Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/05/2026, 03:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe
- Size 455KB
- Sample260503-d2mlgaa16v
- SHA256 03493efdc5dc9f2aab8ef010eb38244ad7ccfd9fdcec59cc770dff27f9fff1a1
- MD5 4f63c82fb8d8c3660f99367cd7bfb404
- SHA1 a43a6555701b74fd373d7171915a3b4b4f9e46a5
- SHA512 449027cec2e7998a8664a495876136a9211c55c4273982daf9bc4a41e22be65465f71c135e582009073b151b65a61c43539c7a27bd5a594bd5ec9135b56507da
- SSDEEP 12288:L5hVs0nRiW4SdUzWAenWRHcfoQwYl4Kb+YdoGP:L5hVs0nRiMHnWRHcfs64Kb+IoGP
- TLSH T19BA46C06E7F504B4F0F3AA34CD764606EAB77C555A308A5F23A9865A2F737608D38723
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4792 Logo1_.exe 4476 2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\dotnet.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\144.0.3719.93\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93281\javaws.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe Logo1_.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\144.0.3719.93\elevated_tracing_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\144.0.3719.93\Installer\copilot_setup.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe Logo1_.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe File created C:\Windows\virDll.dll Logo1_.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4792 Logo1_.exe 4792 Logo1_.exe 4792 Logo1_.exe 4792 Logo1_.exe 4792 Logo1_.exe 4792 Logo1_.exe 4792 Logo1_.exe 4792 Logo1_.exe 4792 Logo1_.exe 4792 Logo1_.exe 4792 Logo1_.exe 4792 Logo1_.exe 4792 Logo1_.exe 4792 Logo1_.exe 4792 Logo1_.exe 4792 Logo1_.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4948 wrote to memory of 4024 4948 2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe 86 PID 4948 wrote to memory of 4792 4948 2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe 87 PID 4024 wrote to memory of 4476 4024 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFED2.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe"3⤵
- Executes dropped EXE
PID:4476
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4792
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zG.exe
- Size 750KB
- SHA256 a14970c1912b8f06c122701c950d22536157d6411ff190c6b8bbdff5bae37cf3
- MD5 952cdf7350b50fdecce3262b45009706
- SHA1 2e679862161fff598fb4089b1b58d4f154726412
- SHA512 8607f6ecd45d1e21fc3eb413af2b319cbd335ba8a98b0cc6860988a20b50a8aec06ad16df59bb875568a7dc321b2adfd9c114f5690db77a221e29b750f241c77
- SSDEEP 12288:L5hV9VJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:L5hV9VbqPb88hv/l+7
- TLSH T14BF42A66F574C331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E677D6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$aFED2.bat
- Size 704B
- SHA256 b0164c030fb86638d7f554cfb03a3c1d4b4ff81065323b8f4b9cedad1fb1f2e8
- MD5 628c8b12a1851670173c655f05357137
- SHA1 f7d1edf317fb8b50f1ec4f938b8620a8b96d5923
- SHA512 9c1cce4dab3aa2eac67f463431d8fa435cd03d9c2c895f9e34315b6ab813f9bcb4a490a8957cb08efe3be4127d17f00e310dcb162b793818372adff5173e36a6
- TLSH T1AE01D62246DBA9DF4806A42B9ED398AEC8F23F447F142399E726A86520C105D78C3150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe.exe
- Size 397KB
- SHA256 bf66dd32c448f5e80506c8cc9655dec8683f6047f998b0957f4660fc82668e10
- MD5 5bbe43a54b8facc512f295204bcc6500
- SHA1 f120f40a14a02760a4fd01406fd7d1deaf0c4cd9
- SHA512 373a04f76073a8b3d65459e2aeccf0a83f96cc299d17a04fd5ccbfb9446e23e0842f2dcffa8335d34e664eb59f16ffe2138e5297f2e1b0dcb54ca0b0ca9dfafc
- SSDEEP 12288:s0nRiW4SdUzWAenWRHcfoQwYl4Kb+YdoGP:s0nRiMHnWRHcfs64Kb+IoGP
- TLSH T1BF845B05E7F504A8F1F3AA34CD764606EAB77C955A308A5F13A9825A2F737608D38733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 58KB
- SHA256 cf970bd7bee89e549a5dda1346b4e6d3e181391fe54c8ee0b8bce832ce0a74f7
- MD5 e523b8691c65acea1e3c1cc52055d8f9
- SHA1 5387d3232f4a54e7c43ee2b11d6397229d54645a
- SHA512 56fadb4f872885d7f7da087fc8bfaf826168cf2043c8573b42b9c84e9fafaa307952ac6760ab37f9843ea7a3b5f82c4b84e5d2c4f5287cf8b9df0d521df73510
- SSDEEP 1536:j4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmit:YKtfDwsjPThTYszDH2f
- TLSH T16A437D5BFA90CC32D03825FC5C19D2D6B6BAB6702D1E0962B9F99F0CDC2B2D2551C257
- MD5 SHA1 SHA512 SSDEEP TLSH