e0dff683c45091fd83c33539c7a55fee15ff757a3e7045076033dcde059692ec

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_317eae1806c06bfb51f0977609948cad_icedid_njrat_stealc.exe
Size 1.9MB
Sample260813-l46fcswtay
SHA256 e0dff683c45091fd83c33539c7a55fee15ff757a3e7045076033dcde059692ec
MD5 317eae1806c06bfb51f0977609948cad
SHA1 5caa6d6a3946d3d1c18cb0a3801492b0c266c45d
SHA512 a7ffba3fa603c57c431c243e40fc36c119f53adda0081d1ab0216480247868bdf47787ef7d4178d850b638d4ead026c0ce71bfcf6181c3ad694c734d14ce271a
SSDEEP 49152:C03bRTzgORAg92pjyf2rzGshgwsh+T9hfWl/:1bRTTngZBgw3/c
TLSH
T102957C6BA66901BCF0BFD178C9565907FBF1780943A096CF02E097A62B63BE0473E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	2026-08-13_317eae1806c06bfb51f0977609948cad_icedid_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
4484	WPeerC.exe
4996	WPeerC.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
5	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2836	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4532	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 2836	4604	2026-08-13_317eae1806c06bfb51f0977609948cad_icedid_njrat_stealc.exe	86
PID 2836 wrote to memory of 4532	2836	cmd.exe	87
PID 4604 wrote to memory of 4484	4604	2026-08-13_317eae1806c06bfb51f0977609948cad_icedid_njrat_stealc.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-13_317eae1806c06bfb51f0977609948cad_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_317eae1806c06bfb51f0977609948cad_icedid_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\WSystemPeers\WPeerC.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\WSystemPeers\WPeerC.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4532
- C:\Users\Admin\AppData\Roaming\WSystemPeers\WPeerC.exe
  "C:\Users\Admin\AppData\Roaming\WSystemPeers\WPeerC.exe"
  2⤵
  - Executes dropped EXE
  PID:4484

C:\Users\Admin\AppData\Roaming\WSystemPeers\WPeerC.exe
C:\Users\Admin\AppData\Roaming\WSystemPeers\WPeerC.exe
1⤵
- Executes dropped EXE
PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WPeerC.exe

Path C:\Users\Admin\AppData\Roaming\WSystemPeers\WPeerC.exe
Size 3.7MB
SHA256 4eb693182855ae077e54d47c343374628ecd52aa358d1e65a0ee3518c0040059
MD5 435d8844efcdd01b13c66362acf53556
SHA1 024200dc22f50af6409c861f2f215041e0852f8a
SHA512 105f6bd74ab1e47c8e7cfd08849dc717bf9aec2293ae8043a45579f0f5584db1cc5551fcad7d870527fe23a559be8413271c99ed2a8a716c99172b540145f0ec
SSDEEP 98304:1bRTTngZBgw3/pWGoqZ92yVG/uzGNV9Hki:1bRTbYCw3sByQyVG/uzGNVyi
TLSH
T10206D0ABA66901BCF4BFD178C9465907FBF1780543A096DF02E097A62B63BE0473E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WPeerC.exe

Path C:\Users\Admin\AppData\Roaming\WSystemPeers\WPeerC.exe
Size 2.0MB
SHA256 3fcbba101b9ae967e33f808a7fdd0ddd7b5cf5adffde69046e172dfb4ec78571
MD5 1bbf4cac7cae800a5497f6888ecae866
SHA1 463c352c4075029ce031d359d873589b376cb86a
SHA512 967ba2e22104a085641a3a9716359cc7de3d614115b38d1a49ef3f2f0ea74ca9aacd72a6520c4d3d093ec2e7aecbe2aa6bd557c670261c91f0ae099b4d4877f4
SSDEEP 49152:C03bRTzgORAg92pjyf2rzGshgwsh+T9hfWlvW:1bRTTngZBgw3/1
TLSH
T10EA58D6BA66901BCF0BFD178C9565907FBF1780943A096CF02E097A62B63BE0473E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads