Analysis
- max time kernel
146s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 15:20
General
- Target 2026-08-20_705ee028c367593d4f4aaf6932ca38c4_icedid_mespinoza_njrat_ryuk.exe
- Size 1.0MB
- Sample260820-sq8f5azdpg
- SHA256 1b04f9c92fa39306917c0ca9fad79573f44516e1f5352f9481118d091c6a1fa1
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 13 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 17 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Modifies registry class 52 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 15 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_705ee028c367593d4f4aaf6932ca38c4_icedid_mespinoza_njrat_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_705ee028c367593d4f4aaf6932ca38c4_icedid_mespinoza_njrat_ryuk.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
memory/480-61-0x00007FF75FDE0000-0x00007FF75FF03000-memory.dmp
memory/480-14-0x00000237379D0000-0x0000023737A36000-memory.dmp
memory/480-13-0x00000237379D0000-0x0000023737A36000-memory.dmp
memory/480-12-0x00000237379D0000-0x0000023737A36000-memory.dmp
memory/480-11-0x00007FF75FDE0000-0x00007FF75FF03000-memory.dmp
memory/624-283-0x000002317C440000-0x000002317C4A6000-memory.dmp
memory/624-284-0x00007FF737BB0000-0x00007FF7382F4000-memory.dmp
memory/624-282-0x000002317C440000-0x000002317C4A6000-memory.dmp
memory/840-36-0x00000184C7EB0000-0x00000184C7F16000-memory.dmp
memory/840-34-0x00000184C7C30000-0x00000184C7D89000-memory.dmp
memory/840-37-0x00000184C7EB0000-0x00000184C7F16000-memory.dmp
memory/840-35-0x00000184C7EB0000-0x00000184C7F16000-memory.dmp
memory/1448-243-0x0000021AFDB20000-0x0000021AFDB86000-memory.dmp
memory/1448-242-0x0000021AFDB20000-0x0000021AFDB86000-memory.dmp
memory/1448-318-0x00007FF632AD0000-0x00007FF632B99000-memory.dmp
memory/1448-241-0x00007FF632AD0000-0x00007FF632B99000-memory.dmp
memory/1928-27-0x00000120F92A0000-0x00000120F9306000-memory.dmp
memory/1928-26-0x00000120F92A0000-0x00000120F9306000-memory.dmp
memory/1928-25-0x00000120F9140000-0x00000120F9299000-memory.dmp
memory/1928-28-0x00000120F92A0000-0x00000120F9306000-memory.dmp
memory/2016-291-0x00000212C0D80000-0x00000212C0DE6000-memory.dmp
memory/2016-292-0x00000212C0D80000-0x00000212C0DE6000-memory.dmp
memory/2016-290-0x00007FF690100000-0x00007FF6901AE000-memory.dmp
memory/2152-319-0x00007FF75DAB0000-0x00007FF75DD53000-memory.dmp
memory/2152-322-0x000001C1B1760000-0x000001C1B17C6000-memory.dmp
memory/2152-321-0x000001C1B1760000-0x000001C1B17C6000-memory.dmp
memory/2428-350-0x00007FF7A5820000-0x00007FF7A5AAB000-memory.dmp
memory/2428-352-0x0000020739D80000-0x0000020739DE6000-memory.dmp
memory/2428-351-0x0000020739D80000-0x0000020739DE6000-memory.dmp
memory/2544-44-0x00000204463A0000-0x0000020446406000-memory.dmp
memory/2544-50-0x00000204463A0000-0x0000020446406000-memory.dmp
memory/2544-43-0x00007FF666370000-0x00007FF6664D8000-memory.dmp
memory/2544-45-0x00000204463A0000-0x0000020446406000-memory.dmp
memory/2544-52-0x00007FF666370000-0x00007FF6664D8000-memory.dmp
memory/2960-330-0x000001EC25210000-0x000001EC25276000-memory.dmp
memory/2960-329-0x00007FF65CF40000-0x00007FF65D0D5000-memory.dmp
memory/2960-331-0x000001EC25210000-0x000001EC25276000-memory.dmp
memory/4148-311-0x000001C40ECC0000-0x000001C40ED26000-memory.dmp
memory/4148-315-0x00007FF71A850000-0x00007FF71A904000-memory.dmp
memory/4148-310-0x000001C40ECC0000-0x000001C40ED26000-memory.dmp
memory/4232-56-0x000001F735840000-0x000001F7358A6000-memory.dmp
memory/4232-55-0x000001F7356E0000-0x000001F735839000-memory.dmp
memory/4232-57-0x000001F735840000-0x000001F7358A6000-memory.dmp
memory/4604-344-0x0000020EF2B20000-0x0000020EF2B86000-memory.dmp
memory/4604-339-0x0000020EF2B20000-0x0000020EF2B86000-memory.dmp
memory/4604-346-0x00007FF6298D0000-0x00007FF629BF1000-memory.dmp
memory/4604-338-0x0000020EF2B20000-0x0000020EF2B86000-memory.dmp
memory/4604-343-0x00007FF6298D0000-0x00007FF629BF1000-memory.dmp
memory/4848-251-0x0000020F2A220000-0x0000020F2A286000-memory.dmp
memory/4848-249-0x00007FF7325A0000-0x00007FF7326BA000-memory.dmp
memory/4848-250-0x0000020F2A220000-0x0000020F2A286000-memory.dmp
memory/4848-328-0x00007FF7325A0000-0x00007FF7326BA000-memory.dmp
memory/4900-261-0x00007FF73EC50000-0x00007FF73ED9A000-memory.dmp
memory/4900-337-0x00007FF73EC50000-0x00007FF73ED9A000-memory.dmp
memory/4900-264-0x0000029E14D00000-0x0000029E14D66000-memory.dmp
memory/4900-263-0x0000029E14D00000-0x0000029E14D66000-memory.dmp
memory/5008-349-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/5008-271-0x00000000009A0000-0x0000000000A09000-memory.dmp
memory/5008-276-0x00000000009A0000-0x0000000000A09000-memory.dmp
memory/5008-270-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/5064-301-0x000001566F3D0000-0x000001566F436000-memory.dmp
memory/5064-300-0x00007FF6486A0000-0x00007FF648AB7000-memory.dmp
memory/5064-299-0x000001566F3D0000-0x000001566F436000-memory.dmp
memory/5276-19-0x00000158D5100000-0x00000158D5166000-memory.dmp
memory/5276-22-0x00007FF7721D0000-0x00007FF7723D3000-memory.dmp
memory/5276-0-0x00007FF7721D0000-0x00007FF7723D3000-memory.dmp
memory/5276-1-0x00000158D5100000-0x00000158D5166000-memory.dmp
memory/5276-3-0x00000158D5100000-0x00000158D5166000-memory.dmp
memory/5712-358-0x0000022BE3C80000-0x0000022BE3CE6000-memory.dmp
memory/5712-359-0x0000022BE3C80000-0x0000022BE3CE6000-memory.dmp
memory/5712-360-0x00007FF651230000-0x00007FF651701000-memory.dmp
memory/5720-234-0x0000026675EF0000-0x0000026675F56000-memory.dmp
memory/5720-309-0x00007FF632AD0000-0x00007FF632B99000-memory.dmp
memory/5720-232-0x00007FF632AD0000-0x00007FF632B99000-memory.dmp
memory/5720-233-0x0000026675EF0000-0x0000026675F56000-memory.dmp