2026-03-08_060c0e17b19eda9217cf3b0823f3fc35_elex_icedid_mountlocker

Sharing

Copy URL Twitter E-mail

General

Target
2026-03-08_060c0e17b19eda9217cf3b0823f3fc35_elex_icedid_mountlocker
Size 64KB
Sample260308-e26vsagt7n
SHA256 cde808e8852ed1f04c9579b72f01e46746896235c70fee3ab4c77013df715552
MD5 060c0e17b19eda9217cf3b0823f3fc35
SHA1 f91aea85f93c9ba58b3581734e246915a286a39c
SHA512 55a995c3180f47c4a4efd9f82c9b1c32b9ac94269fd4a8e83489d47ed4e1a23615740a2b505dfc76813e764c11b700b2f6f90dda3fa3e370f710f54429c11e58
SSDEEP 768:GeJ9uwtbJD/QpEdTrArzVpCK1w22TYgNvCJ037FLxZKQJRNz0TqXfJChu0L:GHwr1AB0AwB57F9npz0Ta4hu0L
TLSH
T1DB53BE52DCD2D472FEA364F0369D5B21EF7AD2264170C4178B80EF659A74212EA2F13B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-08_060c0e17b19eda9217cf3b0823f3fc35_elex_icedid_mountlocker

File Explorer

2026-03-08_060c0e17b19eda9217cf3b0823f3fc35_elex_icedid_mountlocker

.exe 64KB

2026-03-08_060c0e17b19eda9217cf3b0823f3fc35_elex_icedid_mountlocker

IMPHASH 68b5e41a24d5a26c1c2196733789c238
SHA256 cde808e8852ed1f04c9579b72f01e46746896235c70fee3ab4c77013df715552
MD5 060c0e17b19eda9217cf3b0823f3fc35
SHA1 f91aea85f93c9ba58b3581734e246915a286a39c
SHA512 55a995c3180f47c4a4efd9f82c9b1c32b9ac94269fd4a8e83489d47ed4e1a23615740a2b505dfc76813e764c11b700b2f6f90dda3fa3e370f710f54429c11e58
SSDEEP 768:GeJ9uwtbJD/QpEdTrArzVpCK1w22TYgNvCJ037FLxZKQJRNz0TqXfJChu0L:GHwr1AB0AwB57F9npz0Ta4hu0L
TLSH
T1DB53BE52DCD2D472FEA364F0369D5B21EF7AD2264170C4178B80EF659A74212EA2F13B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23753

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mpr

WNetCancelConnection2W WNetOpenEnumW WNetEnumResourceW WNetCloseEnum WNetAddConnection2W

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoInitializeSecurity

activeds

ord9

user32

wsprintfW

advapi32

LookupAccountSidW GetTokenInformation LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken GetUserNameW QueryServiceStatusEx OpenServiceA OpenSCManagerW OpenSCManagerA EnumServicesStatusA StartServiceW CryptDestroyKey DeleteService CreateServiceW CryptAcquireContextW CryptReleaseContext CloseServiceHandle CryptImportKey CryptEncrypt ControlService

ntdll

RtlGetNativeSystemInformation RtlGetVersion ZwQuerySystemInformation

shell32

ord680 CommandLineToArgvW

kernel32

GetComputerNameA TerminateProcess OpenProcess lstrcmpiA GetModuleFileNameW GetTempPathW CreateProcessW GetSystemInfo GlobalMemoryStatus GetComputerNameW DeleteFileW CopyFileW GetStdHandle InitializeCriticalSection ReleaseSemaphore lstrlenA SetConsoleCursorPosition GetConsoleScreenBufferInfo WriteConsoleW AllocConsole DeleteCriticalSection LeaveCriticalSection HeapAlloc GetProcessHeap lstrcpyW lstrcatW lstrlenW FindClose FindFirstFileW FindNextFileW GetVolumeInformationW GetLastError HeapFree CreateFileW WriteFile CloseHandle SetLastError HeapReAlloc GetCurrentProcessId WideCharToMultiByte Sleep GetTickCount QueryPerformanceCounter QueryPerformanceFrequency GetCurrentProcess SetEvent TlsAlloc WaitForSingleObject CreateEventA CreateThread GetTickCount64 CreateSemaphoreA SetFileAttributesW DeviceIoControl lstrcmpiW ResetEvent TerminateThread GetFileSizeEx ReadFile SetEndOfFile SetFileInformationByHandle SetFilePointerEx TlsGetValue TlsSetValue GetDriveTypeW GetCommandLineW ExitProcess SetErrorMode EnterCriticalSection

shlwapi

StrCmpNIW StrStrIW StrStrIA SHRegSetUSValueW StrCmpIW StrChrW

netapi32

NetGetDCName NetGetJoinInformation NetShareEnum NetApiBufferFree

oleaut32

SysFreeString SysAllocString

msvcrt

memset feof fgetws _wfopen _vsnwprintf fclose _getch

Name

.text

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-03-08_060c0e17b19eda9217cf3b0823f3fc35_elex_icedid_mountlocker

mpr

ole32

activeds

user32

advapi32

ntdll

shell32

kernel32

shlwapi

netapi32

oleaut32

msvcrt

generic