b3b96ee89e6e46929bf95c31ffd4018e7ed373b783fdffcb29ed7b410dc4bb65

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_898704150587c832aac331cede7ca450_cobalt-strike_icedid_njrat.exe
Size 240KB
Sample260710-fxpldaex7y
SHA256 b3b96ee89e6e46929bf95c31ffd4018e7ed373b783fdffcb29ed7b410dc4bb65
MD5 898704150587c832aac331cede7ca450
SHA1 e91025cbf9aeed41b60e6d07d854992e8612b57d
SHA512 3c4344c08e8a78d1be7f4f349bc19b51370fdfcb52fa469e20693ee5b853d8a24bec285a31c9fb398ecf4264eec469d252afcd7494cb92127a4e917c6a079da4
SSDEEP 6144:0YFKw41l5m5cLQru++++Ev4aecohOuandc+P1:nFKwCm5cMH/hUandc
TLSH
T1F1345B5BB3E530F9E1B7867885910646E772B83517205FEF03A4426A2F272D09E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1360	ngensvc.exe
6024	ngensvc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\PawSvc46 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngensvc.exe"	ngensvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\PawSvc62 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngensvc.exe"	ngensvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3468	schtasks.exe
1264	schtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5768 wrote to memory of 1360	5768	2026-07-10_898704150587c832aac331cede7ca450_cobalt-strike_icedid_njrat.exe	86
PID 1360 wrote to memory of 3468	1360	ngensvc.exe	87
PID 6024 wrote to memory of 1264	6024	ngensvc.exe	91
PID 5768 wrote to memory of 3732	5768	2026-07-10_898704150587c832aac331cede7ca450_cobalt-strike_icedid_njrat.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-10_898704150587c832aac331cede7ca450_cobalt-strike_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_898704150587c832aac331cede7ca450_cobalt-strike_icedid_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5768
- C:\Users\Admin\AppData\Local\Temp\ngensvc.exe
  "C:\Users\Admin\AppData\Local\Temp\ngensvc.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn "PawSvc_0E597DF0" /tr "C:\Users\Admin\AppData\Local\Temp\ngensvc.exe" /sc minute /mo 60 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
  2⤵
  PID:3732

C:\Users\Admin\AppData\Local\Temp\ngensvc.exe
C:\Users\Admin\AppData\Local\Temp\ngensvc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:6024
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "PawSvc_0E5981E8" /tr "C:\Users\Admin\AppData\Local\Temp\ngensvc.exe" /sc minute /mo 60 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del.bat

Path C:\Users\Admin\AppData\Local\Temp\del.bat
Size 297B
SHA256 8fc7b7d3290226618e56a6d99b2d629db572e11c54e472cc233b6ba78ba33572
MD5 4c1aa46d983f6996a318dddcd709e911
SHA1 8cbabafd1dbe5f48eba975d3ca0d71bd47004bac
SHA512 6624b0c948512562e9adba9be53c2c48fb14b2456065dd538164aa7916fc9938ab2d80dfe05715f60f51ff623dd84c5aec150199b9ed68ae170adb0f33d0c949
TLSH
T161E0C21A814ACFCC042234E903A31EE8D55260E61F84B7C0D3C2D10926D924DE551B56
MD5 SHA1 SHA512 TLSH

Submit Download

ngensvc.exe

Path C:\Users\Admin\AppData\Local\Temp\ngensvc.exe
Size 139KB
SHA256 117671135b6da989135e04a961a71198668c803b258a5f6c10852de478095b32
MD5 95455716e239935b53da97d4c1cbaf53
SHA1 ee3ce553ad5fe24a562de27f8c78dfa5fb60701e
SHA512 677542852f7f031bab4855a67ca2edbc756c20206fd2577b7a81938456f383253870e6d1bb9b7ec36c5fdc7b78c008b8881aaaab813fdc32fa52d8fc04551f08
SSDEEP 3072:glXl1Z4Qg8eyVoI7/qsajOM5an1rcsTfP7P6I:k4aecohOuandc+P1
TLSH
T1F5D35C57B3A631F9E1B7823889A10606F77278355B605BEF03A443752F276D09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads