403d1400faee4273033f280232e480c4b31a2c
MD5 2e820f0b6ca1dd282017f415fcec3f6e
SHA1 375075a0de8f0dd80f72ad19ac18caebc7aa8777
SHA512 ab83790f9932e2b5b77e734708966bc2f57555c0cddb0b729d80e8552a95f27252a74dc0bf7daa18063b50645ff5e3622be93d83e07d6d5d4f10ab3697c4f23c
SSDEEP 49152:z9cNEp1M3oN47m5YSSFYkOqOhlVt9256vPNU9z6Km1wfMIMAMNMoMkM:q7jeXLKu
TLSH
T1CF16BF5FA7A401E8D16BD078CF455943E7B2B41A03A1A7EF259086A70F776F40E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 19 IoCs

resource	yara_rule
behavioral1/memory/2656-12-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/3816-69-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/4860-68-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/3816-60-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/4860-58-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/2396-49-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/2904-39-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/4904-38-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/2904-30-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/4904-27-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/4904-26-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/4776-23-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/2904-29-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/4776-15-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/4776-14-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/2656-10-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/2656-9-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/2656-8-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/2396-82-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	discord.com
5	discord.com
7	discord.com
8	discord.com
9	discord.com
10	discord.com
11	discord.com

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 5088 set thread context of 3220	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	85
PID 5088 set thread context of 2656	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	86
PID 5088 set thread context of 4776	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	87
PID 5088 set thread context of 3452	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	88
PID 5088 set thread context of 4904	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	89
PID 5088 set thread context of 2904	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	91
PID 5088 set thread context of 3780	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	92
PID 5088 set thread context of 3840	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	93
PID 5088 set thread context of 2396	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	94
PID 5088 set thread context of 1200	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	95
PID 5088 set thread context of 4860	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	96
PID 5088 set thread context of 3816	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	97
PID 5088 set thread context of 2100	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	98

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 3220	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	85
PID 5088 wrote to memory of 3220	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	85
PID 5088 wrote to memory of 3220	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	85
PID 5088 wrote to memory of 3220	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	85
PID 5088 wrote to memory of 3220	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	85
PID 5088 wrote to memory of 3220	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	85
PID 5088 wrote to memory of 3220	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	85
PID 5088 wrote to memory of 3220	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	85
PID 5088 wrote to memory of 2656	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	86
PID 5088 wrote to memory of 2656	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	86
PID 5088 wrote to memory of 2656	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	86
PID 5088 wrote to memory of 2656	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	86
PID 5088 wrote to memory of 2656	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	86
PID 5088 wrote to memory of 2656	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	86
PID 5088 wrote to memory of 2656	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	86
PID 5088 wrote to memory of 4776	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	87
PID 5088 wrote to memory of 4776	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	87
PID 5088 wrote to memory of 4776	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	87
PID 5088 wrote to memory of 4776	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	87
PID 5088 wrote to memory of 4776	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	87
PID 5088 wrote to memory of 4776	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	87
PID 5088 wrote to memory of 4776	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	87
PID 5088 wrote to memory of 3452	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	88
PID 5088 wrote to memory of 3452	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	88
PID 5088 wrote to memory of 3452	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	88
PID 5088 wrote to memory of 3452	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	88
PID 5088 wrote to memory of 3452	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	88
PID 5088 wrote to memory of 3452	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	88
PID 5088 wrote to memory of 3452	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	88
PID 5088 wrote to memory of 3452	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	88
PID 5088 wrote to memory of 4904	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	89
PID 5088 wrote to memory of 4904	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	89
PID 5088 wrote to memory of 4904	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	89
PID 5088 wrote to memory of 4904	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	89
PID 5088 wrote to memory of 4904	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	89
PID 5088 wrote to memory of 4904	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	89
PID 5088 wrote to memory of 4904	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	89
PID 5088 wrote to memory of 2904	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	91
PID 5088 wrote to memory of 2904	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	91
PID 5088 wrote to memory of 2904	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	91
PID 5088 wrote to memory of 2904	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	91
PID 5088 wrote to memory of 2904	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	91
PID 5088 wrote to memory of 2904	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	91
PID 5088 wrote to memory of 2904	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	91
PID 5088 wrote to memory of 3780	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	92
PID 5088 wrote to memory of 3780	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	92
PID 5088 wrote to memory of 3780	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	92
PID 5088 wrote to memory of 3780	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	92
PID 5088 wrote to memory of 3780	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	92
PID 5088 wrote to memory of 3780	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	92
PID 5088 wrote to memory of 3780	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	92
PID 5088 wrote to memory of 3780	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	92
PID 5088 wrote to memory of 3840	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	93
PID 5088 wrote to memory of 3840	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	93
PID 5088 wrote to memory of 3840	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	93
PID 5088 wrote to memory of 3840	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	93
PID 5088 wrote to memory of 3840	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	93
PID 5088 wrote to memory of 3840	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	93
PID 5088 wrote to memory of 3840	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	93
PID 5088 wrote to memory of 3840	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	93
PID 5088 wrote to memory of 2396	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	94
PID 5088 wrote to memory of 2396	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	94
PID 5088 wrote to memory of 2396	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	94
PID 5088 wrote to memory of 2396	5088	2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3220
- C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:2656
- C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:4776
- C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3452
- C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:4904
- C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:2904
- C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3780
- C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3840
- C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:2396
- C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:1200
- C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:4860
- C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:3816
- C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 5KB
SHA256 1f2719b100fcc59601f0dbb286aea5034e05bae881425792a115106e244a0ed0
MD5 b10207f8ae69cd9d6daadda0c9d010ef
SHA1 fe195f301116e55b87e1924b93b2d2b906dc572e
SHA512 ff80b70243a5bfe50a3f52eab372042744f7722e22da4be6ed58849258a8cdf4972e654dad78b5d35aadd9e9f7cecee6cbbeb40acc87ef5d39f35438d8c369af
SSDEEP 96:05eywtHRbQ6aOfziJ2WP6s2vYYdn5+PuBttUU2js/OYXgvZ9hkJ4FLUHswb:2e9vIOoPX2vYa5qV1sSv3Resi
TLSH
T1CCC19E94E8F7DC4FD8639F3401AAF2255508E25F4423B71D7081A82B76E2B06330A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8AD687EEF26C5BA42176ECA5E00B1E27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8AD687EEF26C5BA42176ECA5E00B1E27
Size 309B
SHA256 d67e9e8ae1ede573635d7c9a91033545615130e1ceaa310de6ec07ded6dd6a53
MD5 987031e5dfc2bd2ddb5acbfb552d030d
SHA1 f49b5ee3c336f385b91de6db42647e59a457670f
SHA512 22adde18ee7be7e414f856e81b322a337d78de3d8526e0e42cba7f66f8d8bfcabe8f936a61c15f88212d440a110fe9f48c710ee2f6b3d9dc84ac0e3f3c203697
TLSH
T1A2E072D1B2EF1B8006F0F500CDA0C88B1CF8408A0A8FB0002844CBAE42CBFC2EB901CE
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 791735e52af30a1c6a750df3837784a34cfe763332e5b45acfd731ddaa159b83
MD5 937eade2963d309f04ad7c807ba17156
SHA1 b183c87c76481b1e153a6bdfdc71945a59542a84
SHA512 5760b7dcfdcb1f5cd481e3d3c183b9c21996542896c602a0bdb665420693d3c67d3cacf98a2e18e437e6f7abf9263e0a18501930e02dabf2d748f749351820c8
TLSH
T1FB31C14EA2103067D946BF72D9CF7E83CDB1324AB7CAC46B18445E4229AAFC25F840C5
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 529B
SHA256 39c727d70b8bdf5fc324233d0823555eb66ce846119609a22d1cebedbc3cf80c
MD5 f0102d5ebee72932834506783a39ffbf
SHA1 d6bf07be7cc02a713e0f8f94c124da8a15a016db
SHA512 621caa36ba48c567a850166b85b65474e96f860eca78fd1d3967e017f89a2c7919c6e6a21fef38136a5ae5ecfaade5b686be7476ba95253bfd023f71c0ce78a5
TLSH
T138F0C90C80182262CC04FF91CFD6AC93EC3A33427AD492031B444A420882F855FC16E9
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 8b1b65a31afa68148fe8c2b913f479e5070a907beb0693ad8f3101eb2bfcf7fa
MD5 2c187a3ae7507ffb46833cb0aac07d3f
SHA1 6fa79d295d41c19c1f2452d308e72632a5186449
SHA512 a3c25cfb1abaf02fb6676ebc9614f9ac3ec6082809f75c341b2a0718cd0dc30cc518ed7748e9b260834dc6c01baf2f7ef62cc42d5d6091f3c4418ad1aa6ad2d4
TLSH
T1AEE05EA27BE41615E5730B3CB9B3B1854A7BB66B7911CACD0334008D5D36F20C833B1A
MD5 SHA1 SHA512 TLSH

Submit Download

8AD687EEF26C5BA42176ECA5E00B1E27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8AD687EEF26C5BA42176ECA5E00B1E27
Size 192B
SHA256 f28b17b6541ce73abec3a1ee84e36983aebbdb761daf6ce9b047badf659bdea4
MD5 9fe3224af6996eb4c058064850001af9
SHA1 3d0be72b41afaf3737df266b0a1c7b39304a6117
SHA512 0103be37cd1b821e584e7c2d0d9b3900cdd8a245c10f5a047af77ae9a06bb5220caebd97e7cbce19a88555a8009715c88658241b45a2e0578d64cd14f0b9328c
TLSH
T12BC0920833296A19F224473E9CA6924186FDEA54C091835A93B0032CAA099821C34F2A
MD5 SHA1 SHA512 TLSH

Submit Download

8AD687EEF26C5BA42176ECA5E00B1E27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8AD687EEF26C5BA42176ECA5E00B1E27
Size 192B
SHA256 6f973a4c531e30ba43c8db4e5735c1bfdfa9ea2f11c03e05421a0f68952da4e9
MD5 c9552bb387d6331e27e7d5b8da0578fe
SHA1 3bc56ded2acafecd824e0c86ac36039cb0663a10
SHA512 6047a35c95814638f98cbbe98738eb060266a146905539bf005f005f552db48f28f981646413b7831e4db9295e2b6831d6dc2f0a94acb2bfb53ba40f8ad7aa0f
TLSH
T19BC0920437356608F220833E9CA6E20186F9EA50C091835A93B0033CAB49A821C30F26
MD5 SHA1 SHA512 TLSH

Submit Download

8AD687EEF26C5BA42176ECA5E00B1E27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8AD687EEF26C5BA42176ECA5E00B1E27
Size 192B
SHA256 4b54c131709a0f7b9ff2e5f5d7b95104aed248b6041c7b330e51c80c6dc7a2ab
MD5 4b2f8d698de3fba9bb8e6c51f57c48ed
SHA1 40ea242be3da954162a4b26aac743b7ffc9cec75
SHA512 1ce35fcb66fc66a32cb4c1215585af8a0428814bcb4564b25c372233e467560d4fe406e61906f21483bd2a19b16df4180b8fb67eb748a25a42985dc0e252c982
TLSH
T1A7C04C1436365509F230433E9DA6F6119AF99654C54183675BB1133CAE4CE451C30E65
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 da44c7f63a5ac1af7d284f9d710ba8a682de7a39bc040ff4ff23a207c12a1b67
MD5 8468a6f76dc7dfa7b891032f7612f4c5
SHA1 220076dbdf0f9ccff07032d2df643ccaa52c7118
SHA512 0240ff799cf71e28b4b37dde3e490b8b7357abc0ce6f17049f9dee1b02578c42cc31b2bea0f1b6e3cd73f3415f3471dd5aa42699f3d5795b405974501c874f58
TLSH
T194C09B447771161DF465157F555241105FF7D114DF9A83049F701136551C945E8B7E09
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 9ddef465f6fb2ec8b15b35440371f69dec3f098d6d0ac6783558204f8bcb99cf
MD5 d5c60822a337d0e6464ae526ed328748
SHA1 fc6f88ec5b0d380358c808d821e0fffa9e521482
SHA512 a5370db1633d29121fb4a6ef1a37b91a2d7ad6fd40d8affcab776f1583ea845415250059fba6cfa5a20c6546d88975e33a8f02799b83256c18385d07df14e5dd
TLSH
T117C012847B71171CF021257F585383000FF5D200D9E2C304457021299569D42DCF9E0E
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 ba65e4fed440e23f0e6c07392f828bf591986749e75a64e2a870c1a6b8be274b
MD5 4d6794f356c7c4ba0724e2dccc6e5fc1
SHA1 0fb3f88d4bc6e626d762a995bee97c68b0f3a7b9
SHA512 2e9cc4b23b1a7bbc497a6c3fd95983143a2fdae33ddf93f2e2e2cfe4b2d445663adb291dcd4c8449d599f46f1e2b5378f47e7c10de80d3d8e02166cb7ab77dc7
TLSH
T18EC09B6473528197F195013F0DE5571597FA9550F647C30006744175465C7910876D41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1200-147-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/1200-52-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/1200-53-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/1200-56-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/1200-55-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/1200-54-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/2100-65-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/2100-66-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/2100-63-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/2100-145-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/2100-64-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/2100-62-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/2396-82-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2396-49-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2656-12-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2656-8-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2656-9-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2656-10-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2904-30-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2904-39-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2904-29-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3220-2-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3220-11-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3220-5-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3220-144-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3220-1-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3220-3-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3220-4-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3220-6-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3220-7-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3452-17-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3452-22-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3452-18-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3452-24-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3452-21-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3452-20-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3452-143-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3452-19-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3780-35-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3780-36-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3780-40-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3780-148-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3780-34-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3780-37-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3780-33-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3780-32-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3816-60-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3816-69-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3840-42-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3840-44-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3840-45-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3840-46-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3840-47-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3840-50-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3840-43-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/3840-149-0x0000000140000000-0x0000000140066000-memory.dmp

Download

memory/4776-23-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4776-15-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4776-14-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4860-58-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4860-68-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4904-26-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4904-38-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4904-27-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5088-142-0x0000000140000000-0x000000014042F000-memory.dmp

Download

memory/5088-0-0x0000000140000000-0x000000014042F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads