Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 03:10
General
- Target 2026-06-02_01c9cc772b4f1eab38e87db21fc389e9_icedid_njrat.exe
- Size 6.4MB
- Sample260602-dpgvfsdy9n
- SHA256 e57f7b325819e57a222f29389b8902ed687c779f97a6409e268d5a419ccc61be
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
- Executes dropped EXE 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_01c9cc772b4f1eab38e87db21fc389e9_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_01c9cc772b4f1eab38e87db21fc389e9_icedid_njrat.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\jCrz1AD.exe"C:\Program Files\jCrz1AD.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\6zrFj.exe"C:\Program Files\6zrFj.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
jCrz1AD.exe
memory/3580-37-0x0000000180000000-0x00000001806C1000-memory.dmp
memory/3580-43-0x0000000180000000-0x00000001806C1000-memory.dmp
memory/3580-49-0x0000000180000000-0x00000001806C1000-memory.dmp
memory/3580-50-0x0000000180000000-0x00000001806C1000-memory.dmp
memory/3580-51-0x0000000180000000-0x00000001806C1000-memory.dmp
memory/3580-46-0x0000000180000000-0x00000001806C1000-memory.dmp
memory/3580-45-0x0000000180000000-0x00000001806C1000-memory.dmp
memory/3580-39-0x0000000180000000-0x00000001806C1000-memory.dmp
memory/3580-41-0x0000000180000000-0x00000001806C1000-memory.dmp
memory/3580-31-0x0000000180000000-0x00000001806C1000-memory.dmp
memory/3580-34-0x0000000180000000-0x00000001806C1000-memory.dmp
memory/3580-35-0x0000000180000000-0x00000001806C1000-memory.dmp
memory/3580-29-0x0000000180000000-0x00000001806C1000-memory.dmp
memory/3580-26-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/3580-30-0x0000000180000000-0x00000001806C1000-memory.dmp
memory/3580-27-0x0000000180000000-0x00000001806C1000-memory.dmp
memory/3700-0-0x0000000140033000-0x00000001401FD000-memory.dmp
memory/3700-2-0x0000000140000000-0x0000000141157000-memory.dmp
memory/3700-1-0x00007FFF92AB0000-0x00007FFF92AB2000-memory.dmp
memory/3700-10-0x0000000140033000-0x00000001401FD000-memory.dmp
memory/5272-18-0x0000000180000000-0x00000001808EA000-memory.dmp
memory/5272-38-0x0000000180000000-0x00000001808EA000-memory.dmp
memory/5272-15-0x0000000180000000-0x00000001808EA000-memory.dmp
memory/5272-19-0x0000000180000000-0x00000001808EA000-memory.dmp
memory/5272-14-0x0000000180000000-0x00000001808EA000-memory.dmp
memory/5272-16-0x0000000180000000-0x00000001808EA000-memory.dmp
memory/5272-11-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/5272-13-0x0000000180000000-0x00000001808EA000-memory.dmp
memory/5272-7-0x000001F1E3CD0000-0x000001F1E3CD1000-memory.dmp
memory/5272-12-0x0000000180000000-0x00000001808EA000-memory.dmp