Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/08/2026, 21:43
General
- Target 2026-08-30_10d383c0f6f487123183fd1413a3421f_akira_icedid.exe
- Size 12.4MB
- Sample260830-1lbwcs1ala
- SHA256 46d4735ce01801f0860cfba00df6fcbed025ca12f632d718c1e4ff152697d0dc
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 2 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 8 IoCs
- Looks up external IP address via web service 1 TTPs 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-30_10d383c0f6f487123183fd1413a3421f_akira_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-30_10d383c0f6f487123183fd1413a3421f_akira_icedid.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\checker.exe"C:\Users\Admin\AppData\Local\Temp\checker.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="ibW*V}S\VW,sVM" dir=in action=allow program="C:\Windows\System32\Defender.exe" enable=yes & exit3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\Defender.exe"C:\Windows\System32\Defender.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\scanner.exe"C:\Users\Admin\AppData\Local\Temp\scanner.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\scanner.exe"C:\Users\Admin\AppData\Local\Temp\scanner.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\System32\Defender.exeC:\Windows\System32\Defender.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Defender.exeC:\Windows\System32\Defender.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Defender.exeC:\Windows\System32\Defender.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
Defender.exe.log
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_tkinter.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
libtommath.dll
python314.dll
select.pyd
tcl90.dll
tcl9tk90.dll
unicodedata.pyd
zlib1.dll
checker.exe
scanner.exe
memory/3276-18-0x0000000000670000-0x00000000006FC000-memory.dmp
memory/5040-138-0x0000021B60B30000-0x0000021B61226000-memory.dmp
memory/5040-151-0x0000021B60B30000-0x0000021B61226000-memory.dmp
memory/5068-132-0x00000000253D0000-0x000000002542C000-memory.dmp
memory/5068-82-0x00000000230C0000-0x00000000230F4000-memory.dmp
memory/5068-121-0x0000000024620000-0x0000000024644000-memory.dmp
memory/5068-120-0x0000000024400000-0x000000002441F000-memory.dmp
memory/5068-118-0x00000000241E0000-0x0000000024289000-memory.dmp
memory/5068-126-0x0000000024AF0000-0x0000000024B18000-memory.dmp
memory/5068-117-0x00000000240D0000-0x00000000241C6000-memory.dmp
memory/5068-93-0x0000000023940000-0x00000000240D0000-memory.dmp
memory/5068-127-0x00000000243C0000-0x00000000243CC000-memory.dmp
memory/5068-128-0x0000000024B20000-0x0000000024B6E000-memory.dmp
memory/5068-129-0x0000000025080000-0x00000000251C6000-memory.dmp
memory/5068-130-0x00000000251E0000-0x0000000025334000-memory.dmp
memory/5068-131-0x0000000025340000-0x00000000253D0000-memory.dmp
memory/5068-0-0x0000000000B50000-0x00000000017C7000-memory.dmp
memory/5068-133-0x0000000025430000-0x0000000025459000-memory.dmp
memory/5068-134-0x0000000025460000-0x000000002548E000-memory.dmp
memory/5068-135-0x0000000025490000-0x00000000254B5000-memory.dmp
memory/5068-136-0x00000000254C0000-0x000000002553D000-memory.dmp
memory/5068-137-0x0000000025540000-0x0000000025CD8000-memory.dmp
memory/5068-122-0x0000000024650000-0x000000002483B000-memory.dmp
memory/5068-69-0x00000000061F0000-0x0000000006CB1000-memory.dmp
memory/5068-65-0x00000000043E0000-0x00000000043F2000-memory.dmp
memory/5068-61-0x00000000049B0000-0x0000000004A7D000-memory.dmp
memory/5068-56-0x0000000004320000-0x00000000043BE000-memory.dmp
memory/5068-41-0x0000000001CC0000-0x0000000001D7E000-memory.dmp
memory/5068-7-0x00000000061F0000-0x0000000006CB1000-memory.dmp
memory/5068-92-0x0000000023880000-0x000000002392D000-memory.dmp
memory/5068-85-0x0000000023140000-0x000000002387F000-memory.dmp
memory/5068-5-0x00000000061F0000-0x0000000006CB1000-memory.dmp
memory/5068-84-0x0000000023130000-0x000000002313C000-memory.dmp
memory/5068-83-0x0000000023100000-0x0000000023127000-memory.dmp
memory/5068-125-0x0000000024840000-0x0000000024AF0000-memory.dmp
memory/5068-81-0x0000000004F00000-0x0000000004F18000-memory.dmp
memory/5068-80-0x00000000208B0000-0x00000000209FE000-memory.dmp
memory/5068-79-0x0000000004F30000-0x0000000004F5C000-memory.dmp
memory/5068-78-0x0000000004DC0000-0x0000000004E7D000-memory.dmp
memory/5068-77-0x0000000004DA0000-0x0000000004DB6000-memory.dmp
memory/5068-70-0x0000000004D40000-0x0000000004D95000-memory.dmp
memory/5068-68-0x0000000004C90000-0x0000000004D3A000-memory.dmp
memory/5068-67-0x0000000004400000-0x0000000004465000-memory.dmp
memory/5068-66-0x00000000047E0000-0x0000000004863000-memory.dmp
memory/5068-62-0x0000000004A80000-0x0000000004BAA000-memory.dmp
memory/5068-60-0x00000000043C0000-0x00000000043D9000-memory.dmp
memory/5068-57-0x0000000004480000-0x00000000047D5000-memory.dmp
memory/5068-40-0x0000000000B50000-0x00000000017C7000-memory.dmp
memory/5068-55-0x00000000042E0000-0x0000000004311000-memory.dmp
memory/5068-54-0x0000000002CB0000-0x0000000002CE0000-memory.dmp
memory/5068-53-0x00000000029A0000-0x0000000002AA0000-memory.dmp
memory/5068-52-0x0000000002900000-0x000000000299D000-memory.dmp
memory/5068-50-0x00000000026C0000-0x00000000027EA000-memory.dmp
memory/5068-49-0x0000000002620000-0x00000000026BB000-memory.dmp
memory/5068-48-0x0000000002580000-0x000000000261E000-memory.dmp
memory/5068-47-0x0000000001B90000-0x0000000001BBB000-memory.dmp
memory/5068-46-0x0000000001B40000-0x0000000001B62000-memory.dmp
memory/5068-45-0x0000000002360000-0x000000000240C000-memory.dmp
memory/5068-44-0x00000000021B0000-0x0000000002351000-memory.dmp
memory/5068-43-0x0000000002120000-0x00000000021B0000-memory.dmp
memory/5068-42-0x0000000001D80000-0x0000000002049000-memory.dmp
memory/5068-51-0x00000000027F0000-0x00000000028FB000-memory.dmp
memory/5068-4-0x00000000061F0000-0x0000000006CB1000-memory.dmp
memory/5068-3-0x00000000214D0000-0x00000000220E6000-memory.dmp
memory/5068-2-0x00000000069BA000-0x00000000069BB000-memory.dmp