c3b71f6f7955675f09d5e53c1df0a450d7a0a32c363dff624ee531ffc3f4addc

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_47d9184ca36abd28998d672835960451_icedid_njrat_stealc.exe
Size 2.8MB
Sample260704-mmfn2set2y
SHA256 c3b71f6f7955675f09d5e53c1df0a450d7a0a32c363dff624ee531ffc3f4addc
MD5 47d9184ca36abd28998d672835960451
SHA1 55f88207bbbd53bd040db32371ec56840b63cf25
SHA512 741e111cb0d07e3ba8408ed9b3c0796566480b0fc17b02d333df0c3e9e93eef77dc30db0f8b1312456271e32ab3cf3cda60fffd644a15fd79e55512bd09ececd
SSDEEP 49152:uvLZ3dAM/bXiqevF2ewOBB7N5hqT9nppQ9+aLy1wTm:cGFYaN2Te9HywT
TLSH
T1C3D5C007A7B800F8C0A7C178C9065917EBB2784517759BDB16D089EA6F23FE25B7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
2	discord.com

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5180 wrote to memory of 6068	5180	2026-07-04_47d9184ca36abd28998d672835960451_icedid_njrat_stealc.exe	90
PID 5180 wrote to memory of 6068	5180	2026-07-04_47d9184ca36abd28998d672835960451_icedid_njrat_stealc.exe	90
PID 5180 wrote to memory of 1716	5180	2026-07-04_47d9184ca36abd28998d672835960451_icedid_njrat_stealc.exe	93
PID 5180 wrote to memory of 1716	5180	2026-07-04_47d9184ca36abd28998d672835960451_icedid_njrat_stealc.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-04_47d9184ca36abd28998d672835960451_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_47d9184ca36abd28998d672835960451_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_output\Chrome\Default\cookies.json
Size 396B
SHA256 01003de318e660f240f152bcc0c76e298d421931c26c12f3d3f39298c7136988
MD5 ffdfc6a67a031f33ab2750702327cd20
SHA1 06bc12dcd8258a4d60269a3061d66287e62b65d9
SHA512 2f9299e778211a0ff1f41038c2c35a0872fc8e3256e2a6a899765455f1254c09290e403083c423a79efcf2e766db06313decff68a0a33de9d5cca4fd0a13314f
TLSH
T1A4E0AB8B69611C399D02F0B868822C580B350B86004DFD8486A8D94A67EC8C92207CC6
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_output\Chrome\Default\cookies.txt
Size 253B
SHA256 be6e6766d1de2e1ae70a4727e3091edc399a0f03cc373139ba77e57e9ac71e08
MD5 c21f8c6913837b2f9139bac76cde791d
SHA1 a082af5fc16487c9b2283aa0be8427b5ba69f94b
SHA512 d8071d0f37ddfa8d37ab08a9b454024409531bfe462075d3304d212712df5ffce7abf4497cc5a1fb711e67a4c71a7fcd59db5c3441252519ec7112d4d8524d1f
TLSH
T1ACD095477EB10D84350AF4B829D70C650E330FC8002AF7C4175C565777BD8C97547A41
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_output\Edge\Default\cookies.json
Size 409B
SHA256 60bcf3b3515572525d37083e76c369fb7f7f7cff2938e439be9cef03072cb17a
MD5 a0361f67f3443c622a357425d9b6597f
SHA1 a377a8bdcf310ab93001f7654a0b742afea2916a
SHA512 d7451eefa74268e85b7f37f0d2fe42b420a4c8be0c3011d58412f119ac59d94d5b66df5edcbf1552a33937313aaf8957798463dd00071d53002575ab378233b2
TLSH
T134E0AB550A16B83B9B05B5E30904A688F3BC11170884FC58DABDE44CB8F72A8211FCDA
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_output\Edge\Default\cookies.txt
Size 255B
SHA256 dabf6a016b044a49c6ffa387041fc008b055145f9b42bc9bdb784630f8764f1f
MD5 e990cb76033baddf2595f58c7f1959c5
SHA1 1496e0271b5669cf0b1352c0b775f0854f5bb180
SHA512 f6b246fd533db6dc0985a5e3a8bb87c47a00acf2e1e6de8d652c3989d924d77cab8ec5df8bb1d47dc578a2d0aab4c171a2ab9165ef4ed0438956ecc4da4f34a1
TLSH
T167D02B014F46E6972628B4A30614A25077DD1015454594581A7DF048B4A7159284E8E5
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads