22f19427ba381bee79d8c5fabbddbd0846a9599e25a8faef83eb344c0f797358

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 10:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_3f2c62eb848a8a51b91e1b26f54996e8_icedid_njrat_stealc.exe
Size 2.8MB
Sample260703-l77gtsfs21
SHA256 22f19427ba381bee79d8c5fabbddbd0846a9599e25a8faef83eb344c0f797358
MD5 3f2c62eb848a8a51b91e1b26f54996e8
SHA1 583d68d1bcde2347b1651f7270d335ea756263d0
SHA512 249da46ee5460b8038f2dbaf1f488cdf4670fb721d53b91bac3c93e34cd23a37fbf394ba3b2c304af9bc1274378eb1edbb3cd31eb48458c64a4109044996050f
SSDEEP 49152:YvLZ3dAM/bXiqevF2ewOBlQvptO0ApCnGhpU1LdhIf+03:WGFYFHGh0r2
TLSH
T155D5C057A3B800F8C0A7C178CA465517EAB2780507759BDB16D086EA6F23FE25B7E730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	discord.com
7	discord.com

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 4496	2220	2026-07-03_3f2c62eb848a8a51b91e1b26f54996e8_icedid_njrat_stealc.exe	86
PID 2220 wrote to memory of 4496	2220	2026-07-03_3f2c62eb848a8a51b91e1b26f54996e8_icedid_njrat_stealc.exe	86
PID 2220 wrote to memory of 560	2220	2026-07-03_3f2c62eb848a8a51b91e1b26f54996e8_icedid_njrat_stealc.exe	89
PID 2220 wrote to memory of 560	2220	2026-07-03_3f2c62eb848a8a51b91e1b26f54996e8_icedid_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-03_3f2c62eb848a8a51b91e1b26f54996e8_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_3f2c62eb848a8a51b91e1b26f54996e8_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_output\Chrome\Default\cookies.json
Size 395B
SHA256 4dc4ac378a7f5deea82b9d3ae1deece5d4a4a6686611c4c7bfe941d346132ca6
MD5 8ee99a187b194b83509f3d3278de6cf4
SHA1 0378880cba1fc87aa7c6a92ecf5a2efc0c6ffeb5
SHA512 9cac94d3a75ad0b023fe0383d6c09c4cdfd07b0ad2b480f399aed7d07daa88a4a96489bd683c3d72fe2aa6fb831a6a9231ac36b34328add8e2439c83d0cf8645
TLSH
T1DAE0F1CF34546D35CE02D148DC30209D8B7802B7265CDC37C089C9A8B0D16E571114C7
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_output\Chrome\Default\cookies.txt
Size 252B
SHA256 77fa85b1175a13a28d134ee955e120c62a0c80c1fdc00b39bfa44781c0d1e5ca
MD5 80fa440679bea340629cfc3672217979
SHA1 25179fe5e0a9660efeca4a19483c6e017337c441
SHA512 6fab5b8d220ed8d9fc54714d1ad36c85e09bab0b699bfe5abb1ff8ea82c0f33d659498d1134f0dd61f2c6420b200713c67ab9c776f4e58c334aae2037cf67db7
TLSH
T1C7D0954775D5DB509E14D5445871106A8A7001FF1636C677510856F471C17E570100F3
MD5 SHA1 SHA512 TLSH