Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 03:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe
- Size 1.9MB
- Sample260823-ejblxsxth1
- SHA256 7404e9dcac7a10c72da50c4ba874a9c9c80c20346e330dee4c95c4cba55f3893
- MD5 9d22ba3848da7a36baedec2805024368
- SHA1 5a99c0c0c61de920448eadaf8c7f792096a2e993
- SHA512 b19e4ecdaedce3142b58ef51b3724027758475d96d52387b982f5587176fd313d1e037db0897ae60b04d023b3a4e1efbaeaf6e2f90188e41fb53cf20ac30392c
- SSDEEP 49152:zL9QPuMvpCntwzOanKO/6VfCmFMsHUUjbOZ:zbMBKO/6BFqUjm
- TLSH T1B3959E83FEF748A5D139F9B48507466A9620F88E0930655F13FC1A34EFB73A05B2A749
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe 1172 2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1172