Analysis
- max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
21/04/2026, 03:50
Behavioral task
behavioral1
Sample
2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe
Resource
win11-20260130-en
windows11-21h2-x64
14 signatures
150 seconds
General
- Target 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe
- Size 1.1MB
- Sample260421-ed1nvsbs91
- SHA256 3dd19448c609628dad3c04efa2d6267ba544177695f919ba4b85e1b800f52539
- MD5 828adf88ac62ba7e9111442ac0286abe
- SHA1 6761eb3c81f51a71bd6ca47c7332bc665072cd2c
- SHA512 cbb7cd48af8894495e6dfb3751ea2aa1d0ba654cf9f84df6048e0c8fde9856b25b6a0f2065233f58d4f52b1a1b06d67190316f566fc0aa2a043cfe58c779c49c
- SSDEEP 12288:z6Wq4aaE6KwyF5L0Y2D1PqLb6Wq44er5+nZoybaE6KwyF5L0Y2D1PqLx6Wq4aaEp:ZthEVaPqLBt0KEVaPqLHthEVaPqLTth5
- TLSH T19D35029E77A9E8D3DC744E31EC62428142B078A36F619B7B60D4520F5CBF1749E26F28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe - UPX dump on OEP (original entry point) 3 IoCs
resource yara_rule behavioral2/files/0x001d00000002b0fa-4.dat UPX behavioral2/files/0x001900000002b2eb-144.dat UPX behavioral2/memory/2036-986-0x0000000000400000-0x0000000000544000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 3372 svhost.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\e: svhost.exe - AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3372-7-0x0000000000400000-0x0000000000544000-memory.dmp autoit_exe behavioral2/memory/2036-802-0x0000000000400000-0x0000000000544000-memory.dmp autoit_exe behavioral2/memory/2036-986-0x0000000000400000-0x0000000000544000-memory.dmp autoit_exe behavioral2/memory/3372-990-0x0000000000400000-0x0000000000544000-memory.dmp autoit_exe behavioral2/memory/3372-1007-0x0000000000400000-0x0000000000544000-memory.dmp autoit_exe -
resource yara_rule behavioral2/memory/2036-0-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral2/files/0x001d00000002b0fa-4.dat upx behavioral2/memory/3372-6-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral2/memory/3372-7-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral2/files/0x001900000002b2eb-144.dat upx behavioral2/memory/2036-802-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral2/memory/2036-986-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral2/memory/3372-990-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral2/memory/3372-1007-0x0000000000400000-0x0000000000544000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Driver.db svhost.exe File created C:\Windows\svhost.exe 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3372 svhost.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe 3372 svhost.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2036 wrote to memory of 3372 2036 2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_828adf88ac62ba7e9111442ac0286abe_coinminer_elex_icedid_njrat_xloader.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3372
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PerfLogs.exe
- Size 1.1MB
- SHA256 018b11510ba029d013e263df8a5e077fca593c240548ce58a2fe702b20399a89
- MD5 68497fc4e03d7c6369fa7c6278d00ef1
- SHA1 e65adf6d50707e5f1ef2fe1383cb3644dcaa5703
- SHA512 836cfe46d3ccf7d0f0109bd1d8a412366d8d1bd1a63eb859029259ff0a0c596a4edca09b8fd0b76c4339cacf01a8230fb2e9c7d03c8ca3be859b32afc58898d0
- SSDEEP 12288:z6Wq4aaE6KwyF5L0Y2D1PqLb6Wq44er5+nZoybaE6KwyF5L0Y2D1PqLx6Wq4aaEj:ZthEVaPqLBt0KEVaPqLHthEVaPqLTthz
- TLSH T10035029E77A9E8D3DC744E31EC62428142B078A36F619B7B60D4520F5CBF1749E26F28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Driver.db
- Size 82B
- SHA256 b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
- MD5 c2d2dc50dca8a2bfdc8e2d59dfa5796d
- SHA1 7a6150fc53244e28d1bcea437c0c9d276c41ccad
- SHA512 6cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
- TLSH T163A0112832A830A28EE0A00EB0FAC000E28820A00E02882A0800002E0CA83B02C00222
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\svhost.exe
- Size 1.1MB
- SHA256 dc85afbf7ba9686b072c57e44bd51c44a891efaadeca71d8f9dbc99032fa89f0
- MD5 f266d00a71957a0bae6d6664f5ae7d6c
- SHA1 cb3cc630c3a87d2833b399f0545a3d80a59d19ec
- SHA512 9114bbd7398dfed863a5f0ade2798fad6ed117bf05b7ce0c907e7264bd4707be5811fde1b9c98f1a62bac5412f911d3e482b7798bed2acb0e1f411c82ef61986
- SSDEEP 12288:z6Wq4aaE6KwyF5L0Y2D1PqLb6Wq44er5+nZoybaE6KwyF5L0Y2D1PqLx6Wq4aaEr:ZthEVaPqLBt0KEVaPqLHthEVaPqLTthb
- TLSH T19435029E77A9E8D3DC744E31EC62428142B078A36F619B7B60D4520F5CBF1749E26F28
- MD5 SHA1 SHA512 SSDEEP TLSH