9a7bd390d8756eaec02a8daec7dd0be07e3a31c548a8cae6b856dd6f12ac3497

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 09:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_7f45f0902cd038ae36cb209891d1aa76_icedid_njrat.exe
Size 2.7MB
Sample260815-k8tfxsshqe
SHA256 9a7bd390d8756eaec02a8daec7dd0be07e3a31c548a8cae6b856dd6f12ac3497
MD5 7f45f0902cd038ae36cb209891d1aa76
SHA1 157519d422310c98fe00f1c8b3ab419ab8883db4
SHA512 ce09b6eeacc178bffb10e96390b33d0316b3b4240ee815fdb324099f15e7a8997542941abc2792cfc4323240bf2f121c660949444299f0304345170442098620
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90/:AXRE5hpVGh5Rj+bkVexGRu/
TLSH
T168D5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution

Malware Config

Signatures

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000242b6-4.dat	INDICATOR_SUSPICIOUS_ClearWinLogs

Executes dropped EXE 1 IoCs

pid	Process
1772	msedge.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1188	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1188	cmd.exe
552	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
552	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3272	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3272	Process not Found
Token: SeCreatePagefilePrivilege	3272	Process not Found
Token: SeShutdownPrivilege	3272	Process not Found
Token: SeCreatePagefilePrivilege	3272	Process not Found
Token: SeShutdownPrivilege	3272	Process not Found
Token: SeCreatePagefilePrivilege	3272	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1772	848	2026-08-15_7f45f0902cd038ae36cb209891d1aa76_icedid_njrat.exe	86
PID 848 wrote to memory of 1188	848	2026-08-15_7f45f0902cd038ae36cb209891d1aa76_icedid_njrat.exe	87
PID 1188 wrote to memory of 552	1188	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-15_7f45f0902cd038ae36cb209891d1aa76_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_7f45f0902cd038ae36cb209891d1aa76_icedid_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\msedge.exe
  "C:\Users\Admin\AppData\Local\Temp\msedge.exe" --randomized
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1772
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping localhost -n 2 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-08-15_7f45f0902cd038ae36cb209891d1aa76_icedid_njrat.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge.exe

Path C:\Users\Admin\AppData\Local\Temp\msedge.exe
Size 2.7MB
SHA256 2cd8e59cb003eaa374ef1d3c1da65c91922e147c7c78a13f2a6b8dff6ecac908
MD5 c855c9b29d97c127b0c9deb68a3dca9e
SHA1 c130d2409d6ed17038d2adbb2acbca2c168814e8
SHA512 2a2dcbf028eb70c12f0901cc188684af2e285c3d2cca3ff2540863831fa0ba0552c90b5cbe3bc0ce95ebd780ff520420a5fa323dc20e9ab7f2f801d20cff0c57
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90C:AXRE5hpVGh5Rj+bkVexGRuC
TLSH
T1B2D5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3272-5-0x0000000003060000-0x0000000003061000-memory.dmp

Download