8ad2752d467b75655a873f22fec8ddd52291f1a08d2f945d4cd0c6143ab827f4

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_25c197ea5545e92d4703f57e4db6da04_icedid_njrat.exe
Size 1.3MB
Sample260805-qf18ysgn21
SHA256 8ad2752d467b75655a873f22fec8ddd52291f1a08d2f945d4cd0c6143ab827f4
MD5 25c197ea5545e92d4703f57e4db6da04
SHA1 bd2fb1342e7a7aedd029392f500de86ccafb623f
SHA512 3b9da4ed3c29ffd4bacd125cb7adb01226eebd70f5b4721c1e99b702ca195b53abf6f4f6166daa20ca1f3ab5831c250314f62e1e6e785668e36b6e1d154f250d
SSDEEP 12288:xf2eZq3fZ9EdamOoYCKG83ax7DmADwOf33oiXhh3ML+E+DzeKXl:92eZq3fnKgzOf33p33EW
TLSH
T10855B54BE7B611D1F4BAC2399562322AFC7234A5873897D752859A0E4B30FE4ED3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4988	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 4988	3196	2026-08-05_25c197ea5545e92d4703f57e4db6da04_icedid_njrat.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-05_25c197ea5545e92d4703f57e4db6da04_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_25c197ea5545e92d4703f57e4db6da04_icedid_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3196-0-0x00007FF7F26C0000-0x00007FF7F2884000-memory.dmp

Download

memory/3196-1-0x00007FF7F26C0000-0x00007FF7F2884000-memory.dmp