Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 04:25
General
- Target 2026-10-22_93907a025cd5b470fcf6e7b33741a0ce_icedid_njrat.exe
- Size 6.0MB
- Sample261024-e2clyahx4m
- SHA256 3f5f15ff5b54ee8290a31d885295409cfc5a63b3b13002ea676ca3b9e3913f55
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
- Executes dropped EXE 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_93907a025cd5b470fcf6e7b33741a0ce_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_93907a025cd5b470fcf6e7b33741a0ce_icedid_njrat.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Xd4UKwD.exe"C:\Program Files\Xd4UKwD.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\U2Y0X.exe"C:\Program Files\U2Y0X.exe"3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Xd4UKwD.exe
memory/2364-26-0x00007FFEF8A00000-0x00007FFEF8C63000-memory.dmp
memory/2364-34-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2364-52-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2364-35-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2364-48-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2364-50-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2364-47-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2364-46-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2364-51-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2364-27-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2364-55-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2364-31-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2364-30-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2364-29-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2364-44-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2364-42-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2364-40-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2364-38-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2364-36-0x0000000180000000-0x00000001805CF000-memory.dmp
memory/2760-18-0x0000000180000000-0x00000001807F7000-memory.dmp
memory/2760-15-0x0000000180000000-0x00000001807F7000-memory.dmp
memory/2760-17-0x0000000180000000-0x00000001807F7000-memory.dmp
memory/2760-10-0x00007FFEF8A00000-0x00007FFEF8C63000-memory.dmp
memory/2760-13-0x0000000180000000-0x00000001807F7000-memory.dmp
memory/2760-12-0x0000000180000000-0x00000001807F7000-memory.dmp
memory/2760-54-0x0000000180000000-0x00000001807F7000-memory.dmp
memory/2760-7-0x000002348B610000-0x000002348B611000-memory.dmp
memory/2760-14-0x0000000180000000-0x00000001807F7000-memory.dmp
memory/2760-11-0x0000000180000000-0x00000001807F7000-memory.dmp
memory/5080-19-0x0000000140033000-0x00000001401F7000-memory.dmp
memory/5080-2-0x0000000140000000-0x0000000140FEC000-memory.dmp
memory/5080-0-0x0000000140033000-0x00000001401F7000-memory.dmp
memory/5080-1-0x00007FFEF8C70000-0x00007FFEF8C72000-memory.dmp