eda448c4a1d8599c16c4158b134892f18bb358483556b3a433f2f66e0f81489f

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Size 1.3MB
Sample260723-3rvxjaygmb
SHA256 eda448c4a1d8599c16c4158b134892f18bb358483556b3a433f2f66e0f81489f
MD5 e3fa35971ded11156d10062cdc00e733
SHA1 ae5d2fc0171b79d711fd54f6b6574a1c31b03bdb
SHA512 d96a86a069dc163a785ab185e309aca22fc7a07e18146db0d5ac67ac18a901bc2ebc057d93ac959bc350c51c9a640c64195185d85bfe0ff46b686c6adbe46577
SSDEEP 12288:oKrc92qnttwK8zwbD+/7pGQGypBAF2B28ZADNzX+nythYX2b:bDqnttwK7e/dG7ypBAFs0xXoNX
TLSH
T1EC558C2BABA511C1D0BBC13DD9925A1FFDB1741643705BCB02D58A9A1B23FE8AE3D701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1"	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning = "1"	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3452 created 1480	3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe	120

Windows security bypass 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\KasperskyLab	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	api.ipify.org
17	ipapi.co
1	api.ipify.org
1	ipapi.co

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Token: SeIncreaseQuotaPrivilege	3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Token: SeTcbPrivilege	3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Token: SeImpersonatePrivilege	3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Token: SeLoadDriverPrivilege	3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Token: SeSecurityPrivilege	3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Token: SeBackupPrivilege	3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Token: SeRestorePrivilege	3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
Token: SeTakeOwnershipPrivilege	3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 1204	3452	2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_e3fa35971ded11156d10062cdc00e733_cobalt-strike_icedid_njrat.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
- Windows security modification
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:424
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:3372
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:4960
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:4552
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:2976
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:4332
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:4660
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:5708
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:4924
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:4152
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:1864
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:4104
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:952
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:3760
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:5816
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:5580
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:5388
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:936
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:1364
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:2456
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:4684
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:5728
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:2416
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:2744
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:4488
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:5684
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:5312
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:2704
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:5080
- \??\c:\windows\system32\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:5680
- \??\c:\windows\system32\computerdefaults.exe
  c:\windows\system32\computerdefaults.exe
  2⤵
  PID:1480
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe
    3⤵
    PID:1204