771aa5053cdfafa62fdfd586fd8ac4f851574a18cbfc9e92534b97caff61d2d4

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_756e1c39773aca8ae9c2872bd7ba5b76_elex_icedid_njrat.exe
Size 1.7MB
Sample260807-nph3matgrg
SHA256 771aa5053cdfafa62fdfd586fd8ac4f851574a18cbfc9e92534b97caff61d2d4
MD5 756e1c39773aca8ae9c2872bd7ba5b76
SHA1 55558f2fa9b1f13c721b68f8991ad546f0adecf5
SHA512 c6b54f949e7032cf0261784514b8c4475790c2744db597757edc1330afede9653cff037b4519363eb36834bcbdf0231d503895380ecfc3cf112255166044acd8
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOo1YA+wE/nSi1SoCU5qJSrk:26F0eMpAAYEhpX+hwavS7PLjeTi
TLSH
T16F858D54F78384F5E92341F0854BEBBAE530AD1640319D6BE7C8EF527F73A12262A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
264	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_756e1c39773aca8ae9c2872bd7ba5b76_elex_icedid_njrat.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5504 wrote to memory of 264	5504	2026-08-07_756e1c39773aca8ae9c2872bd7ba5b76_elex_icedid_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-07_756e1c39773aca8ae9c2872bd7ba5b76_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_756e1c39773aca8ae9c2872bd7ba5b76_elex_icedid_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5504
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX20B1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX20B1.tmp
Size 1.1MB
SHA256 b82b610662736e8f8634e77491485fbc280d7a05a7f8e2b159d4296d303bd964
MD5 22078c75f4ef1fdcbdfbe78f6ef6da5f
SHA1 a39968181ac2152b64744f3931926d2b343aeb51
SHA512 3777e6e55aa786d627fc4140e15e151047f979449f4e1b97bcf67d3498cd8f5317bafe64d8064f7ac0c86e880815fe1a982ba519a1e0f14efcf065763d59aaef
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO81YA+wlP:W6F0eMpAAYEhpf+hwR
TLSH
T185455B54E783C4F5FD2314F0444BEBFBA5309E1A40318D6BFBC8EE11BAB2E526529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 574KB
SHA256 0cf9864ae3a8679ed503f954a453452c93fa44f99ca6f39bbc5860abde7fd35e
MD5 6503efe0a01c2d50c97be27f3cb10a43
SHA1 a0cb3708603a18f02352d01ec672020e5bad5073
SHA512 ebdbc553ba4348676fd3f2ca12e48af53a229b449a36e653dbfca90efb34d21033e41d1157dcca28c2b1e5f91368c0839298992247cf7d2e8feca5feab8ecea4
SSDEEP 12288:jSiZbbSoCU5qJSr1eWPUntBB0sP0MugCAjHUzTsh:jSi1SoCU5qJSr1eWPSCsP0MugC6eT
TLSH
T12FC48C5A779006F5D17BD239CA524B56EAB278024720A64F03EA43BB1F233215F7F726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 463e3d4ea3464ea0c1d0d090677ff3022932c2c50ca6338e77e6c1ef8b8a325f
MD5 f8abfb8bfb1e86d1301d263df9418c61
SHA1 26acb19293c4c11476fbf6e443f19457587fd565
SHA512 03ee1511405f43428c7aba8298829f5099d85d5f5d0a3f26587c63599a9f8cfb6abc69895ea379d6486644db00bbe4dd32eafc6517969d42a9d548a7f754f294
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOo1YA+wE/:26F0eMpAAYEhpX+hwa
TLSH
T185455C54E783C4F5FD2314F0444BEBFBA5309E1A40318D6BFBC8EE11BAB2E526529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 6746c97e25aa35b5f32082aa35488125a6b512b6fb726471b584de0250eda977
MD5 dcde11d35243eef95c6b7599bd76e611
SHA1 647a9c1b7c89c2b8b7d24ca744383e7ca5cdb655
SHA512 e9a0db753508ada3f1d1e348b823ee66f43b2c6596d18fd361314db24d8776b8aec2a3163333f9722cd6501e2911940ecd04fcdb37f51c4af8d27e3fbcd178a9
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOL1YA+wPD:26F0eMpAAYEhpw+hw7
TLSH
T113455C54E783C4F5FD2314F0444BEBFBA5309E1A40318D6BFBC8EE11BAB2E526529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 4fe5e374ee9d38438b2eefb8e2c7a3864b358bd6cbbc7194165b977100744922
MD5 7c90a56216bf7395d8ae99d2f02fe63d
SHA1 cc642df2de6bd2c632e0601c1481ee65a2a5cb39
SHA512 994b3bfaa548fb99e7fa3d2a7b04c6dc7dfd9f9120455fac1ca6bde8ac45d1bf71426c13a31cf97e67d57763724b6b5b53e837de197d02ab00b4b4d9c7a310ca
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOh1YA+wqc:W6F0eMpAAYEhpK+hw7
TLSH
T1F3455C54E783C4F5FD2314F0444BEBFBA5309E1A40318D6BFBC8EE11BAB2E526529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5504-154-0x0000000000400000-0x0000000000529000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads