Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/11/2026, 16:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
- Size 4.1MB
- Sample261114-vba87afv2m
- SHA256 6d5daea97acf82f1f388271e08403d1400faee4273033f280232e480c4b31a2c
- MD5 2e820f0b6ca1dd282017f415fcec3f6e
- SHA1 375075a0de8f0dd80f72ad19ac18caebc7aa8777
- SHA512 ab83790f9932e2b5b77e734708966bc2f57555c0cddb0b729d80e8552a95f27252a74dc0bf7daa18063b50645ff5e3622be93d83e07d6d5d4f10ab3697c4f23c
- SSDEEP 49152:z9cNEp1M3oN47m5YSSFYkOqOhlVt9256vPNU9z6Km1wfMIMAMNMoMkM:q7jeXLKu
- TLSH T1CF16BF5FA7A401E8D16BD078CF455943E7B2B41A03A1A7EF259086A70F776F40E3E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 8 IoCs
resource yara_rule behavioral2/memory/3108-18-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/6088-26-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/4100-23-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/2964-21-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/2968-20-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/6048-14-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/4560-12-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/3108-3-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat - Suspicious use of SetThreadContext 13 IoCs
description pid Process procid_target PID 448 set thread context of 4172 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 92 PID 448 set thread context of 2276 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 93 PID 448 set thread context of 3108 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 94 PID 448 set thread context of 2908 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 95 PID 448 set thread context of 2964 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 96 PID 448 set thread context of 956 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 97 PID 448 set thread context of 2968 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 98 PID 448 set thread context of 1404 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 99 PID 448 set thread context of 4560 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 101 PID 448 set thread context of 6048 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 100 PID 448 set thread context of 6088 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 102 PID 448 set thread context of 4100 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 103 PID 448 set thread context of 3432 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 104 - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 448 wrote to memory of 4172 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 92 PID 448 wrote to memory of 4172 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 92 PID 448 wrote to memory of 4172 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 92 PID 448 wrote to memory of 4172 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 92 PID 448 wrote to memory of 4172 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 92 PID 448 wrote to memory of 4172 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 92 PID 448 wrote to memory of 4172 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 92 PID 448 wrote to memory of 4172 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 92 PID 448 wrote to memory of 2276 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 93 PID 448 wrote to memory of 2276 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 93 PID 448 wrote to memory of 2276 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 93 PID 448 wrote to memory of 2276 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 93 PID 448 wrote to memory of 2276 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 93 PID 448 wrote to memory of 2276 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 93 PID 448 wrote to memory of 2276 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 93 PID 448 wrote to memory of 2276 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 93 PID 448 wrote to memory of 3108 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 94 PID 448 wrote to memory of 3108 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 94 PID 448 wrote to memory of 3108 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 94 PID 448 wrote to memory of 3108 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 94 PID 448 wrote to memory of 3108 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 94 PID 448 wrote to memory of 3108 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 94 PID 448 wrote to memory of 3108 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 94 PID 448 wrote to memory of 2908 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 95 PID 448 wrote to memory of 2908 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 95 PID 448 wrote to memory of 2908 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 95 PID 448 wrote to memory of 2908 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 95 PID 448 wrote to memory of 2908 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 95 PID 448 wrote to memory of 2908 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 95 PID 448 wrote to memory of 2908 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 95 PID 448 wrote to memory of 2908 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 95 PID 448 wrote to memory of 2964 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 96 PID 448 wrote to memory of 2964 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 96 PID 448 wrote to memory of 2964 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 96 PID 448 wrote to memory of 2964 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 96 PID 448 wrote to memory of 2964 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 96 PID 448 wrote to memory of 2964 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 96 PID 448 wrote to memory of 2964 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 96 PID 448 wrote to memory of 2968 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 98 PID 448 wrote to memory of 2968 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 98 PID 448 wrote to memory of 2968 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 98 PID 448 wrote to memory of 2968 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 98 PID 448 wrote to memory of 2968 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 98 PID 448 wrote to memory of 2968 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 98 PID 448 wrote to memory of 2968 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 98 PID 448 wrote to memory of 956 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 97 PID 448 wrote to memory of 956 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 97 PID 448 wrote to memory of 956 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 97 PID 448 wrote to memory of 956 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 97 PID 448 wrote to memory of 956 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 97 PID 448 wrote to memory of 956 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 97 PID 448 wrote to memory of 956 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 97 PID 448 wrote to memory of 956 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 97 PID 448 wrote to memory of 4560 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 101 PID 448 wrote to memory of 1404 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 99 PID 448 wrote to memory of 4560 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 101 PID 448 wrote to memory of 4560 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 101 PID 448 wrote to memory of 4560 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 101 PID 448 wrote to memory of 4560 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 101 PID 448 wrote to memory of 1404 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 99 PID 448 wrote to memory of 4560 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 101 PID 448 wrote to memory of 4560 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 101 PID 448 wrote to memory of 1404 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 99 PID 448 wrote to memory of 1404 448 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"2⤵PID:4172
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"2⤵PID:2276
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"2⤵PID:3108
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"2⤵PID:2908
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"2⤵PID:2964
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"2⤵PID:956
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"2⤵PID:2968
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"2⤵PID:1404
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"2⤵PID:6048
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"2⤵PID:4560
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"2⤵PID:6088
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"2⤵PID:4100
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe"2⤵PID:3432
-