747cf0bd0db270adfd1c2fac9a6991f92212dc8922e5092a6ec28d9353d37ab5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_04118a4abcc7acca2d9307990cb6963b_icedid_njrat.exe
Size 2.7MB
Sample260824-wpvenaed67
SHA256 747cf0bd0db270adfd1c2fac9a6991f92212dc8922e5092a6ec28d9353d37ab5
MD5 04118a4abcc7acca2d9307990cb6963b
SHA1 9bbee3248cc52b8557c2a0859e449ca59bb14fcb
SHA512 8ac49657790135bbf544379a511fb6cc97e1ab8e4f507384fb3f7141ae7273327b7eaeca3fd0d43db7e763e8835ac6657c21a305a7a9c7bca33d113d9cfcb42e
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90y:AXRE5hpVGh5Rj+bkVexGRuy
TLSH
T140D5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution

Malware Config

Signatures

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
behavioral1/files/0x0005000000009db7-3.dat	INDICATOR_SUSPICIOUS_ClearWinLogs

Executes dropped EXE 1 IoCs

pid	Process
2252	msedge.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1512	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1512	cmd.exe
856	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
856	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3252	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3252	Process not Found
Token: SeCreatePagefilePrivilege	3252	Process not Found
Token: SeShutdownPrivilege	3252	Process not Found
Token: SeCreatePagefilePrivilege	3252	Process not Found
Token: SeShutdownPrivilege	3252	Process not Found
Token: SeCreatePagefilePrivilege	3252	Process not Found

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3252	Process not Found
3252	Process not Found
3252	Process not Found

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3252	Process not Found
3252	Process not Found
3252	Process not Found

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3252	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2252	2328	2026-08-23_04118a4abcc7acca2d9307990cb6963b_icedid_njrat.exe	85
PID 2328 wrote to memory of 1512	2328	2026-08-23_04118a4abcc7acca2d9307990cb6963b_icedid_njrat.exe	86
PID 1512 wrote to memory of 856	1512	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-23_04118a4abcc7acca2d9307990cb6963b_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_04118a4abcc7acca2d9307990cb6963b_icedid_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Local\Temp\msedge.exe
  "C:\Users\Admin\AppData\Local\Temp\msedge.exe" --randomized
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2252
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping localhost -n 2 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-08-23_04118a4abcc7acca2d9307990cb6963b_icedid_njrat.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge.exe

Path C:\Users\Admin\AppData\Local\Temp\msedge.exe
Size 2.7MB
SHA256 ae0702c10cbed0f1fc3f7f90497ca6226c6627c68cdc4afe3e7c7237f31c97c0
MD5 c0e580947f65777b96ca775ca95af6e9
SHA1 e3655ff4663018a3a9df156b76ccc563edd9739f
SHA512 3f16d3ff4331a8ab43e929b2fb652c55021eb1d22c65c96c0315f53917e21e50eff96ba752c23a494f88ce163ce83a259059af1b5688689de197f18511b17d72
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90Q:AXRE5hpVGh5Rj+bkVexGRuQ
TLSH
T1F1D5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3252-5-0x0000000002590000-0x0000000002591000-memory.dmp

Download