00bd7c016ee4253078e4c712824848349b7c152f07a439cc185817a95ee866e2

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 11:39

Target
2026-09-24_3c737574927e80d32379e6ae127ddb5d_icedid_njrat_stealc.exe
Size 4.0MB
Sample260925-nsqa4sdg56
SHA256 00bd7c016ee4253078e4c712824848349b7c152f07a439cc185817a95ee866e2
MD5 3c737574927e80d32379e6ae127ddb5d
SHA1 7328891c67f45e9842937127b0df5ee25d2c2bb9
SHA512 cbab37b1a906f486e89b8329184da2ee7dcdb2a1dec5310773b75fb87ee23641f06c7f7c5a7da113a1823ddab7149f0194187ec259817f55f3978c0cd91e1c75
SSDEEP 49152:f5pyDO0lJQfeNiQIug+q+fCy18jq2oyLuB+GtqgfPSI181VcFc1BOfOgi+2RWg8v:qnlJ/Ueaq2oyLuB+GtqgfPSGW
TLSH
T13316AE26F65041E4C0B25075E91B6A03EB753C68072086C396B4735D2FBBBA07F7EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4464	WM9Z3TK6U5KS5RI3AYS5DFIZ680MU.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\avc.inf_amd64_12ca23d60da30d59\Loader.sys	WM9Z3TK6U5KS5RI3AYS5DFIZ680MU.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	WM9Z3TK6U5KS5RI3AYS5DFIZ680MU.exe
Token: SeImpersonatePrivilege	4464	WM9Z3TK6U5KS5RI3AYS5DFIZ680MU.exe
Token: SeDebugPrivilege	4464	WM9Z3TK6U5KS5RI3AYS5DFIZ680MU.exe
Token: SeDebugPrivilege	4464	WM9Z3TK6U5KS5RI3AYS5DFIZ680MU.exe
Token: SeImpersonatePrivilege	4464	WM9Z3TK6U5KS5RI3AYS5DFIZ680MU.exe
Token: SeDebugPrivilege	4464	WM9Z3TK6U5KS5RI3AYS5DFIZ680MU.exe
Token: SeDebugPrivilege	4464	WM9Z3TK6U5KS5RI3AYS5DFIZ680MU.exe
Token: SeImpersonatePrivilege	4464	WM9Z3TK6U5KS5RI3AYS5DFIZ680MU.exe
Token: SeDebugPrivilege	4464	WM9Z3TK6U5KS5RI3AYS5DFIZ680MU.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 4464	3236	2026-09-24_3c737574927e80d32379e6ae127ddb5d_icedid_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-24_3c737574927e80d32379e6ae127ddb5d_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_3c737574927e80d32379e6ae127ddb5d_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Users\Admin\AppData\Local\Temp\WM9Z3TK6U5KS5RI3AYS5DFIZ680MU.exe
  "C:\Users\Admin\AppData\Local\Temp\WM9Z3TK6U5KS5RI3AYS5DFIZ680MU.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4688

WM9Z3TK6U5KS5RI3AYS5DFIZ680MU.exe

Path C:\Users\Admin\AppData\Local\Temp\WM9Z3TK6U5KS5RI3AYS5DFIZ680MU.exe
Size 4.0MB
SHA256 00bd7c016ee4253078e4c712824848349b7c152f07a439cc185817a95ee866e2
MD5 3c737574927e80d32379e6ae127ddb5d
SHA1 7328891c67f45e9842937127b0df5ee25d2c2bb9
SHA512 cbab37b1a906f486e89b8329184da2ee7dcdb2a1dec5310773b75fb87ee23641f06c7f7c5a7da113a1823ddab7149f0194187ec259817f55f3978c0cd91e1c75
SSDEEP 49152:f5pyDO0lJQfeNiQIug+q+fCy18jq2oyLuB+GtqgfPSI181VcFc1BOfOgi+2RWg8v:qnlJ/Ueaq2oyLuB+GtqgfPSGW
TLSH
T13316AE26F65041E4C0B25075E91B6A03EB753C68072086C396B4735D2FBBBA07F7EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download