Overview

overview

7

Static

static

3

2026-08-12...id.exe

windows10-2004-x64

7

2026-08-12...id.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/08/2026, 16:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-12_47b15a8a9bc063a98e81cb3da8bfb7a0_elex_icedid.exe
  • Size 1.6MB
  • Sample260812-vfp8xa1dqa
  • SHA256 f4feb1e2ac3d7e077afb1a381d55f3cdba4b3d140c4b571577aea7bd06467ab1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 4 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_47b15a8a9bc063a98e81cb3da8bfb7a0_elex_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_47b15a8a9bc063a98e81cb3da8bfb7a0_elex_icedid.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4352
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBAACCCCCACCACBBCCACCBBBAABCACACAACABABACCABBBCBBABABCCBCACBABABCAABCACCACCCCCBACACACAACABAACCABBABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAAAABCCBACCBCCBBBCBCACCBCACCBCCACCCBABACABACACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4188
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBAACCCCCACCACBBCCACCBBBAABCACACAACABABACCABBBCBBABABCCBCACBABABCAABCACCACCCCCBACACACAACABAACCABBABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAAAABCCBACCBCCBBBCBCACCBCACCBCCACCCBABACABACACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3104
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABACBBCCCCCBBBAABCCAACCBBAAAACCAABACACCCBABAABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAAAABCCBACCBCCBBBCBCACCBCACCBCCACCCBABACABACACBCA.exe" start= auto displayName= "UserDataSvc_AAABACBBCCCCCBBBAABCCAACCBBAAAACCAABACACCCBABAABCCA"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:812
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_AAABACBBCCCCCBBBAABCCAACCBBAAAACCAABACACCCBABAABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAAAABCCBACCBCCBBBCBCACCBCACCBCCACCCBABACABACACBCA.exe" start= auto displayName= "UserDataSvc_AAABACBBCCCCCBBBAABCCAACCBBAAAACCAABACACCCBABAABCCA"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3436
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABACBBCCCCCBBBAABCCAACCBBAAAACCAABACACCCBABAABCCA"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5884
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_AAABACBBCCCCCBBBAABCCAACCBBAAAACCAABACACCCBABAABCCA"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3408
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAAAABCCBACCBCCBBBCBCACCBCACCBCCACCCBABACABACACBCA.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAAAABCCBACCBCCBBBCBCACCBCACCBCCACCCBABACABACACBCA.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1144
    • C:\Windows\notepad.exe
      "notepad.exe"
      2⤵
        PID:4324
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABACABABBBABBBCCCAABCAACCAABBABBAACCACCBBBAABBAABBBAAAACCBCBAABBACCCCACCBCCBCAACBABAABBBBCABCBCABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCACBBCABCCAAACAABCACBACCCCABABAABBACBABBACBCBCACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3140
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABACABABBBABBBCCCAABCAACCAABBABBAACCACCBBBAABBAABBBAAAACCBCBAABBACCCCACCBCCBCAACBABAABBBBCABCBCABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCACBBCABCCAAACAABCACBACCCCABABAABBACBABBACBCBCACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:4172
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCACBBCABCCAAACAABCACBACCCCABABAABBACBABBACBCBCACCBC.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCACBBCABCCAAACAABCACBACCCCABABAABBACBABBACBCBCACCBC.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3632
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAAAABCCBACCBCCBBBCBCACCBCACCBCCACCCBABACABACACBCA.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAAAABCCBACCBCCBBBCBCACCBCACCBCCACCCBABACABACACBCA.exe
      1⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2876

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          qap`g`v~dtlq
          • Path C:\PerfLogs\qap`g`v~dtlq
          • Size 10B
          • SHA256 136274b127b5834f1a78d9ac2695b5a3033b4dcd8ad2455d678d9a035dbeaf47
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
          • Size 10B
          • SHA256 b49362308f5632ae1f3e47f90b10586bcdbe3a81795818504d40713125f42313
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
          • Size 10B
          • SHA256 c3ae7bdcd28ec33f20aab88252fde1e98c0fafbca9fd6bda93565f7ebf5f29f9
          • MD5 SHA1 SHA512
          Submit Download

          windowsdesktop-runtime-8.0.15-win-x64.exe
          • Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
          • Size 2.2MB
          • SHA256 cce48f9c42f8c2f8eee4b5427326cba3c0a1660cd62c6003345ac95aff3ef44c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\LocalLow\Oracle\qap`g`v~dtlq
          • Size 10B
          • SHA256 039166d72caa1162377b99544254e3c35823296fa99b86c5597dfe62da6891af
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
          • Size 10B
          • SHA256 04f4166671a558262eb4ee18f0fbc097997fd405a7e6c0acbe5a687cc0c80a1d
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\INetCookies\qap`g`v~dtlq
          • Size 10B
          • SHA256 899db5cabe52f0f940938e04a44999c1561c2558e32bb102a7cab946003991c8
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 80427d8f64683c0aefffd8a0120ce2abea888264daa75ba0555735757647da14
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 ad2a87f8cd31147d0e7243e7d2009967aea332ddfa02077557e01c100f28cfb7
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 2e4f67a57dd250ff17cc1ec072e24a95d17a72b9cd92ac740953cbd39ab73a61
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 3328e1064a582f1673a357fe669d8a4e6149f36ff213a9fedd42c8eb0dd94ffa
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
          • Size 10B
          • SHA256 75d8bc05b6f09931024cde89c5e38bc8ae33820fffb66141066dd9919ed72775
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
          • Size 10B
          • SHA256 3b6b27999c98553b9866d9894a8b30b6de983f1deae606139d6cb5aaf7890645
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
          • Size 10B
          • SHA256 722b0c3bafdbaedef480f8b90319b514994712b9311da2d5823e3ceae8d65d67
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Default\AppData\Local\Microsoft\Windows\History\qap`g`v~dtlq
          • Size 10B
          • SHA256 e24bf0dae6d1d96c9f9372b3edc3f6c277bb66afb6ecbbb1e2e081d26a2bf518
          • MD5 SHA1 SHA512
          Submit Download

          svchost_CBABAAAAAABCCBACCBCCBBBCBCACCBCACCBCCACCCBABACABACACBCA.exe
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAAAABCCBACCBCCBBBCBCACCBCACCBCCACCCBABACABACACBCA.exe
          • Size 1.6MB
          • SHA256 f4feb1e2ac3d7e077afb1a381d55f3cdba4b3d140c4b571577aea7bd06467ab1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 1KB
          • SHA256 1976f728ed0ee435b2078593a654f038704d388509347745a4569cb43f1e4677
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 1KB
          • SHA256 60285686baf3830e8a31a85bd7588c2cb16fb7436c29189979bd18f64c71cb6a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 926B
          • SHA256 937b8cb0fbc3de84f5c73ae4afde2d52da23da3ca8514e74c8c7385270091f54
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Public\Documents\qap`g`v~dtlq
          • Size 10B
          • SHA256 ecbe615817b1f37497620da01c058bbeac96feac3dce3c383a98981fdb0652b5
          • MD5 SHA1 SHA512
          Submit Download

          memory/1144-33-0x0000000000860000-0x0000000000881000-memory.dmp
          Download

          memory/2876-1253-0x0000000000860000-0x0000000000881000-memory.dmp
          Download

          memory/3632-68-0x00000000004A0000-0x00000000004C1000-memory.dmp
          Download

          memory/4352-6-0x0000000000250000-0x0000000000271000-memory.dmp
          Download