Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 19:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_7562f75aabd8ab64339850fe9a068201_amadey_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_7562f75aabd8ab64339850fe9a068201_amadey_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target 2026-09-29_7562f75aabd8ab64339850fe9a068201_amadey_icedid_njrat_vidar_wannacry.exe
- Size 3.1MB
- Sample260930-x41ewssaph
- SHA256 e0fa855fd50041a946735c15d5a2e5ce3a4942f7638436b568c00e6d13158c7d
- MD5 7562f75aabd8ab64339850fe9a068201
- SHA1 b7aaae024c70c8d4523c4a4498aa95c217bfb96c
- SHA512 19acd55744ea1eff893005addf455a8ef6aee5910e3a6815580c45113b7a911693778bac47ff45ade0ad4bd4640ef4e5356e4c847049afddec954cc74793d7e6
- SSDEEP 49152:ZeW4SkZP4sz9MbguygmUSbHDUnbiXqJtb2IMpYq:tfkZcEUEKiXX6
- TLSH T1DBE50756B7B88E72F0B6C075C4E29679F93238450BB2868B024EA72D1F376D589F5331
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 2026-09-29_7562f75aabd8ab64339850fe9a068201_amadey_icedid_njrat_vidar_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1492 2026-09-29_7562f75aabd8ab64339850fe9a068201_amadey_icedid_njrat_vidar_wannacry.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1492 2026-09-29_7562f75aabd8ab64339850fe9a068201_amadey_icedid_njrat_vidar_wannacry.exe Token: 35 1492 2026-09-29_7562f75aabd8ab64339850fe9a068201_amadey_icedid_njrat_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_7562f75aabd8ab64339850fe9a068201_amadey_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_7562f75aabd8ab64339850fe9a068201_amadey_icedid_njrat_vidar_wannacry.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1492