25d73b07c2aa510c65fe5bea9cff22d2f14c1c2cc6453d440d52f2f63b73b825

General

Target
2026-07-17_f44a6c94e0a9794056b7150862ba3534_elex_icedid_njrat.exe
Size 2.1MB
Sample260717-fm7n7sbs8k
SHA256 25d73b07c2aa510c65fe5bea9cff22d2f14c1c2cc6453d440d52f2f63b73b825
MD5 f44a6c94e0a9794056b7150862ba3534
SHA1 18097d0c8dd1f00b099874421f748d72a7583e67
SHA512 46b12dc9de7068f5b65496765ec8ba12752df6be46c3a9a9e2ffeca6045d6ca89078f40e6584129c1169499b9e80b0c61110fbb2463721fda83dbd8cbc1f07f2
SSDEEP 24576:1Zv65D3JJQdtvkMkj0zIR+Tf3NnlatHIy4UvTtsq0R03MfI83kJktCHaKCdvcx:1ZC5D3MTvAR+T3NnINyl63qUJk0hqo
TLSH
T1BBA57B47A3D840D9E059C178F73A8522EA627C450BECA6DF02DCB6591FBBED49B39310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	2026-07-17_f44a6c94e0a9794056b7150862ba3534_elex_icedid_njrat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	zgokr00.exe

Executes dropped EXE 4 IoCs

pid	Process
4688	zgokr00.exe
5504	.2026-07-17_f44a6c94e0a9794056b7150862ba3534_elex_icedid_njrat.exe
4796	vshost32.exe
2736	vshost32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ScdBcd = "C:\\Users\\Admin\\AppData\\Roaming\\Dibifu_9\\vshost32.exe"	vshost32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ScdBcd = "C:\\Users\\Admin\\AppData\\Roaming\\Dibifu_9\\vshost32.exe"	vshost32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vshost32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_f44a6c94e0a9794056b7150862ba3534_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zgokr00.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vshost32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2252	2026-07-17_f44a6c94e0a9794056b7150862ba3534_elex_icedid_njrat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2252	2026-07-17_f44a6c94e0a9794056b7150862ba3534_elex_icedid_njrat.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 4688	2252	2026-07-17_f44a6c94e0a9794056b7150862ba3534_elex_icedid_njrat.exe	86
PID 2252 wrote to memory of 5504	2252	2026-07-17_f44a6c94e0a9794056b7150862ba3534_elex_icedid_njrat.exe	87
PID 4688 wrote to memory of 4796	4688	zgokr00.exe	88
PID 4688 wrote to memory of 3648	4688	zgokr00.exe	89
PID 3648 wrote to memory of 1080	3648	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-17_f44a6c94e0a9794056b7150862ba3534_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_f44a6c94e0a9794056b7150862ba3534_elex_icedid_njrat.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\zgokr00.exe
  "C:\Users\Admin\AppData\Local\Temp\zgokr00.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Users\Admin\AppData\Roaming\Dibifu_9\vshost32.exe
    "C:\Users\Admin\AppData\Roaming\Dibifu_9\vshost32.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4796
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del C:\Users\Admin\AppData\Local\Temp\zgokr00.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\Windows\SysWOW64\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      System Location Discovery: System Language Discovery
      PID:1080
- C:\Users\Admin\AppData\Local\Temp\.2026-07-17_f44a6c94e0a9794056b7150862ba3534_elex_icedid_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\.2026-07-17_f44a6c94e0a9794056b7150862ba3534_elex_icedid_njrat.exe"
  2⤵
  - Executes dropped EXE
  PID:5504

C:\Users\Admin\AppData\Roaming\Dibifu_9\vshost32.exe
C:\Users\Admin\AppData\Roaming\Dibifu_9\vshost32.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.2026-07-17_f44a6c94e0a9794056b7150862ba3534_elex_icedid_njrat.exe

Path C:\Users\Admin\AppData\Local\Temp\.2026-07-17_f44a6c94e0a9794056b7150862ba3534_elex_icedid_njrat.exe
Size 1.9MB
SHA256 f86a64aa878bb5d8c1a4158245483db61522cb049a35a461699900b2b283a664
MD5 916f164da25c614d380f9ca5be3df9fd
SHA1 9574dd0428c5b2ec8b3abb7ee456344698ae5fc4
SHA512 6966bc2c19b1bb8dd6e30a5846d5e39c5aa12a89bbbeaf5caf7402fbda250ab66c7d2b06e10e6427c62db4c22f3bbc4eeb21f9742f9e242a92a6932e2036595c
SSDEEP 24576:55D3JJQdtvkMkj0zIR+Tf3NnlatHIy4UvTtsq0R03MfI83kJktCHaKCdvcF:55D3MTvAR+T3NnINyl63qUJk0hqe
TLSH
T100958B43B3D800D9E059D178E77A8532EA627C450BA8A6DF02DCB7991F7BED49B39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zgokr00.exe

Path C:\Users\Admin\AppData\Local\Temp\zgokr00.exe
Size 238KB
SHA256 ae90ad360f2701b2cd157a5a7cd1882978775f5df7f8db6b1da4dbd95d657710
MD5 c6f8bcae7cba4189b03c20eb7f0e78cd
SHA1 7b9e103a37eea491deb0f8c80fb76ab162c5c26d
SHA512 11117b55cd39fdf2cfb25684ad53bd4b174ae3b62fa33f93f5a8a557abd7591788e17272db266df82471348cc4fe6f396b5c5bd72214949ed5e8b0353bb968b4
SSDEEP 6144:iWgad99P+uvp4hSde12Kota8lD8iy9KZ6a7:iWsuvpe2KM
TLSH
T1163437DDABE09557F8714638FA3A4C41DB64BC1982FE8A427ADD710E07E3CC1E1213A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2252-0-0x0000000000DC0000-0x0000000000E02000-memory.dmp

Download

memory/2252-1-0x0000000005CC0000-0x0000000006264000-memory.dmp

Download

memory/2252-2-0x00000000057B0000-0x0000000005842000-memory.dmp

Download

memory/2252-3-0x0000000005960000-0x0000000005970000-memory.dmp

Download

memory/2252-4-0x0000000005950000-0x000000000595A000-memory.dmp

Download

memory/4688-22-0x0000000005AC0000-0x0000000005AD0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads