db241dbd789fbf9ca576d26824e82d945296bdb3b4d2863725125f7819a05b86

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/10/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-15_0aca50e8012560559c35d6eb7112ca5b_icedid_njrat.exe
Size 2.7MB
Sample261016-3ptaxset2l
SHA256 db241dbd789fbf9ca576d26824e82d945296bdb3b4d2863725125f7819a05b86
MD5 0aca50e8012560559c35d6eb7112ca5b
SHA1 c5dc5e3cf92b8136ce89efb1981dc4c66d1b0908
SHA512 e2a5e3da681f9f2026be833101c4bc61043180b1b541ce7f3078c2895b2d35da60d8ab70e64bf1821f2f59f7712183ba0677bbfb77723be70e3fb610581a7cac
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90E:AXRE5hpVGh5Rj+bkVexGRuE
TLSH
T1A0D5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution privilege_escalation

Malware Config

Signatures

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
behavioral1/files/0x001a0000000242b1-3.dat	INDICATOR_SUSPICIOUS_ClearWinLogs

Executes dropped EXE 1 IoCs

pid	Process
836	msedge.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2508	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	msedge.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2508	cmd.exe
2016	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2016	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
836	msedge.exe
836	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3296	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3296	Process not Found
Token: SeCreatePagefilePrivilege	3296	Process not Found
Token: SeShutdownPrivilege	3296	Process not Found
Token: SeCreatePagefilePrivilege	3296	Process not Found
Token: SeShutdownPrivilege	3296	Process not Found
Token: SeCreatePagefilePrivilege	3296	Process not Found

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3296	Process not Found
3296	Process not Found
3296	Process not Found

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3296	Process not Found
3296	Process not Found
3296	Process not Found

Suspicious use of UnmapMainImage 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Hollowing

T1055.012

pid	Process
3296	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 836	1720	2026-10-15_0aca50e8012560559c35d6eb7112ca5b_icedid_njrat.exe	84
PID 1720 wrote to memory of 2508	1720	2026-10-15_0aca50e8012560559c35d6eb7112ca5b_icedid_njrat.exe	85
PID 2508 wrote to memory of 2016	2508	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-10-15_0aca50e8012560559c35d6eb7112ca5b_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_0aca50e8012560559c35d6eb7112ca5b_icedid_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\msedge.exe
  "C:\Users\Admin\AppData\Local\Temp\msedge.exe" --randomized
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:836
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping localhost -n 2 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0aca50e8012560559c35d6eb7112ca5b_icedid_njrat.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Process Injection

T1055

Process Hollowing

T1055.012

Defense Evasion

Process Injection

T1055

Process Hollowing

T1055.012

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge.exe

Path C:\Users\Admin\AppData\Local\Temp\msedge.exe
Size 2.7MB
SHA256 00171a62a43cd211b61de372a887e84f0e0b71d98580609f357e9e0d862b7029
MD5 fc800a97cad1112a0b53e17b86a3e288
SHA1 81c48c53a2d98336e777ce8fce8f95bac8f759ce
SHA512 5c3e82e2a571a6a8c77286b9cc982c2e6344ff62568cc53057e838d4a4dc754143ce1b6bf9124ecfba3ad29f2a8cf5dcac35256205855368f4aa6d3905e66ffb
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90u:AXRE5hpVGh5Rj+bkVexGRuu
TLSH
T161D5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3296-5-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

Download