Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
30/08/2026, 21:43
General
- Target 2026-08-30_10d383c0f6f487123183fd1413a3421f_akira_icedid.exe
- Size 12.4MB
- Sample260830-1lbwcs1ala
- SHA256 46d4735ce01801f0860cfba00df6fcbed025ca12f632d718c1e4ff152697d0dc
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 2 IoCs
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 7 IoCs
- Looks up external IP address via web service 1 TTPs 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-30_10d383c0f6f487123183fd1413a3421f_akira_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-30_10d383c0f6f487123183fd1413a3421f_akira_icedid.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\checker.exe"C:\Users\Admin\AppData\Local\Temp\checker.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="ibW*V}S\VW,sVM" dir=in action=allow program="C:\Windows\System32\Defender.exe" enable=yes & exit3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\Defender.exe"C:\Windows\System32\Defender.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\scanner.exe"C:\Users\Admin\AppData\Local\Temp\scanner.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\scanner.exe"C:\Users\Admin\AppData\Local\Temp\scanner.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\System32\Defender.exeC:\Windows\System32\Defender.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Defender.exe"C:\Windows\System32\Defender.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Defender.exe"C:\Windows\System32\Defender.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_zstd.pyd
base_library.zip
libffi-8.dll
python314.dll
checker.exe
scanner.exe
memory/2452-112-0x0000000024DC0000-0x0000000024DE9000-memory.dmp
memory/2452-103-0x00000000246B0000-0x00000000246D9000-memory.dmp
memory/2452-23-0x0000000006620000-0x0000000006FC4000-memory.dmp
memory/2452-33-0x0000000006620000-0x0000000006FC4000-memory.dmp
memory/2452-28-0x0000000001D70000-0x0000000001E37000-memory.dmp
memory/2452-26-0x0000000000B90000-0x0000000001807000-memory.dmp
memory/2452-32-0x0000000001E40000-0x00000000021E1000-memory.dmp
memory/2452-54-0x00000000022F0000-0x000000000238D000-memory.dmp
memory/2452-62-0x0000000002770000-0x000000000279A000-memory.dmp
memory/2452-65-0x0000000002930000-0x0000000002A46000-memory.dmp
memory/2452-67-0x0000000002B80000-0x0000000002C23000-memory.dmp
memory/2452-74-0x0000000004BF0000-0x0000000004CC6000-memory.dmp
memory/2452-79-0x0000000004FF0000-0x000000000508B000-memory.dmp
memory/2452-8-0x0000000006620000-0x0000000006FC4000-memory.dmp
memory/2452-86-0x0000000020BF0000-0x0000000020D1F000-memory.dmp
memory/2452-91-0x0000000023370000-0x0000000023A66000-memory.dmp
memory/2452-7-0x0000000006620000-0x0000000006FC4000-memory.dmp
memory/2452-107-0x0000000024910000-0x0000000024AE8000-memory.dmp
memory/2452-119-0x0000000025510000-0x0000000025678000-memory.dmp
memory/2452-118-0x0000000025490000-0x000000002550C000-memory.dmp
memory/2452-115-0x0000000025360000-0x0000000025424000-memory.dmp
memory/2452-117-0x0000000025460000-0x000000002547E000-memory.dmp
memory/2452-116-0x0000000025440000-0x0000000025457000-memory.dmp
memory/2452-111-0x0000000024AF0000-0x0000000024DB2000-memory.dmp
memory/2452-114-0x0000000024DF0000-0x0000000024E49000-memory.dmp
memory/2452-113-0x0000000024670000-0x000000002467D000-memory.dmp
memory/2452-5-0x0000000006620000-0x0000000006FC4000-memory.dmp
memory/2452-4-0x0000000006620000-0x0000000006FC4000-memory.dmp
memory/2452-3-0x0000000021810000-0x0000000022426000-memory.dmp
memory/2452-102-0x0000000024480000-0x0000000024528000-memory.dmp
memory/2452-104-0x00000000248E0000-0x0000000024908000-memory.dmp
memory/2452-17-0x0000000006620000-0x0000000006FC4000-memory.dmp
memory/2452-101-0x0000000024380000-0x0000000024473000-memory.dmp
memory/2452-99-0x00000000242A0000-0x0000000024373000-memory.dmp
memory/2452-92-0x0000000023A70000-0x000000002429A000-memory.dmp
memory/2452-2-0x0000000006DBC000-0x0000000006DBD000-memory.dmp
memory/2452-0-0x0000000000B90000-0x0000000001807000-memory.dmp
memory/2452-90-0x00000000217C0000-0x00000000217E6000-memory.dmp
memory/2452-89-0x00000000217B0000-0x00000000217BC000-memory.dmp
memory/2452-88-0x0000000020BA0000-0x0000000020BD8000-memory.dmp
memory/2452-87-0x0000000005250000-0x000000000526C000-memory.dmp
memory/2452-85-0x0000000005380000-0x00000000053DF000-memory.dmp
memory/2452-84-0x0000000005120000-0x00000000051ED000-memory.dmp
memory/2452-83-0x0000000005100000-0x000000000511B000-memory.dmp
memory/2452-82-0x0000000004DB0000-0x0000000004DBC000-memory.dmp
memory/2452-81-0x00000000050A0000-0x00000000050FD000-memory.dmp
memory/2452-78-0x0000000004F80000-0x0000000004FED000-memory.dmp
memory/2452-77-0x0000000004CD0000-0x0000000004D69000-memory.dmp
memory/2452-75-0x0000000004DE0000-0x0000000004F79000-memory.dmp
memory/2452-76-0x0000000004730000-0x000000000474A000-memory.dmp
memory/2452-72-0x0000000004870000-0x0000000004BEC000-memory.dmp
memory/2452-73-0x0000000004710000-0x000000000472D000-memory.dmp
memory/2452-71-0x00000000047C0000-0x000000000486D000-memory.dmp
memory/2452-68-0x0000000002C30000-0x0000000002D7B000-memory.dmp
memory/2452-70-0x00000000045C0000-0x0000000004608000-memory.dmp
memory/2452-69-0x0000000002F90000-0x0000000002FBF000-memory.dmp
memory/2452-66-0x0000000002A50000-0x0000000002B71000-memory.dmp
memory/2452-64-0x0000000002880000-0x0000000002927000-memory.dmp
memory/2452-63-0x00000000027D0000-0x0000000002879000-memory.dmp
memory/2452-61-0x0000000002560000-0x0000000002587000-memory.dmp
memory/2452-60-0x00000000025B0000-0x0000000002662000-memory.dmp
memory/2452-56-0x0000000002390000-0x0000000002553000-memory.dmp
memory/5036-16-0x0000000000130000-0x00000000001BC000-memory.dmp