90d7edc6d0c63cfd7d998046a27410f180d6c2d0574f26562f745e9bdde1cb95

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_75cc9e9d503fe6f2055c13e13c00de1e_icedid_njrat.exe
Size 2.7MB
Sample260813-e7tgms1hra
SHA256 90d7edc6d0c63cfd7d998046a27410f180d6c2d0574f26562f745e9bdde1cb95
MD5 75cc9e9d503fe6f2055c13e13c00de1e
SHA1 cf92a574ca08be0a2e5daf018fbe77151da381be
SHA512 b6d69db09e0c6c7b5b668f03b5b01beba6b27ae758948af8c5ab4d9e4b53f658afbc9550159cb1a39933f687483e51a36203f9e9cdc632c95c899e7ce145a3eb
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90+:AXRE5hpVGh5Rj+bkVexGRu+
TLSH
T1A0D5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution

Malware Config

Signatures

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000002434e-3.dat	INDICATOR_SUSPICIOUS_ClearWinLogs

Executes dropped EXE 1 IoCs

pid	Process
940	msedge.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1664	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1664	cmd.exe
3696	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3696	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
940	msedge.exe
940	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3280	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3280	Process not Found
Token: SeCreatePagefilePrivilege	3280	Process not Found
Token: SeShutdownPrivilege	3280	Process not Found
Token: SeCreatePagefilePrivilege	3280	Process not Found
Token: SeShutdownPrivilege	3280	Process not Found
Token: SeCreatePagefilePrivilege	3280	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 940	2568	2026-08-13_75cc9e9d503fe6f2055c13e13c00de1e_icedid_njrat.exe	85
PID 2568 wrote to memory of 1664	2568	2026-08-13_75cc9e9d503fe6f2055c13e13c00de1e_icedid_njrat.exe	86
PID 1664 wrote to memory of 3696	1664	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-13_75cc9e9d503fe6f2055c13e13c00de1e_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_75cc9e9d503fe6f2055c13e13c00de1e_icedid_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\msedge.exe
  "C:\Users\Admin\AppData\Local\Temp\msedge.exe" --randomized
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:940
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping localhost -n 2 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-08-13_75cc9e9d503fe6f2055c13e13c00de1e_icedid_njrat.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge.exe

Path C:\Users\Admin\AppData\Local\Temp\msedge.exe
Size 2.7MB
SHA256 812b3506e291213bf1fce2c452d95c0dfaa70797103780a39900103c9ceef6ad
MD5 674c591da9f859f5dbcb1571b53930de
SHA1 77198881eb4f83440ab6c6f3ca8f65b193243c24
SHA512 7976fb680aa048e69339dc7e752ee07b1ef6fcf3fd76096fdaca748dc0cc34566de0711d8d170febeb552d0ff2a333ef0d7c2c9955e62b6290d58487ec55cc37
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90Y:AXRE5hpVGh5Rj+bkVexGRuY
TLSH
T19AD5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3280-5-0x0000000002260000-0x0000000002261000-memory.dmp

Download