033062df3063de75aec216ec6751633b75e1e9d1e03fdabcb19f35b36e2796a8

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_d5e4ca26f9b7b3b029a6d828272aaa67_elex_icedid.exe
Size 1.1MB
Sample260813-tyhfcaca89
SHA256 033062df3063de75aec216ec6751633b75e1e9d1e03fdabcb19f35b36e2796a8
MD5 d5e4ca26f9b7b3b029a6d828272aaa67
SHA1 acbc99b34e0898938a1fe68c59a5989fbd230af5
SHA512 a29ca2cd0ec525904777b764e40c6976fc342dc026df56ccf1e4ad757f164f52c85f5993bf9da721b2c78d99aec95a5ac50d0867887897483427d2b2c2a71494
SSDEEP 24576:m9+EM0O9+EM0q9+EM0q9+EM5AhY59+EM0q9+EM0q9+E29+EM0q9+EM0q9+EM0O9A:U+E2+ES+ES+EkN+ES+ES+Ek+ES+ES+Er
TLSH
T11F450909F94340B1D92A54B049CBE3BF8620BA25C5134EA7F64D8FDFFBE2B915828175
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
260	svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe
1276	svchost_AACBBCBBBCBAAACAACBCACABAACCCCCACBAABBCABCACACACCACBBAA.exe
1404	svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCBCCBAAACACCACABBCABACBBCBCBCBABCABACABABBCCCCCCCCCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe"	2026-08-13_d5e4ca26f9b7b3b029a6d828272aaa67_elex_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCBABCCBCCACCBCCBBBCCBAACBCBBABACCBACCBCBBACCBBBCAABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBBCBBBCBAAACAACBCACABAACCCCCACBAABBCABCACACACCACBBAA.exe"	svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5564	sc.exe
4308	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5228	cmd.exe
5988	cmd.exe
2456	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBBCBBBCBAAACAACBCACABAACCCCCACBAABBCABCACACACCACBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_d5e4ca26f9b7b3b029a6d828272aaa67_elex_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1504	2026-08-13_d5e4ca26f9b7b3b029a6d828272aaa67_elex_icedid.exe
1504	2026-08-13_d5e4ca26f9b7b3b029a6d828272aaa67_elex_icedid.exe
1504	2026-08-13_d5e4ca26f9b7b3b029a6d828272aaa67_elex_icedid.exe
1504	2026-08-13_d5e4ca26f9b7b3b029a6d828272aaa67_elex_icedid.exe
260	svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe
260	svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe
260	svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe
260	svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe
1276	svchost_AACBBCBBBCBAAACAACBCACABAACCCCCACBAABBCABCACACACCACBBAA.exe
1276	svchost_AACBBCBBBCBAAACAACBCACABAACCCCCACBAABBCABCACACACCACBBAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	2026-08-13_d5e4ca26f9b7b3b029a6d828272aaa67_elex_icedid.exe
Token: SeDebugPrivilege	260	svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe
Token: SeDebugPrivilege	1276	svchost_AACBBCBBBCBAAACAACBCACABAACCCCCACBAABBCABCACACACCACBBAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 5228	1504	2026-08-13_d5e4ca26f9b7b3b029a6d828272aaa67_elex_icedid.exe	92
PID 5228 wrote to memory of 1864	5228	cmd.exe	94
PID 260 wrote to memory of 5032	260	svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe	95
PID 1504 wrote to memory of 5988	1504	2026-08-13_d5e4ca26f9b7b3b029a6d828272aaa67_elex_icedid.exe	98
PID 5988 wrote to memory of 5564	5988	cmd.exe	100
PID 1504 wrote to memory of 2456	1504	2026-08-13_d5e4ca26f9b7b3b029a6d828272aaa67_elex_icedid.exe	101
PID 2456 wrote to memory of 4308	2456	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-13_d5e4ca26f9b7b3b029a6d828272aaa67_elex_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_d5e4ca26f9b7b3b029a6d828272aaa67_elex_icedid.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCCAABCACBCCCBCACCCCACBACCCBACCCCBCCCBBCABABCABABABABBACBACCAAABBBCAABABACBCBCBCBCBAACABCCAAACCBBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCCAABCACBCCCBCACCCCACBACCCBACCCCBCCCBBCABABCABABABABBACBACCAAABBBCAABABACBCBCBCBCBAACABCCAAACCBBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACCBCABBCCAAABBCABAAABAABAAACCAAABBCCCABBBABABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe" start= auto displayName= "UserDataSvc_ABACCBCABBCCAAABBCABAAABAABAAACCAAABBCCCABBBABABBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACCBCABBCCAAABBCABAAABAABAAACCAAABBCCCABBBABABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe" start= auto displayName= "UserDataSvc_ABACCBCABBCCAAABBCABAAABAABAAACCAAABBCCCABBBABABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACCBCABBCCAAABBCABAAABAABAAACCAAABBCCCABBBABABBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACCBCABBCCAAABBCABAAABAABAAACCAAABBCCCABBBABABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:260
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBBBCBAAACAACBCACABAACCCCCACBAABBCABCACACACCACBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBBBCBAAACAACBCACABAACCCCCACBAABBCABCACACACCACBBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe
1⤵
- Executes dropped EXE
PID:1404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f35793892597578c47affe49468a7d80a8e8cbc7b99c47a00cee5dcf3d081ba5
MD5 4463d202eb16490e03848748687f7757
SHA1 0f5323bfbf3a99ff7201b989c8cd7c257f3a7404
SHA512 8fbc735a50cd05e8fa03f57674de3f4d38e2be3179dcda7b87d2cde5e7381b2de83fa5d50ce8b962b17bfc267bab00e5e4a5d2600361d92c5617294a5847cf90
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a514a291f93b495fbb902a7236f0baed67a06083e885672e0785139d0f6e7076
MD5 1003c45f08df321f4fa1fd510fba6a03
SHA1 b8fb6b42f1ec9bfa205fe1c9c963554083637cfd
SHA512 db486cb009339c2dcc3de51468f19e3a1f789eb6d20e51f745492c9ad0c3f03f3a4bcc0eb0fb15a141aebe681dc68e7805d3a690476347203e56ffd7bc0a9e79
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e029540b0ecd9b327e845952a4c69734f705bdfdad06111619f6e9b82c5aca92
MD5 91a2ebe5aecac79c6868c0663168dbd0
SHA1 075c393ebfaacb5c58e782e846e05dccee90b468
SHA512 1fd34e9af88c3a009ce0c16ca0bc47e1241e16363d41962863722d288a1ed3b3566de83947dbe1d52b0394662b0d4d62a142ee539fee396b043d5283bdd330d7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9c1cb0021938d8b7cfc740fffcc6ae06b14bd6d27ee491e1d8e5284325343d92
MD5 956c5f66480cb75f6ee43535c42c028f
SHA1 6178298d9f7e5658bbfa7754e16167611b18b6e1
SHA512 dfa5ab51615fe09d69ba6dc9e1c15416191ea5c04ea814913409bb87dcd157847437b84d36e8fd8c1cb6e72ff7f2632cfb6b603e57961f61c9ea82c3aa233994
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 89b1c5c0462c7bfc3cb12e23cec0f362d1f8d612998c32659c021e22369f2fd1
MD5 03deaad0ff90a4eb353c7ee108a3e898
SHA1 48292df4d971a32f36aef11d83826e9502f61139
SHA512 d5718bc758d4d5c0d80586f249e9bad4b09751bb8c4706904144daa6936849bf6a725ddb2e1585f75789dd687bd398f0d7470530d5de6142a5bd5389721ffeaa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5b19daf318324731067c0c25a7f8690b5cfb4bc97a5cbf96b8bb3527a490fa87
MD5 e44799e4bb680711a4a8e0d53a3b3531
SHA1 22272c9f5c88ab69e6fa74232f2dde0cc9f7e2f8
SHA512 f1e79158600bc3191945d0e1e5295b44e7ea6c2aa3d7509d199c626dcbe96b82eabab4d56f7138b42c3ff0de924bc24532cc16055c62312a9ac067af1d62c049
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4f949012051eb2231d44c0cd5eb2cf54b8b735ba5816c29600f1fe9607c7edb5
MD5 4c2a45ab79b1c9e5c873ec7402a51f48
SHA1 cbcad32ed41dd50bc8ca08beeb7164172ca63176
SHA512 aacc2762da84865ba1b209d38b58a0d11dfa784eeb32140ccc501817cfd240b001499a397294d1597937e568f77bf7323fd0d0bebb8920cb621de808587f466f
MD5 SHA1 SHA512

Submit Download

svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBBBCCCCCBBCCBCACAABBABCBAACAABCCBAABACBAABBCABBCAA.exe
Size 1.1MB
SHA256 033062df3063de75aec216ec6751633b75e1e9d1e03fdabcb19f35b36e2796a8
MD5 d5e4ca26f9b7b3b029a6d828272aaa67
SHA1 acbc99b34e0898938a1fe68c59a5989fbd230af5
SHA512 a29ca2cd0ec525904777b764e40c6976fc342dc026df56ccf1e4ad757f164f52c85f5993bf9da721b2c78d99aec95a5ac50d0867887897483427d2b2c2a71494
SSDEEP 24576:m9+EM0O9+EM0q9+EM0q9+EM5AhY59+EM0q9+EM0q9+E29+EM0q9+EM0q9+EM0O9A:U+E2+ES+ES+EkN+ES+ES+Ek+ES+ES+Er
TLSH
T11F450909F94340B1D92A54B049CBE3BF8620BA25C5134EA7F64D8FDFFBE2B915828175
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 865ef290ee4d9a6c91d1d13d43f9114e4ef2d081ffc905d0f2ee84d5449f5274
MD5 d28743bf7458841016a95929d45f50ad
SHA1 84c3ed6a701d19eed254b563aea3dd8add82fba3
SHA512 61a1fd03bee01908c70873aba5104e1493115c07d5e73d5e5e3dab04ffa4cea3095efb060b0778d32c0e0151dafd779e2c51e81aa6e4c84c848f4420d7289482
TLSH
T1FE112B14B4E5DC23F873688B671B9FD34CA432AF9958AF282308431A66D5C72DD198F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/260-34-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/1276-65-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/1504-0-0x0000000000710000-0x0000000000731000-memory.dmp

Download

memory/1504-8-0x0000000000710000-0x0000000000731000-memory.dmp

Download