Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
11/10/2026, 07:38
General
- Target 2026-10-10_99fb9adff7e614d23c536123eb93a703_icedid.exe
- Size 6.9MB
- Sample261011-jgdqqaeb59
- SHA256 b33cbcf9182bd249fff060936a7c9d9749ec16be556f36acba4753a00494c7e9
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Delays execution with timeout.exe 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_99fb9adff7e614d23c536123eb93a703_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_99fb9adff7e614d23c536123eb93a703_icedid.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C timeout /t 3 /nobreak > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-10-10_99fb9adff7e614d23c536123eb93a703_icedid.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 3 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\ProgramData\Windows Ghost\WinGhost.exe"C:\ProgramData\Windows Ghost\WinGhost.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WinGhost.exe
memory/2440-33-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-44-0x00007FF640820000-0x00007FF6415DA000-memory.dmp
memory/2440-25-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-24-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-26-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-28-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-45-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-30-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-27-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-32-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-37-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-38-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-34-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-41-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-39-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-40-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-36-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-35-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-31-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/2440-29-0x0000019E75380000-0x0000019E7589B000-memory.dmp
memory/3568-7-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-19-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-20-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-21-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-4-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-5-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-8-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-10-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-15-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-3-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-6-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-1-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-9-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-17-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-11-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-12-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-13-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-16-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-14-0x000002A462B10000-0x000002A46302B000-memory.dmp
memory/3568-2-0x000002A462B10000-0x000002A46302B000-memory.dmp