Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 00:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe
- Size 459KB
- Sample260810-a4276a11fv
- SHA256 37557b143770ea6716a1d5bbd1b8ed62f0207a72886858f672f6ddb8ef12af34
- MD5 c30d5df4a2e0e292da4c7189db64fd23
- SHA1 4327eda6919e1c5f5915e4152f3561b9303cd813
- SHA512 60ced91d543a7426aad444aad87f8d99706f604ab9c5fac1d09c5eaecec416810c51ed12e8929033e1290c8632d26d4ff683c6b50ca317e6857ae8f178450142
- SSDEEP 6144:kI93pYjXb4MyoykX9EpC67esP0uZSi/c+h5N9MDyyg2HpObZNHUi:RHonkisP0MugCAjHUi
- TLSH T14AA47C2AB7A824E5F0774634C9628A46D7727C760B70C7CF1294726E1E373E19D36B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4644 2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_c30d5df4a2e0e292da4c7189db64fd23_elex_icedid_njrat.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4644
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 549KB
- SHA256 2b0813a136a9f3fa54a6985df0e8bdbc19808d50ee169d81116e3a608fbf894e
- MD5 c554449ec725df2f7f5aad68bf01802a
- SHA1 9b4c6f704df93a5bd1fe46ecb6bc7b29e2a7878f
- SHA512 1448725629e5190bd73dc88fa0257911fdcad8b326ef35ae0e7d4209b78319cb5bbd35b8444f744d99748aa6a1d8e79227f278d9eca89e06cb555d85e69bd874
- SSDEEP 6144:kI93pYjXb4MyoykX9EpC67esP0uZSi/c+h5N9MDyyg2HpObZNHUdrXdPG6rRDQ:RHonkisP0MugCAjHU5Hs
- TLSH T11DC46D16F6A81FE1E4738674C8A38A8ADB753C650B71C68B0258B27D3E373D19D35B12
- MD5 SHA1 SHA512 SSDEEP TLSH