201e489f1bd1fc109250fdc9eea5abae65fd001a85436da64a7c3c1721562f61

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_9cc045d8e8ec0785b777f16543e82a87_elex_icedid_stop.exe
Size 2.2MB
Sample260807-vs8wsaha89
SHA256 201e489f1bd1fc109250fdc9eea5abae65fd001a85436da64a7c3c1721562f61
MD5 9cc045d8e8ec0785b777f16543e82a87
SHA1 fe943523733f8e6cde755b0374375ffe9f46914e
SHA512 653f4cc2b1e1ba337d4c1dbfc763b9c140a51d4a7d83467c7a3092855908cdc38a6fe7f3ed822f2fcb09c268a490b706c158b414e29e5dc1d3f198bd4b2eea05
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCQk:Jp7Dp7Dp7Dp7mk
TLSH
T1E5B53A11B6818035F4A218714AAFD73D55287921CB678ECFA3880EEEBFF16D19934736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4920	svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe
3560	svchost_BACCCCBAAACCCBBBBBCCBBCBCBACBABBCAABCABABCCACBBCCCAABCA.exe
4208	svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBAABABAABCCABBAACABCABABACACBCACCABBACABCCBABACBACCAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe"	2026-08-07_9cc045d8e8ec0785b777f16543e82a87_elex_icedid_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABACCABBBBBBBBAACCAAACBBCBBAACACAACCBBBBACBABAACABABCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCCCBAAACCCBBBBBCCBBCBCBACBABBCAABCABABCCACBBCCCAABCA.exe"	svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5648	sc.exe
1340	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2296	cmd.exe
2636	cmd.exe
1668	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_9cc045d8e8ec0785b777f16543e82a87_elex_icedid_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCCCBAAACCCBBBBBCCBBCBCBACBABBCAABCABABCCACBBCCCAABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1324	2026-08-07_9cc045d8e8ec0785b777f16543e82a87_elex_icedid_stop.exe
1324	2026-08-07_9cc045d8e8ec0785b777f16543e82a87_elex_icedid_stop.exe
1324	2026-08-07_9cc045d8e8ec0785b777f16543e82a87_elex_icedid_stop.exe
1324	2026-08-07_9cc045d8e8ec0785b777f16543e82a87_elex_icedid_stop.exe
4920	svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe
4920	svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe
4920	svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe
4920	svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe
3560	svchost_BACCCCBAAACCCBBBBBCCBBCBCBACBABBCAABCABABCCACBBCCCAABCA.exe
3560	svchost_BACCCCBAAACCCBBBBBCCBBCBCBACBABBCAABCABABCCACBBCCCAABCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	2026-08-07_9cc045d8e8ec0785b777f16543e82a87_elex_icedid_stop.exe
Token: SeDebugPrivilege	4920	svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe
Token: SeDebugPrivilege	3560	svchost_BACCCCBAAACCCBBBBBCCBBCBCBACBABBCAABCABABCCACBBCCCAABCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 2636	1324	2026-08-07_9cc045d8e8ec0785b777f16543e82a87_elex_icedid_stop.exe	91
PID 2636 wrote to memory of 1152	2636	cmd.exe	93
PID 4920 wrote to memory of 4304	4920	svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe	94
PID 1324 wrote to memory of 1668	1324	2026-08-07_9cc045d8e8ec0785b777f16543e82a87_elex_icedid_stop.exe	97
PID 1668 wrote to memory of 5648	1668	cmd.exe	99
PID 1324 wrote to memory of 2296	1324	2026-08-07_9cc045d8e8ec0785b777f16543e82a87_elex_icedid_stop.exe	100
PID 2296 wrote to memory of 1340	2296	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-07_9cc045d8e8ec0785b777f16543e82a87_elex_icedid_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_9cc045d8e8ec0785b777f16543e82a87_elex_icedid_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCCCBBBBACBCCAACABBAACCACCABCACAABAAACAACCABBCBABCAACCCCBBCACAACAAABBACBBCBCBCBABABCCABBAABCCACBCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCCCBBBBACBCCAACABBAACCACCABCACAABAAACAACCABBCBABCAACCCCBBCACAACAAABBACBBCBCBCBABABCCABBAABCCACBCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCAAACCCBCBCBCCABBACCACCCCCBBCCBBCAABCCABCBABBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe" start= auto displayName= "UserDataSvc_CBCCAAACCCBCBCBCCABBACCACCCCCBBCCBBCAABCCABCBABBCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCAAACCCBCBCBCCABBACCACCCCCBBCCBBCAABCCABCBABBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe" start= auto displayName= "UserDataSvc_CBCCAAACCCBCBCBCCABBACCACCCCCBBCCBBCAABCCABCBABBCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCAAACCCBCBCBCCABBACCACCCCCBBCCBBCAABCCABCBABBCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCAAACCCBCBCBCCABBACCACCCCCBBCCBBCAABCCABCBABBCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1340

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4304

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCBAAACCCBBBBBCCBBCBCBACBABBCAABCABABCCACBBCCCAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCBAAACCCBBBBBCCBBCBCBACBABBCAABCABABCCACBBCCCAABCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe
1⤵
- Executes dropped EXE
PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 46696a065dfda972a90e672ef0ce35c523f70a9791490cd325b0ceb0926431b9
MD5 05bcd604461da530e4e5f41893879c6c
SHA1 e195c28edf4410c374b8132818ec43a7a1e44c33
SHA512 d5683f3b0f27f9c3090edfc65e4e87ac115821fdbfc24fd7083fb3e1bd318fa1b2122d21c2e85989b8efe67b57cf2c35c94b23d231b69e2d41dfe3c2fdf86f78
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f0b79166e6c2311bfc93c9e44f2b5af59089a72a4502b51c4a62f8038d823ddc
MD5 de0d467c34e6b26281edca76614b0372
SHA1 bdde6d5a8275d26f84a9389ed69aacfbf04726e2
SHA512 fc6b7b6dc0f0a1ae9539615bfd8c2e4aab9486571a6034a9753ddd5adf17ae25b5a685c327e9af00324f7af40ad6a252606856c4c7937e0963b930f8e190abb4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 db9b87f1b3519ab11c383ed397a05cd4f9d631183644e690c0eb6612702c4032
MD5 28ddcfc9afbb624534c20bfb323cfe90
SHA1 8eb60b4910556fbfa220294b9e0a4a758c121ba6
SHA512 b6e7ef00dc3412abe5241f126c7fa8436c91bb97bae3cd0b135e1c759a0ef51d40ac1812febc95aa5f697000801c9a167884ca2a4fa79377e9008975048e755e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 59ca73c79cb2ae0b0b9fec87eb068c052483194bdfcd23a88bc9225969739efa
MD5 679dbf080c54037981fd7ed314ef9c70
SHA1 b1f2d33a21a9691a8bcbe9131198ef948577be2a
SHA512 4361af31f81f1432a81499de54eb7b7b978f70435d678d506251a4ff2976670ab03e830fb5369cbf3041b42fcdde7fbb6bfc11a189bbe928d40af11bace8df8f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 55e441584470498bb0748d8581660480b2ea8b715c09888a93cdb320404b9f34
MD5 7d7d1b18279969cabcbd2b0a7bbda824
SHA1 e001b7d4b3ceb864ebf216b9dfb7b0af46a697d9
SHA512 59426585804e263e3331678e484531cab763c418d8d850b76139b1cc4b913c6b2daca186d97b2387fb3a308191d319f7362e7fe0a44c5e28d47f9450d8be99c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa5d187a7ec54d947203b5a9d78a604dcbfb3d5f84b8c6eebeecde242321199a
MD5 7fbf48de709a337823e3980f5be264fb
SHA1 dad0fa30f8bcc5343ce36e8ce5cfb74f78381a80
SHA512 3bbce163b9b8eb75766a6be071e98337c1d8b8f243327ee0119652b2d7275024c98fc739e38ce8b382d65d51f21e591b353b62f31690a5921c7d1e1742d2b5b5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3b252bac76eaf2a298b5ea29ef846150e47669100df076ebec13bf3c2378eb04
MD5 39032d89e9fc136477cd1ebcab2ad0f7
SHA1 6b1dddbfbd9be080b82927a4a00d6c28be41f3cf
SHA512 cdabebd19cc76e4e91988a8506bf29c671b633de5392141783f1a16840515e955e4dae0029257621c7f9218ce803fd3777a06242b1d460fc92560fc378d60bc4
MD5 SHA1 SHA512

Submit Download

svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCCCBBBCCBBBCBBCBACAABCCBACACBCACBBCBBBCBBCABABA.exe
Size 2.2MB
SHA256 201e489f1bd1fc109250fdc9eea5abae65fd001a85436da64a7c3c1721562f61
MD5 9cc045d8e8ec0785b777f16543e82a87
SHA1 fe943523733f8e6cde755b0374375ffe9f46914e
SHA512 653f4cc2b1e1ba337d4c1dbfc763b9c140a51d4a7d83467c7a3092855908cdc38a6fe7f3ed822f2fcb09c268a490b706c158b414e29e5dc1d3f198bd4b2eea05
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCQk:Jp7Dp7Dp7Dp7mk
TLSH
T1E5B53A11B6818035F4A218714AAFD73D55287921CB678ECFA3880EEEBFF16D19934736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 21f54368530e0c73db2375f4b660d4ba5b25fbce99b0111da365b70082ec7778
MD5 7f117d55e9ed63e3a8df21d638fac162
SHA1 75c6b76b877138c5b14763b6372ff1edbb04669c
SHA512 1223effe71f8bf14e9ca45bcc351fd38637596bab02f96338bfa6c3f8f0d9c413dc9fafc056eb2d6db669f47944247889743ab7a72d4389686bd174bbef666b9
TLSH
T16411985070E9D867EC33ACCB5235D9D20CE837DA7558BE58A30D911C7756C324F158E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1324-8-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/1324-0-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/3560-74-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/4920-34-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download