Analysis
- max time kernel
10s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/08/2026, 03:47
General
- Target 2026-08-01_fbbb22b96845db8d90f0585674975319_icedid.exe
- Size 2.6MB
- Sample260802-ech3esteqb
- SHA256 80d47bb6d8de56c244cfbcbeda4d24b3003682dc2c539a20c93b93603e77c890
Malware Config
Signatures
- Detects executables referencing many IR and analysis tools 10 IoCs
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_fbbb22b96845db8d90f0585674975319_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_fbbb22b96845db8d90f0585674975319_icedid.exe"1⤵
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E581AC0.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_fbbb22b96845db8d90f0585674975319_icedid.exeC:\Users\Admin\AppData\Local\Temp\2026-08-01_fbbb22b96845db8d90f0585674975319_icedid.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
~st0E581AC0.xml
memory/4120-3-0x000001E52EE40000-0x000001E52EE41000-memory.dmp
memory/4120-13-0x000001E52EFF0000-0x000001E52EFF1000-memory.dmp
memory/4120-18-0x000001E52F040000-0x000001E52F041000-memory.dmp
memory/4120-17-0x000001E52F030000-0x000001E52F031000-memory.dmp
memory/4120-16-0x000001E52F020000-0x000001E52F021000-memory.dmp
memory/4120-15-0x000001E52F010000-0x000001E52F011000-memory.dmp
memory/4120-14-0x000001E52F000000-0x000001E52F001000-memory.dmp
memory/4120-12-0x000001E52EFE0000-0x000001E52EFE1000-memory.dmp
memory/4120-11-0x000001E52EFD0000-0x000001E52EFD1000-memory.dmp
memory/4120-10-0x000001E52EFC0000-0x000001E52EFC1000-memory.dmp
memory/4120-9-0x000001E52EFB0000-0x000001E52EFB1000-memory.dmp
memory/4120-8-0x000001E52EFA0000-0x000001E52EFA1000-memory.dmp
memory/4120-7-0x000001E52EE80000-0x000001E52EE81000-memory.dmp
memory/4120-6-0x000001E52EE70000-0x000001E52EE71000-memory.dmp
memory/4120-5-0x000001E52EE60000-0x000001E52EE61000-memory.dmp
memory/4120-4-0x000001E52EE50000-0x000001E52EE51000-memory.dmp
memory/4120-23-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4120-22-0x000001E52F090000-0x000001E52F091000-memory.dmp
memory/4120-21-0x000001E52F080000-0x000001E52F081000-memory.dmp
memory/4120-40-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4120-42-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4120-41-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4120-39-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4120-38-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4120-36-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4120-35-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4120-37-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4120-34-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4120-20-0x000001E52F070000-0x000001E52F071000-memory.dmp
memory/4120-19-0x000001E52F050000-0x000001E52F051000-memory.dmp
memory/4120-44-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4120-45-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4120-49-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4120-52-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4120-53-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4120-55-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4120-54-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4120-51-0x0000000140000000-0x0000000140A00000-memory.dmp