2722ecca9a74821d7c1d7bbe1b4e32f2af6461500df82511d21c6b2667a09fb5

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 07:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_3b25afcbdfcd8e52140eb4d12a750dd4_icedid.exe
Size 27.5MB
Sample260805-jrmrdafh98
SHA256 2722ecca9a74821d7c1d7bbe1b4e32f2af6461500df82511d21c6b2667a09fb5
MD5 3b25afcbdfcd8e52140eb4d12a750dd4
SHA1 add951afd019c5c2fc771c176add1925f96bc8f7
SHA512 993f3e59b5320ca0ef552950ebc9c29b182731fe3655e23e216f2c900c297d33975df9eea818a5f9fb402dd7473855da41a3002c8dec4d2feca663031320db70
SSDEEP 12288:iG+ednu444444444444444444444444444444444444444444444444444444447:ikM
TLSH
T1A3574BE8E6F56085D1D866EF2C6F41B45103F072CD48829B8972712742E9B9FF8227F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 3248	964	2026-08-05_3b25afcbdfcd8e52140eb4d12a750dd4_icedid.exe	89
PID 5104 wrote to memory of 3288	5104	2026-08-05_3b25afcbdfcd8e52140eb4d12a750dd4_icedid.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-05_3b25afcbdfcd8e52140eb4d12a750dd4_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_3b25afcbdfcd8e52140eb4d12a750dd4_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Users\Admin\AppData\Local\Temp\2026-08-05_3b25afcbdfcd8e52140eb4d12a750dd4_icedid.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_3b25afcbdfcd8e52140eb4d12a750dd4_icedid.exe"
  2⤵
  PID:3248

C:\Users\Admin\AppData\Local\Temp\2026-08-05_3b25afcbdfcd8e52140eb4d12a750dd4_icedid.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-05_3b25afcbdfcd8e52140eb4d12a750dd4_icedid.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\Local\Temp\2026-08-05_3b25afcbdfcd8e52140eb4d12a750dd4_icedid.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_3b25afcbdfcd8e52140eb4d12a750dd4_icedid.exe"
  2⤵
  PID:3288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-0-0x000001DD25380000-0x000001DD25382000-memory.dmp

Download

memory/964-2-0x000001DD25380000-0x000001DD25382000-memory.dmp