Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 21:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe
- Size 445KB
- Sample260729-z5kryafa74
- SHA256 cdd5c6750e778b357ad438bda10fb35ea4fc10ba0945bfc59ad8d9b9e951aa10
- MD5 19eb2232d1a5e47eb95a957533c09b86
- SHA1 36b914735662dbae74dc2c2d651e11c69a9b1b5c
- SHA512 690f47bd9c2c15c4ae2e43a07fb000d9f0d01cdc1c29d4bfa15d92a05fabc5648a7d763ef9733c41e55e3b87792e474a3475c7a4c22f93d6974ccabe8d29dc1a
- SSDEEP 6144:2sYQXsnUVx4ZXvQShd+XvbGLcqBG65tufv1Qp9A2+94juR1y93kQ/ESWJn5lz:2jndvQSr+XvbGIqBGr1m+910dWJTz
- TLSH T1F6A48D107BD1C036F5B324724A7E8665956DB9712F2182CFA3C0276E5F70AD1EA31B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe - Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 14 IoCs
resource yara_rule behavioral2/memory/3956-1-0x0000000002430000-0x00000000034EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3956-11-0x0000000002430000-0x00000000034EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3956-9-0x0000000002430000-0x00000000034EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3956-10-0x0000000002430000-0x00000000034EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3956-6-0x0000000002430000-0x00000000034EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3956-5-0x0000000002430000-0x00000000034EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3956-3-0x0000000002430000-0x00000000034EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3956-4-0x0000000002430000-0x00000000034EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3956-8-0x0000000002430000-0x00000000034EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3956-7-0x0000000002430000-0x00000000034EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3956-12-0x0000000002430000-0x00000000034EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3956-23-0x0000000002430000-0x00000000034EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3956-26-0x0000000002430000-0x00000000034EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3956-22-0x0000000002430000-0x00000000034EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 16 IoCs
resource yara_rule behavioral2/memory/3956-1-0x0000000002430000-0x00000000034EA000-memory.dmp UPX behavioral2/memory/3956-11-0x0000000002430000-0x00000000034EA000-memory.dmp UPX behavioral2/memory/3956-9-0x0000000002430000-0x00000000034EA000-memory.dmp UPX behavioral2/memory/3956-10-0x0000000002430000-0x00000000034EA000-memory.dmp UPX behavioral2/memory/3956-6-0x0000000002430000-0x00000000034EA000-memory.dmp UPX behavioral2/memory/3956-5-0x0000000002430000-0x00000000034EA000-memory.dmp UPX behavioral2/memory/3956-3-0x0000000002430000-0x00000000034EA000-memory.dmp UPX behavioral2/memory/3956-4-0x0000000002430000-0x00000000034EA000-memory.dmp UPX behavioral2/memory/3956-21-0x0000000000400000-0x0000000000474000-memory.dmp UPX behavioral2/memory/3956-8-0x0000000002430000-0x00000000034EA000-memory.dmp UPX behavioral2/memory/3956-7-0x0000000002430000-0x00000000034EA000-memory.dmp UPX behavioral2/memory/3956-12-0x0000000002430000-0x00000000034EA000-memory.dmp UPX behavioral2/memory/3956-23-0x0000000002430000-0x00000000034EA000-memory.dmp UPX behavioral2/memory/3956-125-0x0000000000400000-0x0000000000474000-memory.dmp UPX behavioral2/memory/3956-26-0x0000000002430000-0x00000000034EA000-memory.dmp UPX behavioral2/memory/3956-22-0x0000000002430000-0x00000000034EA000-memory.dmp UPX - Windows security modification 2 TTPs 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe -
resource yara_rule behavioral2/memory/3956-1-0x0000000002430000-0x00000000034EA000-memory.dmp upx behavioral2/memory/3956-11-0x0000000002430000-0x00000000034EA000-memory.dmp upx behavioral2/memory/3956-9-0x0000000002430000-0x00000000034EA000-memory.dmp upx behavioral2/memory/3956-10-0x0000000002430000-0x00000000034EA000-memory.dmp upx behavioral2/memory/3956-6-0x0000000002430000-0x00000000034EA000-memory.dmp upx behavioral2/memory/3956-5-0x0000000002430000-0x00000000034EA000-memory.dmp upx behavioral2/memory/3956-3-0x0000000002430000-0x00000000034EA000-memory.dmp upx behavioral2/memory/3956-4-0x0000000002430000-0x00000000034EA000-memory.dmp upx behavioral2/memory/3956-8-0x0000000002430000-0x00000000034EA000-memory.dmp upx behavioral2/memory/3956-7-0x0000000002430000-0x00000000034EA000-memory.dmp upx behavioral2/memory/3956-12-0x0000000002430000-0x00000000034EA000-memory.dmp upx behavioral2/memory/3956-23-0x0000000002430000-0x00000000034EA000-memory.dmp upx behavioral2/memory/3956-26-0x0000000002430000-0x00000000034EA000-memory.dmp upx behavioral2/memory/3956-22-0x0000000002430000-0x00000000034EA000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp AdobeARM.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup AdobeARM.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e58e74e 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe File opened for modification C:\Windows\SYSTEM.INI 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeARM.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe Token: SeDebugPrivilege 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1648 AdobeARM.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3956 wrote to memory of 1204 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 15 PID 3956 wrote to memory of 3048 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 44 PID 3956 wrote to memory of 3088 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 45 PID 3956 wrote to memory of 3480 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 50 PID 3956 wrote to memory of 3252 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 57 PID 3956 wrote to memory of 4376 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 59 PID 3956 wrote to memory of 4432 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 60 PID 3956 wrote to memory of 4444 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 61 PID 3956 wrote to memory of 4732 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 63 PID 3956 wrote to memory of 2656 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 64 PID 3956 wrote to memory of 5156 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 65 PID 3956 wrote to memory of 5268 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 66 PID 3956 wrote to memory of 4876 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 79 PID 3956 wrote to memory of 5476 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 80 PID 3956 wrote to memory of 4792 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 81 PID 3956 wrote to memory of 1508 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 82 PID 3956 wrote to memory of 3196 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 83 PID 3956 wrote to memory of 1648 3956 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe 89 PID 1648 wrote to memory of 1364 1648 AdobeARM.exe 93 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1204
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3048
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3088
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3252
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4376
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4432
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4444
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4732
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵PID:2656
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:5156
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5268
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4876
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_19eb2232d1a5e47eb95a957533c09b86_amadey_elex_icedid_stealc_stop.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3956 -
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"4⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"5⤵PID:1364
-
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:4792
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1508
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:3196
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Adobe\ARM\ArmReport.ini
- Size 782B
- SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
- MD5 29f1b2d1b6f9290138596cf180847e53
- SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
- SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
- TLSH T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
- Size 18KB
- SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
- MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
- SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
- SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
- SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
- TLSH T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
- Size 168B
- SHA256 c76f80c209693d4ba3ae04d9acf1725b2de797f034674dc809ec3e84e9831b9f
- MD5 79482341d9a12ebde03b4b16fd467ba0
- SHA1 0117ee8645552a45033e7685b80c0a0fbae7e51c
- SHA512 510209f477d2192b52ef3dd0a5e1ed2897785d2db05b540a27d67d75d77b96a80239838568c8c9c82eade9d2f979ec2267bee3a79d2a21675dc418f7a639d088
- TLSH T14AC0128252BF580A173A0085A71A3EA0D8E0719882854A2236102B06BB208130E6FA38
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
- Size 251KB
- SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
- MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
- SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
- SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
- SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
- TLSH T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Tmp4973.tmp
- Size 3KB
- SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
- MD5 bbb796dd2b53f7fb7ce855bb39535e2f
- SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
- SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
- TLSH T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Tmp64DC.tmp
- Size 3KB
- SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
- MD5 ec946860cff4f4a6d325a8de7d6254d2
- SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
- SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
- TLSH T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Tmp64FD.tmp
- Size 3KB
- SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
- MD5 fc2430057cb1be74c788f10c2d4540c8
- SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
- SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
- TLSH T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
- MD5 SHA1 SHA512 TLSH