ccdf7f3f080064c38f9a89313c89b6f36567d9b0f70ab9205a9150426112648e

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 11:22

Target
2026-09-23_3115f450126d8c590bd6fc039dfe7841_icedid_njrat_ryuk.exe
Size 6.5MB
Sample260924-ng1mpsshpc
SHA256 ccdf7f3f080064c38f9a89313c89b6f36567d9b0f70ab9205a9150426112648e
MD5 3115f450126d8c590bd6fc039dfe7841
SHA1 f7c932be19de9cbc74c825a7ff3c114a2f608c5a
SHA512 9537cdb5e581ecc4edf656b2a72b9984c213760a08f88ce7b95b2e23a69504774db11f42b8b15f9d0a4b928c4a048fee73b3cd3bfe2dfadccbc8170967107447
SSDEEP 49152:7kMGKUNs/ybCavm+WWBO8JNgXEpw+aT9ECMOrORImtktyWCqyVF/8mQzHkfY2av6:IfKGjCavm+W3jLFyjktyQyRYvvSPkW
TLSH
T106664A66A2B6C0A8D05AC873FA29D521D7253C4E53F492EB13D475E416F2AC63F38F90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\aloha_installer.log	2026-09-23_3115f450126d8c590bd6fc039dfe7841_icedid_njrat_ryuk.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 4460	2720	2026-09-23_3115f450126d8c590bd6fc039dfe7841_icedid_njrat_ryuk.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-09-23_3115f450126d8c590bd6fc039dfe7841_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_3115f450126d8c590bd6fc039dfe7841_icedid_njrat_ryuk.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Users\Admin\AppData\Local\Temp\2026-09-23_3115f450126d8c590bd6fc039dfe7841_icedid_njrat_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-23_3115f450126d8c590bd6fc039dfe7841_icedid_njrat_ryuk.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Crashpad" --annotation=device_id=864ddaf1-1968-4ead-9c86-62acd3ec3075 --annotation=format=minidump --annotation=is_debug=false --annotation=is_release=true --annotation=plat=Win64 --annotation=prod=Aloha --annotation=product_version=4.17.0.0 --annotation=token=9e03b2e36605d475196bcb6e61ae3a9157de20aa775eeae07c234f3b16008d28 --annotation=user_hostname=VHVQVSII --annotation=user_id=864ddaf1-1968-4ead-9c86-62acd3ec3075 --annotation=ver=4.17.0.0 --initial-client-data=0x248,0x288,0x28c,0x24c,0x290,0x7ff7686b01f8,0x7ff7686b0204,0x7ff7686b0210
  2⤵
  PID:4460