d60a17e74ffd7c356c2a6d7233057157f06b68ba9f17afb9def822386e572790

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_aa32c7a8ed6b7808b7813dfcbf9ea8cc_icedid_njrat.exe
Size 2.7MB
Sample261017-lpmpps1thv
SHA256 d60a17e74ffd7c356c2a6d7233057157f06b68ba9f17afb9def822386e572790
MD5 aa32c7a8ed6b7808b7813dfcbf9ea8cc
SHA1 892d6a7910233278efdb5ef976fe06f014fa776e
SHA512 97a98df3851c1e40ef0ae318999c698382d185ea5fde4d0eb39c2391abc48165e954d90e303078a309888cd5e26c33e3aa99d05484982f50b6b8b1b604e7fbd5
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90M:AXRE5hpVGh5Rj+bkVexGRuM
TLSH
T171D5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution privilege_escalation

Malware Config

Signatures

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000242b4-4.dat	INDICATOR_SUSPICIOUS_ClearWinLogs

Executes dropped EXE 1 IoCs

pid	Process
728	msedge.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1016	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	msedge.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1016	cmd.exe
556	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
556	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
728	msedge.exe
728	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3256	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3256	Process not Found
3256	Process not Found
3256	Process not Found

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3256	Process not Found
3256	Process not Found
3256	Process not Found

Suspicious use of UnmapMainImage 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Hollowing

T1055.012

pid	Process
3256	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 728	3816	2026-10-16_aa32c7a8ed6b7808b7813dfcbf9ea8cc_icedid_njrat.exe	86
PID 3816 wrote to memory of 1016	3816	2026-10-16_aa32c7a8ed6b7808b7813dfcbf9ea8cc_icedid_njrat.exe	87
PID 1016 wrote to memory of 556	1016	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-16_aa32c7a8ed6b7808b7813dfcbf9ea8cc_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_aa32c7a8ed6b7808b7813dfcbf9ea8cc_icedid_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Users\Admin\AppData\Local\Temp\msedge.exe
  "C:\Users\Admin\AppData\Local\Temp\msedge.exe" --randomized
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:728
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping localhost -n 2 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-10-16_aa32c7a8ed6b7808b7813dfcbf9ea8cc_icedid_njrat.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Process Injection

T1055

Process Hollowing

T1055.012

Defense Evasion

Process Injection

T1055

Process Hollowing

T1055.012

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge.exe

Path C:\Users\Admin\AppData\Local\Temp\msedge.exe
Size 2.7MB
SHA256 22679e2fcc69712f2046c43460b5f78b9ae7745d64a56dfd5220397aaa730c39
MD5 8f63ab47b56eaecf7b3a75c163b8c944
SHA1 1a3df87509b2609c1388bee5b4c53c9ccb228664
SHA512 c85c22dcb6bf8e3213a76072a86be87c74b2276e7220f5a6cf9cb131e716defa37cd837b746a78952de4539badd275380eb8c3d8b9e466b7982f6be70bf9fe0b
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR907:AXRE5hpVGh5Rj+bkVexGRu7
TLSH
T19AD5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3256-5-0x0000000002F50000-0x0000000002F51000-memory.dmp

Download