0e40b0f51c6cd2f5755fc3155c3ec225d91df2d790eb57210b13ddf2ad241be0

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_74714fa28cf997682b7e9657720c6811_icedid_njrat.exe
Size 2.7MB
Sample260821-b5zdbstyhs
SHA256 0e40b0f51c6cd2f5755fc3155c3ec225d91df2d790eb57210b13ddf2ad241be0
MD5 74714fa28cf997682b7e9657720c6811
SHA1 e79a703da3d090586b0dd857feb395200e62e5d0
SHA512 b7c48ce2ed68fde33891a1f85441aa9b36cee0efa3146a989bfe9142d18c46920a900692887080434fe547754b6016ce3c2df357a2895aa17a41faeb453f00cc
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90C:AXRE5hpVGh5Rj+bkVexGRuC
TLSH
T1EED5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution

Malware Config

Signatures

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
behavioral1/files/0x00060000000231d3-4.dat	INDICATOR_SUSPICIOUS_ClearWinLogs

Executes dropped EXE 1 IoCs

pid	Process
4700	msedge.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4420	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4420	cmd.exe
636	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
636	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3264	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3264	Process not Found
3264	Process not Found
3264	Process not Found

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3264	Process not Found
3264	Process not Found
3264	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 4700	2568	2026-08-21_74714fa28cf997682b7e9657720c6811_icedid_njrat.exe	85
PID 2568 wrote to memory of 4420	2568	2026-08-21_74714fa28cf997682b7e9657720c6811_icedid_njrat.exe	86
PID 4420 wrote to memory of 636	4420	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-21_74714fa28cf997682b7e9657720c6811_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_74714fa28cf997682b7e9657720c6811_icedid_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\msedge.exe
  "C:\Users\Admin\AppData\Local\Temp\msedge.exe" --randomized
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping localhost -n 2 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-08-21_74714fa28cf997682b7e9657720c6811_icedid_njrat.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge.exe

Path C:\Users\Admin\AppData\Local\Temp\msedge.exe
Size 2.7MB
SHA256 9885cf531bf19914a3f691148df6d38d88bf29e40f435806994571a3d28e5483
MD5 f06e35b835bffaef0fa20caa6f741169
SHA1 15b2d9a04fee3e73da2b5c54756ca25aa6a1c226
SHA512 93f05c4c279284f98c4748c14264c9737745b00e17cfeb7087b5b2c470f84261c9bfdfd4294af0ff8c7f0b6df1dba7a005ddbf59f72b2c35665093dea3494f4c
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90t:AXRE5hpVGh5Rj+bkVexGRut
TLSH
T10BD5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3264-5-0x0000000002570000-0x0000000002571000-memory.dmp

Download