2026-03-08_073af0796bda93eeb342f794d7da4517_elex_icedid_mountlocker

Sharing

Copy URL Twitter E-mail

General

Target
2026-03-08_073af0796bda93eeb342f794d7da4517_elex_icedid_mountlocker
Size 64KB
Sample260308-e3be9say2v
SHA256 78932bb8fe66d6dc5b421e94e2723705fd2a38a8b0c06456a603ab20536e884e
MD5 073af0796bda93eeb342f794d7da4517
SHA1 04bce15489d5084a7e4c4593dd3e797c2d7435ce
SHA512 2da1af15c7db832b8063d532ccd2811df92636d2a05875086c871244ce4865d5d7cfef3a59c4e7aa243b6166e429404b26dd2b485c10695a0aa984b194d9bd81
SSDEEP 768:GeJ9uwtbJD/QpEdTrArzVpCK1w22TYgNvCJ037FLxZKQJRNz0TqXfJCtu0L:GHwr1AB0AwB57F9npz0Ta4tu0L
TLSH
T12E53BE92CCD2D472FDA364F0369D5B21EF7AD226417084178B80EF659A74212EA2F13B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-08_073af0796bda93eeb342f794d7da4517_elex_icedid_mountlocker

File Explorer

2026-03-08_073af0796bda93eeb342f794d7da4517_elex_icedid_mountlocker

.exe 64KB

2026-03-08_073af0796bda93eeb342f794d7da4517_elex_icedid_mountlocker

IMPHASH 68b5e41a24d5a26c1c2196733789c238
SHA256 78932bb8fe66d6dc5b421e94e2723705fd2a38a8b0c06456a603ab20536e884e
MD5 073af0796bda93eeb342f794d7da4517
SHA1 04bce15489d5084a7e4c4593dd3e797c2d7435ce
SHA512 2da1af15c7db832b8063d532ccd2811df92636d2a05875086c871244ce4865d5d7cfef3a59c4e7aa243b6166e429404b26dd2b485c10695a0aa984b194d9bd81
SSDEEP 768:GeJ9uwtbJD/QpEdTrArzVpCK1w22TYgNvCJ037FLxZKQJRNz0TqXfJCtu0L:GHwr1AB0AwB57F9npz0Ta4tu0L
TLSH
T12E53BE92CCD2D472FDA364F0369D5B21EF7AD226417084178B80EF659A74212EA2F13B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23753

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mpr

WNetCancelConnection2W WNetOpenEnumW WNetEnumResourceW WNetCloseEnum WNetAddConnection2W

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoInitializeSecurity

activeds

ord9

user32

wsprintfW

advapi32

LookupAccountSidW GetTokenInformation LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken GetUserNameW QueryServiceStatusEx OpenServiceA OpenSCManagerW OpenSCManagerA EnumServicesStatusA StartServiceW CryptDestroyKey DeleteService CreateServiceW CryptAcquireContextW CryptReleaseContext CloseServiceHandle CryptImportKey CryptEncrypt ControlService

ntdll

RtlGetNativeSystemInformation RtlGetVersion ZwQuerySystemInformation

shell32

ord680 CommandLineToArgvW

kernel32

GetComputerNameA TerminateProcess OpenProcess lstrcmpiA GetModuleFileNameW GetTempPathW CreateProcessW GetSystemInfo GlobalMemoryStatus GetComputerNameW DeleteFileW CopyFileW GetStdHandle InitializeCriticalSection ReleaseSemaphore lstrlenA SetConsoleCursorPosition GetConsoleScreenBufferInfo WriteConsoleW AllocConsole DeleteCriticalSection LeaveCriticalSection HeapAlloc GetProcessHeap lstrcpyW lstrcatW lstrlenW FindClose FindFirstFileW FindNextFileW GetVolumeInformationW GetLastError HeapFree CreateFileW WriteFile CloseHandle SetLastError HeapReAlloc GetCurrentProcessId WideCharToMultiByte Sleep GetTickCount QueryPerformanceCounter QueryPerformanceFrequency GetCurrentProcess SetEvent TlsAlloc WaitForSingleObject CreateEventA CreateThread GetTickCount64 CreateSemaphoreA SetFileAttributesW DeviceIoControl lstrcmpiW ResetEvent TerminateThread GetFileSizeEx ReadFile SetEndOfFile SetFileInformationByHandle SetFilePointerEx TlsGetValue TlsSetValue GetDriveTypeW GetCommandLineW ExitProcess SetErrorMode EnterCriticalSection

shlwapi

StrCmpNIW StrStrIW StrStrIA SHRegSetUSValueW StrCmpIW StrChrW

netapi32

NetGetDCName NetGetJoinInformation NetShareEnum NetApiBufferFree

oleaut32

SysFreeString SysAllocString

msvcrt

memset feof fgetws _wfopen _vsnwprintf fclose _getch

Name

.text

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-03-08_073af0796bda93eeb342f794d7da4517_elex_icedid_mountlocker

mpr

ole32

activeds

user32

advapi32

ntdll

shell32

kernel32

shlwapi

netapi32

oleaut32

msvcrt

generic