a81228744db97c50764cfca6e70fa4817094853f2090802417b149bf67d3bd06

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_23a1e036200eedd4f2b52ddc897e5d44_elex_icedid.exe
Size 25KB
Sample260711-aa3a3af15p
SHA256 a81228744db97c50764cfca6e70fa4817094853f2090802417b149bf67d3bd06
MD5 23a1e036200eedd4f2b52ddc897e5d44
SHA1 18dbbecfb6eefbdf67911f3e43f73e47ad05e2e2
SHA512 ff4412323d9da409418670f475e47f05d57278c113fc935f7863092081a8ef9e74066201af2817abd20f665c8f1975eab6e20d7975646a2cc6ae6e82b632ea49
SSDEEP 768:JEZkcHRXJBBBBohN28Cul/rzDzRw13JoE4pb:Ux5BBBBgN/CoHDtw1ZoFb
TLSH
T1A3C2D09FCFA9B443D39222B4349BAD35C1626E7481147E33C7BE18DA6D305C5CADE512
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3228	ayxuvtshmrr.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_23a1e036200eedd4f2b52ddc897e5d44_elex_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayxuvtshmrr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 6020	5856	2026-07-10_23a1e036200eedd4f2b52ddc897e5d44_elex_icedid.exe	87
PID 5856 wrote to memory of 6020	5856	2026-07-10_23a1e036200eedd4f2b52ddc897e5d44_elex_icedid.exe	87
PID 5856 wrote to memory of 6020	5856	2026-07-10_23a1e036200eedd4f2b52ddc897e5d44_elex_icedid.exe	87
PID 3228 wrote to memory of 5044	3228	ayxuvtshmrr.exe	90
PID 3228 wrote to memory of 5044	3228	ayxuvtshmrr.exe	90
PID 3228 wrote to memory of 5044	3228	ayxuvtshmrr.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-10_23a1e036200eedd4f2b52ddc897e5d44_elex_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_23a1e036200eedd4f2b52ddc897e5d44_elex_icedid.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6020

C:\ProgramData\{76A2B876-7A76-47FC-988B-1FDDC3B4012D}\ayxuvtshmrr.exe
"C:\ProgramData\{76A2B876-7A76-47FC-988B-1FDDC3B4012D}\ayxuvtshmrr.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ayxuvtshmrr.exe

Path C:\ProgramData\{76A2B876-7A76-47FC-988B-1FDDC3B4012D}\ayxuvtshmrr.exe
Size 25KB
SHA256 bd56eb633a32515d290296fc50b3ec7191ad3575f67f4bb4d1895907f4729186
MD5 9f98e25bd6ba4c66d631089e62df36a1
SHA1 a204a4350bdf005b543c1ac5691196c2ea2e7d8a
SHA512 0e146281d1c4e9306d240d4dfc336145e38018b70c709faff0650c422970a30140529967f7e4ba4a9e6d6afe9693f61ad33cfd8a6a3b00e420d8504727a63067
SSDEEP 768:jEZkcHRX9BBBBohN28Cul/rzDzRw13JoE4pb:GxtBBBBgN/CoHDtw1ZoFb
TLSH
T19CC2D08FCFA9B443E39222B4359BAD39C1626E7481147E33C7BE18DA6D305C5CADD512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5044-9-0x00000000006D0000-0x00000000006DB000-memory.dmp

Download

memory/6020-0-0x0000000000FB0000-0x0000000000FBB000-memory.dmp

Download

memory/6020-6-0x0000000000FB0000-0x0000000000FBB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads