Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/05/2026, 22:55
Behavioral task
behavioral1
Sample
2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe
Resource
win11-20260130-en
windows11-21h2-x64
14 signatures
150 seconds
General
- Target 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe
- Size 1.1MB
- Sample260509-2v69ashs8p
- SHA256 95c11ee9279a1b832e002689993f69eae6b8bf0d4681c69ad0cc21e73f3dff1c
- MD5 ecc6d2124165022546f4a578cfcdd6b3
- SHA1 c3d5640bbb2bd437199cdab8be23c9963ee567c8
- SHA512 33f2af7b8863687f5cda5ed0d365b970a8e9c9e5cbc4daeb3993079b43e561075b34e624326b7abac446b212e6d24d7be8fbedca61c5dd9e9a4a847095a02115
- SSDEEP 12288:z6Wq4aaE6KwyF5L0Y2D1PqLb6Wq44er5+nZoybaE6KwyF5L0Y2D1PqLx6Wq4aaEy:ZthEVaPqLBt0KEVaPqLHthEVaPqLTthi
- TLSH T14035025E77A9E8D3DC744E31EC62428142B078A36F619B7B60D4520F5CBF1749E26F28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe - Custom signatureUPX dump on OEP (original entry point) 3 IoCs
resource yara_rule behavioral1/files/0x00030000000231c7-5.dat UPX behavioral1/files/0x00070000000243e2-125.dat UPX behavioral1/memory/4504-981-0x0000000000400000-0x0000000000544000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 1048 svhost.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\e: svhost.exe - AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1048-7-0x0000000000400000-0x0000000000544000-memory.dmp autoit_exe behavioral1/memory/4504-785-0x0000000000400000-0x0000000000544000-memory.dmp autoit_exe behavioral1/memory/1048-898-0x0000000000400000-0x0000000000544000-memory.dmp autoit_exe behavioral1/memory/4504-981-0x0000000000400000-0x0000000000544000-memory.dmp autoit_exe behavioral1/memory/1048-1126-0x0000000000400000-0x0000000000544000-memory.dmp autoit_exe -
resource yara_rule behavioral1/memory/4504-0-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral1/files/0x00030000000231c7-5.dat upx behavioral1/memory/1048-7-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral1/memory/1048-6-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral1/files/0x00070000000243e2-125.dat upx behavioral1/memory/4504-785-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral1/memory/1048-898-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral1/memory/4504-981-0x0000000000400000-0x0000000000544000-memory.dmp upx behavioral1/memory/1048-1126-0x0000000000400000-0x0000000000544000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe File opened for modification C:\Windows\Driver.db svhost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1048 svhost.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe 1048 svhost.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4504 wrote to memory of 1048 4504 2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-09_ecc6d2124165022546f4a578cfcdd6b3_coinminer_elex_icedid_njrat_xloader.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1048
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PerfLogs.exe
- Size 1.1MB
- SHA256 ab8b3dbe4364a6e248ea5c6096fb47b48df632cdb3f5d530da9cf287d313c77e
- MD5 6166acaf2c8d73b2f687390bc131a0e5
- SHA1 c5fa2b801723df8f23089c8fbd7bf43bf81965a9
- SHA512 9f39975eaf35207343eea7106a7e85fc895e1c12b7dae486a57a572bcad6d7bdca6b810a73cf22f866d5ebd5104f52c5b7b156df0e0a808c29abb1175df84881
- SSDEEP 12288:z6Wq4aaE6KwyF5L0Y2D1PqLb6Wq44er5+nZoybaE6KwyF5L0Y2D1PqLx6Wq4aaEy:ZthEVaPqLBt0KEVaPqLHthEVaPqLTthi
- TLSH T1D635025E77A9E8D3DC744E31EC62428142B078A36F619B7B60D4520F5CBF1749E26F28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Driver.db
- Size 82B
- SHA256 b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
- MD5 c2d2dc50dca8a2bfdc8e2d59dfa5796d
- SHA1 7a6150fc53244e28d1bcea437c0c9d276c41ccad
- SHA512 6cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
- TLSH T163A0112832A830A28EE0A00EB0FAC000E28820A00E02882A0800002E0CA83B02C00222
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\svhost.exe
- Size 1.1MB
- SHA256 0b711cda5eb548f94da3bad15ea50a00ed9a4dacd543bd425a51adff22314953
- MD5 1f7d388a97c901910155a769647e1c20
- SHA1 c40758ad30cafd28ef2adac78758fcb4b63a2817
- SHA512 f0054078a1ca74d1854bfc47564daee4931a147ac0842625c575084dca1ce0b9f02a4a5a8664556650a19fed0367c65930d0a7d9cf3da7287f5eceb199c0ac97
- SSDEEP 12288:z6Wq4aaE6KwyF5L0Y2D1PqLb6Wq44er5+nZoybaE6KwyF5L0Y2D1PqLx6Wq4aaEC:ZthEVaPqLBt0KEVaPqLHthEVaPqLTthS
- TLSH T12635025E77A9E8D3DC744E31EC62428142B078A36F619B7B60D4520F5CBF1749E26F28
- MD5 SHA1 SHA512 SSDEEP TLSH