Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 00:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe
- Size 190KB
- Sample260810-a9ghmsgl8v
- SHA256 3f67695bd3e0e7b212c423885cb89dea19973a57e367f8e49d47fd14c875586f
- MD5 707227cea9e8b082b2f1a756053e567f
- SHA1 42a86a4014919a6536330adb161d542b99ea9d41
- SHA512 0cb613797bd290ca1049a323ddb8a79c74f5778095c8b1e990eddfc213c74aca79623813ec1675bfb6c9ee5ce61a79fbf144f06ac5e94ca6aa5cd0a40245fefd
- SSDEEP 3072:HE7oP60YrKBaeLflY++RfvbgfWhQETMlQ5jveTEvao7j:kI93pYjXb4Myoyo
- TLSH T19C143B1BF6A838D1F4764A3455614A499B367DB11FB0CAEB2245B62C1E372DADC30F23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4600 2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_707227cea9e8b082b2f1a756053e567f_elex_icedid.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4600
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 549KB
- SHA256 23ebc0c02e702cb6fe21d66f6ba227377a04bab3b53008a782a344e805487214
- MD5 b8b5b9bdd5a81e346921878fd10fc28f
- SHA1 94678dbc93c1cf6dcdcf824ce9beb19f8912e257
- SHA512 ac9802021d71adc7954ea2f5e7c6ed0c48f51a364315ffda21ae5e5fab6725b6d82856088e53906a867271423b20319fbdf6b3b5879a49198e45d27ab954323f
- SSDEEP 6144:kI93pYjXb4Myoyr6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4zrrXdPG6rRDQ:RHonkhZD0wxpGZIVuKrHs
- TLSH T1EDC4E716F6B48B61D073C4B5C5E29A89EE713C910B30CACB1249F67C2E776D68D36722
- MD5 SHA1 SHA512 SSDEEP TLSH