Analysis
- max time kernel
149s - max time network
145s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
22/05/2026, 03:18
General
- Target 2026-05-22_77304c368f264021ef264b98938bf4db_icedid_njrat_ryuk.exe
- Size 963KB
- Sample260522-dttptads8m
- SHA256 527cef6dd875a5beda550e529a7d05388a1ead563308aa7a7656ed5a27c1c707
Malware Config
Signatures
- Executes dropped EXE 7 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 7 IoCs
- Drops file in Program Files directory 64 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_77304c368f264021ef264b98938bf4db_icedid_njrat_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_77304c368f264021ef264b98938bf4db_icedid_njrat_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
DiagnosticsHub.StandardCollector.Service.exe
FXSSVC.exe
alg.exe
AppVClient.exe
memory/1200-51-0x000002040DDD0000-0x000002040DE36000-memory.dmp
memory/1200-50-0x000002040DDD0000-0x000002040DE36000-memory.dmp
memory/1200-49-0x000002040DB60000-0x000002040DCA8000-memory.dmp
memory/1716-37-0x00007FF750190000-0x00007FF75041B000-memory.dmp
memory/1716-46-0x00007FF750190000-0x00007FF75041B000-memory.dmp
memory/1716-44-0x0000023E61750000-0x0000023E617B6000-memory.dmp
memory/1716-40-0x0000023E61750000-0x0000023E617B6000-memory.dmp
memory/1716-38-0x0000023E61750000-0x0000023E617B6000-memory.dmp
memory/1740-66-0x000002308E550000-0x000002308E5B6000-memory.dmp
memory/1740-74-0x00007FF7ACC90000-0x00007FF7ACDF8000-memory.dmp
memory/1740-72-0x000002308E550000-0x000002308E5B6000-memory.dmp
memory/1740-67-0x000002308E550000-0x000002308E5B6000-memory.dmp
memory/1740-65-0x00007FF7ACC90000-0x00007FF7ACDF8000-memory.dmp
memory/2028-3-0x00000110D8970000-0x00000110D89D6000-memory.dmp
memory/2028-34-0x00000110D8970000-0x00000110D89D6000-memory.dmp
memory/2028-1-0x00000110D8970000-0x00000110D89D6000-memory.dmp
memory/2028-33-0x00007FF614730000-0x00007FF61491F000-memory.dmp
memory/2028-0-0x00007FF614730000-0x00007FF61491F000-memory.dmp
memory/2084-14-0x0000018E7F120000-0x0000018E7F186000-memory.dmp
memory/2084-11-0x00007FF6F9430000-0x00007FF6F9517000-memory.dmp
memory/2084-83-0x00007FF6F9430000-0x00007FF6F9517000-memory.dmp
memory/2084-12-0x0000018E7F120000-0x0000018E7F186000-memory.dmp
memory/2156-77-0x0000020B3AB40000-0x0000020B3AC88000-memory.dmp
memory/2156-78-0x0000020B3ADB0000-0x0000020B3AE16000-memory.dmp
memory/2156-79-0x0000020B3ADB0000-0x0000020B3AE16000-memory.dmp
memory/3352-57-0x000001CCC3910000-0x000001CCC3A58000-memory.dmp
memory/3352-59-0x000001CCC3B80000-0x000001CCC3BE6000-memory.dmp
memory/3352-58-0x000001CCC3B80000-0x000001CCC3BE6000-memory.dmp
memory/4136-22-0x00007FF73D5D0000-0x00007FF73D6B7000-memory.dmp
memory/4136-23-0x0000026D0A930000-0x0000026D0A996000-memory.dmp
memory/4136-25-0x0000026D0A930000-0x0000026D0A996000-memory.dmp
memory/4136-88-0x00007FF73D5D0000-0x00007FF73D6B7000-memory.dmp