d44766a1eebfcb2a545bd72b5eafaca30df01b752d65809a119fb54e37e409e6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_eff523fdde3f44a355b7acceacbaa2b2_icedid_njrat.exe
Size 2.7MB
Sample260730-hf5mdaseqa
SHA256 d44766a1eebfcb2a545bd72b5eafaca30df01b752d65809a119fb54e37e409e6
MD5 eff523fdde3f44a355b7acceacbaa2b2
SHA1 b0934269cf6c7b7faa37e18b8b45c7db1380832b
SHA512 5f77f0706fafb46e7a62c6e8be2df5217dd82f2de3ddfe337a05107b788e55dc0172bba834f632a48b851a7404c955b75887e1d1144bc521a0052614c36dda1a
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90c:AXRE5hpVGh5Rj+bkVexGRuc
TLSH
T10CD5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution

Malware Config

Signatures

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
behavioral1/files/0x000f0000000231e5-4.dat	INDICATOR_SUSPICIOUS_ClearWinLogs

Executes dropped EXE 1 IoCs

pid	Process
2092	msedge.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4928	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4928	cmd.exe
6100	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6100	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3244	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2092	3048	2026-07-30_eff523fdde3f44a355b7acceacbaa2b2_icedid_njrat.exe	86
PID 3048 wrote to memory of 4928	3048	2026-07-30_eff523fdde3f44a355b7acceacbaa2b2_icedid_njrat.exe	87
PID 4928 wrote to memory of 6100	4928	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_eff523fdde3f44a355b7acceacbaa2b2_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_eff523fdde3f44a355b7acceacbaa2b2_icedid_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\msedge.exe
  "C:\Users\Admin\AppData\Local\Temp\msedge.exe" --randomized
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping localhost -n 2 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-07-30_eff523fdde3f44a355b7acceacbaa2b2_icedid_njrat.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge.exe

Path C:\Users\Admin\AppData\Local\Temp\msedge.exe
Size 2.7MB
SHA256 e165aa584c2382878f775faf69bdc0541888b8806b17574177ac5e87b24a917d
MD5 d164a3cd5face0afeda637b9ad3b351c
SHA1 025c56b93e2a29331c836c386d43e68a67e5b4ca
SHA512 cb003899cf334013286a7ef2f1219fa98f1bb162466147311c2c08a93b3c6317e1b19b9851f688f8971cd8b0b733ad36d06c3431c03ee461812de4aa40b20da2
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90D:AXRE5hpVGh5Rj+bkVexGRuD
TLSH
T17AD5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3244-5-0x00000000031C0000-0x00000000031C1000-memory.dmp

Download