c756ca6e9f64ff9dde8fa4d7772054c89684a77ec5f40ec1cc50bd5ebc402932

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 16:49

Target
2026-10-05_b2fcc88cdf8cf0137907a7b7c4326097_icedid_ryuk.exe
Size 468KB
Sample261006-vb2q5sssd1
SHA256 c756ca6e9f64ff9dde8fa4d7772054c89684a77ec5f40ec1cc50bd5ebc402932
MD5 b2fcc88cdf8cf0137907a7b7c4326097
SHA1 30e59ac2a25a4e0f594de4476a68c7fb91457d3d
SHA512 805794355d7c8a2ac46ad945b526f900ea8cb1f0fe188f77c31258af512f0357d360825bbb2a4f85a4e37cfa127e7f01f9cb7dd329ea314411a0ce15b27d432e
SSDEEP 6144:EzMwUeT4SiLdxQwJ3lN5e5TShFHTcHctkEsgVhrcTAh+tLtdEBFHm8PD8Aq4klPS:inklN5hhyXgzcTAhUjIrNq4mELfHLuz
TLSH
T157A4AE0AF75791E9D527C17082573622B6B578498B307FFF8BA85A321F21F90593EB08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4756	2026-10-05_b2fcc88cdf8cf0137907a7b7c4326097_icedid_ryuk.exe
4756	2026-10-05_b2fcc88cdf8cf0137907a7b7c4326097_icedid_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-05_b2fcc88cdf8cf0137907a7b7c4326097_icedid_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_b2fcc88cdf8cf0137907a7b7c4326097_icedid_ryuk.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4756

kr_step05.txt

Path C:\Windows\Temp\kr_step05.txt
Size 133B
SHA256 5710bbd92221cacc9e8daa379a363fd5b7daebdc6f86e5e7b23a08e317261dcb
MD5 f4cebe7bcdefc0a753b8fa23c1c33d7a
SHA1 d48a7c572454bb170ad55858918778d54b249fba
SHA512 cfc7777e33444ed615286a61d265b0182b291e90e4dd461fb30d53fc9826cd6dc77a329100b31ed7ae0d3ca200f3d453b2c39d5739b13ca0469b6ca970435edb
TLSH
T118C02B0202E0F767018440C069431110635CA0340CD8D0338A782D350D131180530D2C
MD5 SHA1 SHA512 TLSH

Submit Download

kr_step08.txt

Path C:\Windows\Temp\kr_step08.txt
Size 118B
SHA256 b5c25cd693a4f56d674859d171cf4ced289b3c03730e7eb67f25cf9b3adccbf0
MD5 53d37b1e69d2a57dc4e3c1c56b22f9a0
SHA1 c74d22f148c5741ea93646a7bd5d290729043137
SHA512 23fc62881b8825f32f33184b64351c09c91d5bb686f5674d3ff5f7aa911dfecb3246f40b5bcafdad18ef062f2c5e966bae5d37bd61e773ca94e8efab26c60d4a
TLSH
T186B01443CD53D35557140F51CD551151710D053705C155714F35D745C5730505FF5334
MD5 SHA1 SHA512 TLSH

Submit Download

kr_step14.txt

Path C:\Windows\Temp\kr_step14.txt
Size 131B
SHA256 23ecd299f6994435a80aab004a5d5ee7a334491fc0724fc345e022c47d1d466b
MD5 0507b13d86bbd445d2c1271563113cee
SHA1 a7a3402122cf6883402c98f3c4e8beb189e7962b
SHA512 5b8efcc6f8298744a861d8440c4fb729004e5389a9f516fa19e1fe05fead917e3a58a05ad443afb57e526420c7153e648057255ffedc18f6e646cc83f480aac8
TLSH
T1F9C02BC1C4701530F8C50D11CE0202F5010C0EE03FF584034C534020C40784A7010990
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4756-38-0x000002007F5E0000-0x000002007F5E1000-memory.dmp

Download

memory/4756-31-0x00007FFB8DC60000-0x00007FFB8DF1C000-memory.dmp

Download

memory/4756-42-0x000002007F800000-0x000002007F840000-memory.dmp

Download

memory/4756-48-0x00007FFB8DC60000-0x00007FFB8DF1C000-memory.dmp

Download