Analysis
- max time kernel
3s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 03:47
General
- Target 2026-08-01_fbbb22b96845db8d90f0585674975319_icedid.exe
- Size 2.6MB
- Sample260802-ech3esteqb
- SHA256 80d47bb6d8de56c244cfbcbeda4d24b3003682dc2c539a20c93b93603e77c890
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_fbbb22b96845db8d90f0585674975319_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_fbbb22b96845db8d90f0585674975319_icedid.exe"1⤵
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E597B5D.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_fbbb22b96845db8d90f0585674975319_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_fbbb22b96845db8d90f0585674975319_icedid.exe" --msvc-svc-worker 40842⤵
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
~st0E597B5D.xml
memory/4084-18-0x00000200C4970000-0x00000200C4971000-memory.dmp
memory/4084-21-0x00000200C49B0000-0x00000200C49B1000-memory.dmp
memory/4084-20-0x00000200C49A0000-0x00000200C49A1000-memory.dmp
memory/4084-19-0x00000200C4990000-0x00000200C4991000-memory.dmp
memory/4084-17-0x00000200C4960000-0x00000200C4961000-memory.dmp
memory/4084-14-0x00000200C4930000-0x00000200C4931000-memory.dmp
memory/4084-15-0x00000200C4940000-0x00000200C4941000-memory.dmp
memory/4084-12-0x00000200C4910000-0x00000200C4911000-memory.dmp
memory/4084-11-0x00000200C48F0000-0x00000200C48F1000-memory.dmp
memory/4084-22-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4084-10-0x00000200C48E0000-0x00000200C48E1000-memory.dmp
memory/4084-33-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4084-47-0x00000200C49C0000-0x00000200C49E0000-memory.dmp
memory/4084-44-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4084-41-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4084-40-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4084-38-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4084-37-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4084-8-0x00000200C48C0000-0x00000200C48C1000-memory.dmp
memory/4084-7-0x00000200C48B0000-0x00000200C48B1000-memory.dmp
memory/4084-4-0x00000200C4880000-0x00000200C4881000-memory.dmp
memory/4084-3-0x00000200C4870000-0x00000200C4871000-memory.dmp
memory/4084-45-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4084-43-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4084-49-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4084-42-0x0000000140000000-0x0000000140A00000-memory.dmp
memory/4084-39-0x0000000140000000-0x0000000140A00000-memory.dmp