e367ab372ad82cfc146715594ebf9814d1b42e95ab9ad8714d644c67f0b65e3e

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_7041592f8bbd38a96e41181eb909ec18_elex_icedid_njrat.exe
Size 350KB
Sample260809-w5fw7stdlc
SHA256 e367ab372ad82cfc146715594ebf9814d1b42e95ab9ad8714d644c67f0b65e3e
MD5 7041592f8bbd38a96e41181eb909ec18
SHA1 ec31c4d54bbce0f9c0939c8d49de4bc2402bea70
SHA512 de260eb5f63dbc6f5bdf58fc06a2e5b2b02450248b050b06f9973757db0658414ff863846d584aaafb92cd537835737fc34113cc6cac243e4efe00456a518ec3
SSDEEP 6144:m+dTTUFgEs3XojAdsLNMIRIwo1igg1NBice1sTAQOehTlO+8RTZWVtSUa:mgUFgEsnojAyLNrCB1igsNBfcsc+ZOnf
TLSH
T13F74AE0AF2A11CF5D6A785348A8BD136D7B2BD521A10CF5FA3A4831B6F23761BD2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4880	svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe
2792	svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe
2952	svchost_CBBCCBBABCCAABAAAAABCBBCCCBBCABABBBBABABBCCCCCBAAACCCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABABCABCBCBCCCAACBBCBAABBACBACAABBACCCACCBCCCCCBCCABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe"	2026-08-09_7041592f8bbd38a96e41181eb909ec18_elex_icedid_njrat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBBBACCBCBBCACCBBBBBBBCBACBCBAAABCABCCABAACBBBACAABCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCCBBABCCAABAAAAABCBBCCCBBCABABBBBABABBCCCCCBAAACCCCB.exe"	svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5788	sc.exe
5444	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5680	cmd.exe
4940	cmd.exe
4452	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_7041592f8bbd38a96e41181eb909ec18_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCCBBABCCAABAAAAABCBBCCCBBCABABBBBABABBCCCCCBAAACCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4336	2026-08-09_7041592f8bbd38a96e41181eb909ec18_elex_icedid_njrat.exe
4336	2026-08-09_7041592f8bbd38a96e41181eb909ec18_elex_icedid_njrat.exe
4336	2026-08-09_7041592f8bbd38a96e41181eb909ec18_elex_icedid_njrat.exe
4336	2026-08-09_7041592f8bbd38a96e41181eb909ec18_elex_icedid_njrat.exe
4880	svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe
4880	svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe
4880	svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe
4880	svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe
2952	svchost_CBBCCBBABCCAABAAAAABCBBCCCBBCABABBBBABABBCCCCCBAAACCCCB.exe
2952	svchost_CBBCCBBABCCAABAAAAABCBBCCCBBCABABBBBABABBCCCCCBAAACCCCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4336	2026-08-09_7041592f8bbd38a96e41181eb909ec18_elex_icedid_njrat.exe
Token: SeDebugPrivilege	4880	svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe
Token: SeDebugPrivilege	2952	svchost_CBBCCBBABCCAABAAAAABCBBCCCBBCABABBBBABABBCCCCCBAAACCCCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 4940	4336	2026-08-09_7041592f8bbd38a96e41181eb909ec18_elex_icedid_njrat.exe	91
PID 4940 wrote to memory of 1220	4940	cmd.exe	93
PID 4336 wrote to memory of 4452	4336	2026-08-09_7041592f8bbd38a96e41181eb909ec18_elex_icedid_njrat.exe	94
PID 4452 wrote to memory of 5444	4452	cmd.exe	96
PID 4336 wrote to memory of 5680	4336	2026-08-09_7041592f8bbd38a96e41181eb909ec18_elex_icedid_njrat.exe	97
PID 5680 wrote to memory of 5788	5680	cmd.exe	99
PID 4880 wrote to memory of 1888	4880	svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-09_7041592f8bbd38a96e41181eb909ec18_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_7041592f8bbd38a96e41181eb909ec18_elex_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBCCBACBCCAACABBACCCBBCACBACAABACABBBABCACACCABCCCCABABCAAAABAAAACCBACBACCCCCAACCABCACCBCACACAAABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBCCBACBCCAACABBACCCBBCACBACAABACABBBABCACACCABCCCCABABCAAAABAAAACCBACBACCCCCAACCABCACCBCACACAAABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBBCBAAABAAABABBAABCAABACCCBBCCAACABABCCCACCBCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe" start= auto displayName= "UserDataSvc_AACBBCBAAABAAABABBAABCAABACCCBBCCAACABABCCCACCBCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACBBCBAAABAAABABBAABCAABACCCBBCCAACABABCCCACCBCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe" start= auto displayName= "UserDataSvc_AACBBCBAAABAAABABBAABCAABACCCBBCCAACABABCCCACCBCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBBCBAAABAAABABBAABCAABACCCBBCCAACABABCCCACCBCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5680
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACBBCBAAABAAABABBAABCAABACCCBBCCAACABABCCCACCBCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1888

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe
1⤵
- Executes dropped EXE
PID:2792

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBBABCCAABAAAAABCBBCCCBBCABABBBBABABBCCCCCBAAACCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBBABCCAABAAAAABCBBCCCBBCABABBBBABABBCCCCCBAAACCCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 13b41b310abe73a9e50bbed9c8b89a0d3beab228ea4a146fe1b8012805199284
MD5 6ab4a569098c75591989606c33991d41
SHA1 6e7cc5ab95b39cc43041b4221f481fdd8e6cfc14
SHA512 4da2719eac7a18c40541b49f311d6c4e0a1eead5dd1d935a2b3d76aaa6b62b84145d90916baf727270a1c5c1adeaddbd0d28e4425fa30fe28e0741d975fb65c6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d43e10ff155fb3af3254ae8303f491adb7a3c417713a1dd4512077a6b66db1f2
MD5 939a8cf09e0e218132c4b0a777ce648c
SHA1 0bfe1cac84f4bed8d4b1e0eaefc2083d04131487
SHA512 0d0addaf93eaa4144a8588874880139484bc3f00f70814b638e05d7b45ef52a5ec44a4a584bfc50c3dca5b8428f2949256e4561174b9b65f5608291568a40624
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 896c7b58d52791b5a64f941cb2fd74fd12c08383cc82518c96ab97b16b819f07
MD5 d366f7979bb28e9662ba424abf7dbac2
SHA1 802f70f632be8bc41b3ed6a534bce3c5dd3fa052
SHA512 81ea8aaed29173411d0186c06bad17b85003c2a06d0e778445775c90cd6daa90ac72626a1641d1ff11a06fb356a3402846baab8e179e149ca240f99bada2c57a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6248cedd7af69a914649d04e57533c379cf369dda419e4d0910b92998640c1fe
MD5 280ab566da1758effa979f0fdcb58ee3
SHA1 ad2a474ff673e59e3a728873de3d69504e408e6f
SHA512 8f2b5c25be4ad9f13e4b98fa9b397bbe84756586530cd4d5a40a4a522099b7acdff3b50c3a0c7a737eb6c9ccfdc164e48282e63b8bc376d86d86c303cdf1f67b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1bfecb93e81ef03962558201b31e00b1f2cfc3211ff97e4c929e116a6ce8b5f5
MD5 5a12dfe724846d519a339b67169130a0
SHA1 2af32766b5d17aeee1d98e0017c54592927427ed
SHA512 a191e9aebb1238e269712a8842aa358fa0a8d11db7c78c4a595b763c28be02bbcb2dde6c99859c51d5618bdce00675159fff24f1aa3d04784a665c0bf93ab3d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2eff6089488e76bff635e2371ba6b81dceca42a551e03cbd7d54e8c32cf63e2f
MD5 188060dc9ff7a3aaca14c12e247ee284
SHA1 d04a132e611bee9d8535c45ea60f19c4605f72da
SHA512 d4e62a69561f05b4049e177008941c55bc4fa5f15b013a2d6c0bb9bc5634fcd2a90b8337bfdb352d9f533a6e6138eb4ee7c7381c41da0c716a6188b67895d333
MD5 SHA1 SHA512

Submit Download

svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCBCBABBBBBBBBBAABABCCBCABAABCCACBAABBCCAABCABCABC.exe
Size 350KB
SHA256 e367ab372ad82cfc146715594ebf9814d1b42e95ab9ad8714d644c67f0b65e3e
MD5 7041592f8bbd38a96e41181eb909ec18
SHA1 ec31c4d54bbce0f9c0939c8d49de4bc2402bea70
SHA512 de260eb5f63dbc6f5bdf58fc06a2e5b2b02450248b050b06f9973757db0658414ff863846d584aaafb92cd537835737fc34113cc6cac243e4efe00456a518ec3
SSDEEP 6144:m+dTTUFgEs3XojAdsLNMIRIwo1igg1NBice1sTAQOehTlO+8RTZWVtSUa:mgUFgEsnojAyLNrCB1igsNBfcsc+ZOnf
TLSH
T13F74AE0AF2A11CF5D6A785348A8BD136D7B2BD521A10CF5FA3A4831B6F23761BD2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 164c0cfd617942f5694372b03e283fa44e38cfe9b399b68c2565c7d152aa1124
MD5 fd7448de3c679fb81745e5e72f75e0e6
SHA1 1a009f6b198fb0d31f844642aaafaebe1677cd10
SHA512 b6ced0d158f4e7ac9575b8e86fc98d4266051b50d5f0bd13b39e20cb4d819b8d517a29a6f9c2b47247380e69cb9b56e69a1a471fd621d204ec5b37b39a1dd5d4
TLSH
T14A11E751A0ADD8E7B533A8CBA339D8C68C9C27D7A91CEE54630A411867D5C319D198E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2792-66-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download

memory/2952-72-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/4336-6-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/4880-22-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download

memory/4880-35-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download