Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/04/2026, 03:50
Behavioral task
behavioral1
Sample
2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe
Resource
win11-20260130-en
windows11-21h2-x64
14 signatures
150 seconds
General
- Target 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe
- Size 1.1MB
- Sample260421-ed1nvsbs91
- SHA256 3dd19448c609628dad3c04efa2d6267ba544177695f919ba4b85e1b800f52539
- MD5 828adf88ac62ba7e9111442ac0286abe
- SHA1 6761eb3c81f51a71bd6ca47c7332bc665072cd2c
- SHA512 cbb7cd48af8894495e6dfb3751ea2aa1d0ba654cf9f84df6048e0c8fde9856b25b6a0f2065233f58d4f52b1a1b06d67190316f566fc0aa2a043cfe58c779c49c
- SSDEEP 12288:z6Wq4aaE6KwyF5L0Y2D1PqLb6Wq44er5+nZoybaE6KwyF5L0Y2D1PqLx6Wq4aaEp:ZthEVaPqLBt0KEVaPqLHthEVaPqLTth5
- TLSH T19D35029E77A9E8D3DC744E31EC62428142B078A36F619B7B60D4520F5CBF1749E26F28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe - UPX dump on OEP (original entry point) 3 IoCs
resource yara_rule behavioral1/files/0x001e00000002423a-5.dat UPX behavioral1/files/0x00070000000243ba-125.dat UPX behavioral1/memory/2464-914-0x0000000000400000-0x0000000000544000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 3852 svhost.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\v: svhost.exe - AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/3852-7-0x0000000000400000-0x0000000000544000-memory.dmp autoit_exe behavioral1/memory/3852-6-0x0000000000400000-0x0000000000544000-memory.dmp autoit_exe behavioral1/memory/2464-733-0x0000000000400000-0x0000000000544000-memory.dmp autoit_exe behavioral1/memory/2464-914-0x0000000000400000-0x0000000000544000-memory.dmp autoit_exe behavioral1/memory/3852-947-0x0000000000400000-0x0000000000544000-memory.dmp autoit_exe behavioral1/memory/3852-948-0x0000000000400000-0x0000000000544000-memory.dmp autoit_exe -
resource yara_rule behavioral1/memory/2464-0-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral1/files/0x001e00000002423a-5.dat upx behavioral1/memory/3852-7-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral1/memory/3852-6-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral1/files/0x00070000000243ba-125.dat upx behavioral1/memory/2464-733-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral1/memory/2464-914-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral1/memory/3852-947-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral1/memory/3852-948-0x0000000000400000-0x0000000000544000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe File opened for modification C:\Windows\Driver.db svhost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3852 svhost.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe 3852 svhost.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2464 wrote to memory of 3852 2464 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3852
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PerfLogs.exe
- Size 1.1MB
- SHA256 ac13eef7bc079010894c2c573eaaa24e659f161448deba29e7c8497e6b25d679
- MD5 1161974c5a095e0abf8162483104e9f8
- SHA1 55da91ce9d23dd8af823c1d645571de4d3ef03b1
- SHA512 7a0a82d7bd9e2b17b2c20d780479d7715fd05e05b55a70417034dcd8ca7fb364e6bb4ef81ec679a431107f842808b1a71595fbcb2eea6c0a60639bf4a112bf3d
- SSDEEP 12288:z6Wq4aaE6KwyF5L0Y2D1PqLb6Wq44er5+nZoybaE6KwyF5L0Y2D1PqLx6Wq4aaET:ZthEVaPqLBt0KEVaPqLHthEVaPqLTthj
- TLSH T1CC35029E77A9E8D3DC744E31EC62428142B078A36F619B7B60D4520F5CBF1749E26F28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Driver.db
- Size 82B
- SHA256 b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
- MD5 c2d2dc50dca8a2bfdc8e2d59dfa5796d
- SHA1 7a6150fc53244e28d1bcea437c0c9d276c41ccad
- SHA512 6cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
- TLSH T163A0112832A830A28EE0A00EB0FAC000E28820A00E02882A0800002E0CA83B02C00222
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\svhost.exe
- Size 1.1MB
- SHA256 dc85afbf7ba9686b072c57e44bd51c44a891efaadeca71d8f9dbc99032fa89f0
- MD5 f266d00a71957a0bae6d6664f5ae7d6c
- SHA1 cb3cc630c3a87d2833b399f0545a3d80a59d19ec
- SHA512 9114bbd7398dfed863a5f0ade2798fad6ed117bf05b7ce0c907e7264bd4707be5811fde1b9c98f1a62bac5412f911d3e482b7798bed2acb0e1f411c82ef61986
- SSDEEP 12288:z6Wq4aaE6KwyF5L0Y2D1PqLb6Wq44er5+nZoybaE6KwyF5L0Y2D1PqLx6Wq4aaEr:ZthEVaPqLBt0KEVaPqLHthEVaPqLTthb
- TLSH T19435029E77A9E8D3DC744E31EC62428142B078A36F619B7B60D4520F5CBF1749E26F28
- MD5 SHA1 SHA512 SSDEEP TLSH