94b4f0f72fcd8bdfefdd1bf9147db128f16c5b209ec010b9105e0704e6e481a3

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 01:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_33956fae253df7550919aa435fc5e1d1_elex_icedid_njrat.exe
Size 3.4MB
Sample260714-b1daasev4s
SHA256 94b4f0f72fcd8bdfefdd1bf9147db128f16c5b209ec010b9105e0704e6e481a3
MD5 33956fae253df7550919aa435fc5e1d1
SHA1 85d2c823f0e88a801e19387baecb60c2cfcdc949
SHA512 8e93b1800411a6cf0cca58617907c6ce5de73607d3e9ae340d1c682aa9dcab16e595f86e208009a7a9f39343a5876b5d74b9aaa0baee40f74ccfe08d48dd92e6
SSDEEP 49152:G3mpnltBB850JijXWThgKme86ZJpCn7fTFkgkWXNUP2DlWy95p+lsGZ1OcPTY6Y9:hphB7g4+mpCX3hF/1Z9
TLSH
T132F56B13F19940D9C159C078CF56D232AB21BC4D47F266EB3A90BAD23AB6AD07B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3536	zgokr00.exe
4128	.2026-07-13_33956fae253df7550919aa435fc5e1d1_elex_icedid_njrat.exe
3848	vshost32.exe
4716	vshost32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\ScdBcd = "C:\\Users\\Admin\\AppData\\Roaming\\Dibifu_9\\vshost32.exe"	vshost32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\ScdBcd = "C:\\Users\\Admin\\AppData\\Roaming\\Dibifu_9\\vshost32.exe"	vshost32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vshost32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vshost32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_33956fae253df7550919aa435fc5e1d1_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zgokr00.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3688	2026-07-13_33956fae253df7550919aa435fc5e1d1_elex_icedid_njrat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3688	2026-07-13_33956fae253df7550919aa435fc5e1d1_elex_icedid_njrat.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 3536	3688	2026-07-13_33956fae253df7550919aa435fc5e1d1_elex_icedid_njrat.exe	87
PID 3536 wrote to memory of 3848	3536	zgokr00.exe	89
PID 3536 wrote to memory of 4332	3536	zgokr00.exe	90
PID 4332 wrote to memory of 3348	4332	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-13_33956fae253df7550919aa435fc5e1d1_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_33956fae253df7550919aa435fc5e1d1_elex_icedid_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Users\Admin\AppData\Local\Temp\zgokr00.exe
  "C:\Users\Admin\AppData\Local\Temp\zgokr00.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Users\Admin\AppData\Roaming\Dibifu_9\vshost32.exe
    "C:\Users\Admin\AppData\Roaming\Dibifu_9\vshost32.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3848
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del C:\Users\Admin\AppData\Local\Temp\zgokr00.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4332
  - - C:\Windows\SysWOW64\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      System Location Discovery: System Language Discovery
      PID:3348
- C:\Users\Admin\AppData\Local\Temp\.2026-07-13_33956fae253df7550919aa435fc5e1d1_elex_icedid_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\.2026-07-13_33956fae253df7550919aa435fc5e1d1_elex_icedid_njrat.exe"
  2⤵
  - Executes dropped EXE
  PID:4128

C:\Users\Admin\AppData\Roaming\Dibifu_9\vshost32.exe
C:\Users\Admin\AppData\Roaming\Dibifu_9\vshost32.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.2026-07-13_33956fae253df7550919aa435fc5e1d1_elex_icedid_njrat.exe

Path C:\Users\Admin\AppData\Local\Temp\.2026-07-13_33956fae253df7550919aa435fc5e1d1_elex_icedid_njrat.exe
Size 3.2MB
SHA256 a4da5e943218fd81af3d9077f8b8c02ffd1c38a9e23e1e200b5226094bb29db8
MD5 8f72d79078ba1efc496ba731c16ae59e
SHA1 6e8947eb39871443f64088db8a1f8157cd1fb579
SHA512 4d6bca0d6a7c6e1562e8c253f89d55d9349a8c970ba00af2f19e3861685a4844419f936da7818b02fa2e9a6ded1689626fe1615a50b5ffcbbd41d9ac24455b15
SSDEEP 49152:fnltBB850JijXWThgKme86ZJpCn7fTFkgkWXNUP2DlWy95p+lsGZ1OcPTY6Y5AY:fhB7g4+mpCX3hF/1Zp
TLSH
T157E56A13F19940D9C159C078CF5AD232AB21BC4D47F266EB3A90BAD23A76AD07B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zgokr00.exe

Path C:\Users\Admin\AppData\Local\Temp\zgokr00.exe
Size 204KB
SHA256 d816c8843e46f66067585ca3d53c29a115297cfa12fe5fb863303daa2b28e13d
MD5 dfd10fae2b3bf63de66052a035a20c37
SHA1 c131a8e84a2ec533b07563ffb970e1a861bbcbdc
SHA512 75b95b46400a460f2f00561ed1841c0ce710c62bb082e5ae18bb05fae676324e3ae36545911d955641e0d7573cc35f4a8477de5426fed3449fa3f7b7b841da0b
SSDEEP 3072:3gpgFOdpFd9iKhZtnRPF9EVnb43jaI5grKzvxfZIwm5U3:3Wgad997tnRPF9cCGrKvxZI
TLSH
T182248D597703F11ACE9C0935C922DE82816C3C97A99056A33AB47F2D27F73D1E462A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3536-25-0x0000000074270000-0x0000000074A2C000-memory.dmp

Download

memory/3536-26-0x0000000074270000-0x0000000074A2C000-memory.dmp

Download

memory/3536-32-0x0000000074270000-0x0000000074A2C000-memory.dmp

Download

memory/3688-0-0x0000000074282000-0x0000000074283000-memory.dmp

Download

memory/3688-1-0x0000000000E00000-0x0000000000E3A000-memory.dmp

Download

memory/3688-2-0x0000000005FC0000-0x000000000657A000-memory.dmp

Download

memory/3688-3-0x0000000005950000-0x00000000059E2000-memory.dmp

Download

memory/3688-4-0x0000000005A00000-0x0000000005A0A000-memory.dmp

Download

memory/3688-5-0x0000000074270000-0x0000000074A2C000-memory.dmp

Download

memory/3688-34-0x0000000074270000-0x0000000074A2C000-memory.dmp

Download