Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/05/2026, 03:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe
- Size 455KB
- Sample260503-d2mlgaa16v
- SHA256 03493efdc5dc9f2aab8ef010eb38244ad7ccfd9fdcec59cc770dff27f9fff1a1
- MD5 4f63c82fb8d8c3660f99367cd7bfb404
- SHA1 a43a6555701b74fd373d7171915a3b4b4f9e46a5
- SHA512 449027cec2e7998a8664a495876136a9211c55c4273982daf9bc4a41e22be65465f71c135e582009073b151b65a61c43539c7a27bd5a594bd5ec9135b56507da
- SSDEEP 12288:L5hVs0nRiW4SdUzWAenWRHcfoQwYl4Kb+YdoGP:L5hVs0nRiMHnWRHcfs64Kb+IoGP
- TLSH T19BA46C06E7F504B4F0F3AA34CD764606EAB77C555A308A5F23A9865A2F737608D38723
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 5480 Logo1_.exe 572 2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\WeatherStub.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe Logo1_.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe File created C:\Windows\virDll.dll Logo1_.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 5480 Logo1_.exe 5480 Logo1_.exe 5480 Logo1_.exe 5480 Logo1_.exe 5480 Logo1_.exe 5480 Logo1_.exe 5480 Logo1_.exe 5480 Logo1_.exe 5480 Logo1_.exe 5480 Logo1_.exe 5480 Logo1_.exe 5480 Logo1_.exe 5480 Logo1_.exe 5480 Logo1_.exe 5480 Logo1_.exe 5480 Logo1_.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4568 wrote to memory of 1164 4568 2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe 79 PID 4568 wrote to memory of 5480 4568 2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe 80 PID 1164 wrote to memory of 572 1164 cmd.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD33.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe"3⤵
- Executes dropped EXE
PID:572
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5480
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zG.exe
- Size 750KB
- SHA256 a14970c1912b8f06c122701c950d22536157d6411ff190c6b8bbdff5bae37cf3
- MD5 952cdf7350b50fdecce3262b45009706
- SHA1 2e679862161fff598fb4089b1b58d4f154726412
- SHA512 8607f6ecd45d1e21fc3eb413af2b319cbd335ba8a98b0cc6860988a20b50a8aec06ad16df59bb875568a7dc321b2adfd9c114f5690db77a221e29b750f241c77
- SSDEEP 12288:L5hV9VJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:L5hV9VbqPb88hv/l+7
- TLSH T14BF42A66F574C331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E677D6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$aCD33.bat
- Size 704B
- SHA256 a840fb4afb2e62906a21a993649850af4e961d30ca046a31f6f2c3afe9a0f0d0
- MD5 b9dbde5f3c5850aeb1333a07856918ba
- SHA1 7e998bfe75ea3a5bce833548fe7f62d021d4de83
- SHA512 ed61e59844a1622e4815d38a6406edafe4569d99b466c37acfc786dbf228a9fa13e9e46aa86ac38de48e9e30c6ae2bd3bfd358d93384261402d0656004085e4d
- TLSH T14601F93247DBA9DF5806A43B9ED388AEC8F23F447F543399E726E86520C205D78D3150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-03_4f63c82fb8d8c3660f99367cd7bfb404_elex_icedid_njrat.exe.exe
- Size 397KB
- SHA256 bf66dd32c448f5e80506c8cc9655dec8683f6047f998b0957f4660fc82668e10
- MD5 5bbe43a54b8facc512f295204bcc6500
- SHA1 f120f40a14a02760a4fd01406fd7d1deaf0c4cd9
- SHA512 373a04f76073a8b3d65459e2aeccf0a83f96cc299d17a04fd5ccbfb9446e23e0842f2dcffa8335d34e664eb59f16ffe2138e5297f2e1b0dcb54ca0b0ca9dfafc
- SSDEEP 12288:s0nRiW4SdUzWAenWRHcfoQwYl4Kb+YdoGP:s0nRiMHnWRHcfs64Kb+IoGP
- TLSH T1BF845B05E7F504A8F1F3AA34CD764606EAB77C955A308A5F13A9825A2F737608D38733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 58KB
- SHA256 cf970bd7bee89e549a5dda1346b4e6d3e181391fe54c8ee0b8bce832ce0a74f7
- MD5 e523b8691c65acea1e3c1cc52055d8f9
- SHA1 5387d3232f4a54e7c43ee2b11d6397229d54645a
- SHA512 56fadb4f872885d7f7da087fc8bfaf826168cf2043c8573b42b9c84e9fafaa307952ac6760ab37f9843ea7a3b5f82c4b84e5d2c4f5287cf8b9df0d521df73510
- SSDEEP 1536:j4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmit:YKtfDwsjPThTYszDH2f
- TLSH T16A437D5BFA90CC32D03825FC5C19D2D6B6BAB6702D1E0962B9F99F0CDC2B2D2551C257
- MD5 SHA1 SHA512 SSDEEP TLSH