7e3d8fe4d4c73254cb7429b87f581c513764debdc6aadbc0d750da0cf925dc2f

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_273f2cdf1eab4829f16d15f935976fea_elex_icedid_vidar.exe
Size 1.7MB
Sample260814-flbv5sfc98
SHA256 7e3d8fe4d4c73254cb7429b87f581c513764debdc6aadbc0d750da0cf925dc2f
MD5 273f2cdf1eab4829f16d15f935976fea
SHA1 be89fd1000d8051b955268b4e87e6083725d0a66
SHA512 3e230168db1bd7841f392b95d173ed5770a32fd258a2666e4e5d276e29319ff15d763d6107d29f79c32fe7122814fa3f3309a255cbe70fe26c17b7a5b834220c
SSDEEP 24576:m9+EM0q9+EM5AhYELgV83LzXYJLKSMex9+EM0q9+EM5AhYELgV83LzXYJLKSMeT2:U+ES+Ek+LgVLKR++ES+Ek+LgVLKRswMi
TLSH
T149854912FA4148F1D96224304946E67E9B75B520C7138ECBA3985EEEFFE3AD05D38235
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3184	svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe
4608	svchost_CAAABBCCBACCCCBCBBBABCCBCBCBABAAAACBAACCBBCABCBACCBBCAA.exe
2204	svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBCBBCCACBABACBCBAAAAAABCAACCCCCAABCBCABABCBAACAACAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe"	2026-08-14_273f2cdf1eab4829f16d15f935976fea_elex_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBAAACBACBCCCBBCCAAAACCACBBBACCAABABABAABBBCBBAACCBCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAABBCCBACCCCBCBBBABCCBCBCBABAAAACBAACCBBCABCBACCBBCAA.exe"	svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5524	sc.exe
1460	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4464	cmd.exe
3432	cmd.exe
2036	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_273f2cdf1eab4829f16d15f935976fea_elex_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAABBCCBACCCCBCBBBABCCBCBCBABAAAACBAACCBBCABCBACCBBCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
936	2026-08-14_273f2cdf1eab4829f16d15f935976fea_elex_icedid_vidar.exe
936	2026-08-14_273f2cdf1eab4829f16d15f935976fea_elex_icedid_vidar.exe
936	2026-08-14_273f2cdf1eab4829f16d15f935976fea_elex_icedid_vidar.exe
936	2026-08-14_273f2cdf1eab4829f16d15f935976fea_elex_icedid_vidar.exe
3184	svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe
3184	svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe
3184	svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe
3184	svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe
4608	svchost_CAAABBCCBACCCCBCBBBABCCBCBCBABAAAACBAACCBBCABCBACCBBCAA.exe
4608	svchost_CAAABBCCBACCCCBCBBBABCCBCBCBABAAAACBAACCBBCABCBACCBBCAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	936	2026-08-14_273f2cdf1eab4829f16d15f935976fea_elex_icedid_vidar.exe
Token: SeDebugPrivilege	3184	svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe
Token: SeDebugPrivilege	4608	svchost_CAAABBCCBACCCCBCBBBABCCBCBCBABAAAACBAACCBBCABCBACCBBCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 2036	936	2026-08-14_273f2cdf1eab4829f16d15f935976fea_elex_icedid_vidar.exe	92
PID 2036 wrote to memory of 2728	2036	cmd.exe	94
PID 3184 wrote to memory of 2136	3184	svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe	95
PID 936 wrote to memory of 4464	936	2026-08-14_273f2cdf1eab4829f16d15f935976fea_elex_icedid_vidar.exe	98
PID 4464 wrote to memory of 5524	4464	cmd.exe	100
PID 936 wrote to memory of 3432	936	2026-08-14_273f2cdf1eab4829f16d15f935976fea_elex_icedid_vidar.exe	101
PID 3432 wrote to memory of 1460	3432	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_273f2cdf1eab4829f16d15f935976fea_elex_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_273f2cdf1eab4829f16d15f935976fea_elex_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCBCCBCCCACCBBBCABBBBCBCABABCCACBAABAACCABBCABAACACAABCCCCCCCBAAABCBCCAABCCCABCCACACACACAABAAAAACCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCBCCBCCCACCBBBCABBBBCBCABABCCACBAABAACCABBCABAACACAABCCCCCCCBAAABCBCCAABCCCABCCACACACACAABAAAAACCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBCBBAABABBCABCBBBCABCCCAAACBBBABCCBAAABCBAAACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe" start= auto displayName= "UserDataSvc_BCCBCBBAABABBCABCBBBCABCCCAAACBBBABCCBAAABCBAAACAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBCBBAABABBCABCBBBCABCCCAAACBBBABCCBAAABCBAAACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe" start= auto displayName= "UserDataSvc_BCCBCBBAABABBCABCBBBCABCCCAAACBBBABCCBAAABCBAAACAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBCBBAABABBCABCBBBCABCCCAAACBBBABCCBAAABCBAAACAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBCBBAABABBCABCBBBCABCCCAAACBBBABCCBAAABCBAAACAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBCCBACCCCBCBBBABCCBCBCBABAAAACBAACCBBCABCBACCBBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBCCBACCCCBCBBBABCCBCBCBABAAAACBAACCBBCABCBACCBBCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe
1⤵
- Executes dropped EXE
PID:2204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 43e7b7562cf838a37d498e847125ec8df886e3833054e2da7442ae25ae80fa6a
MD5 42ae169aaed1e447b89554f77763ee42
SHA1 3d144022274d8eb58770e4e4de9afecfc7376613
SHA512 e68b643820aaaac723b76c8062518ca694810abe6c081dad2d9cc6a4ccfb9ea7c74e9cb6d9a92b1e444f70411d2b720c05b529c2e3c6b479c0996a7945f5db66
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 30af75d512f7229b9dcd801255f30e2e82ff7ac9f5cc48097bd4409f5f77a21b
MD5 6e75e76fb67e12b5f3dfe14d13d16f64
SHA1 2a577604e75b2e4bb52f9753a778f245bd5a66ea
SHA512 e76a634291370792cb9e390c7979c1c80ab8c53a690b714b34f25293dfe8556cb9f7b0228b80d210b2384a0933d10c9df3a94db929f5077f44db6a59a50f2bc4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fc651ff1634451da3357d9217ddcbadcfee6df273ffa4171d1a1050b55c487e9
MD5 9f17c00a12fbd83a51d457fcac1ab989
SHA1 02d4e9f7393080dc595ccf0cdb9ad28fd036b20c
SHA512 53fa93353ec6d5d77ed06474c28f45974d79a07d07f12cf82689bc4bbe9f37fb1193d465d68615b61ebe1acd9cb4a31be0fd7b673507181e925f95b2131a4f63
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 29de48e8434824467e202f23e772cc6aeb3cd156dcc7fc9ad29cc77a1231b565
MD5 8ac356eecd3e9efbdc642eb24cfe7b9a
SHA1 dd610bd9277a7def927a1b33ad47deada91603d8
SHA512 ac41d6e49091b4b9e7d924e3af977a0a7553025f2668f0334282af4818b80c68644d850abacab10727afd37b5b7d09a0d21a9a38980cf4b2856fac039e2f7664
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 72e8dabf8fe9ad9df4178d55dea34a252242886066d443cf325443118a28f9d0
MD5 a2f25585dec21438794331a6438587bc
SHA1 4d8e36d2c41baefa0ab7536560850fbdc93a62b2
SHA512 ee7af370ee04ea89f5ad692d13c58c98c4293043a4d0c5adaa68618d1e338091e3288921c6b8973aa1ff199a8cb437fd0d61a1ed0530d059e8591fb0880e29df
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d8086e5e9fee8036c0735a9aeb8b24552672c7dea0232bb6baaa998ab9d67bb8
MD5 dff5409a2d7e4823d82cede28f43b035
SHA1 f5347be8c85eb05b7b88ac010583295543264e7f
SHA512 8c3b4b351c072080a4c45816a12bb5405be173ca4cb26aaf0d7233d599e7ed2a230d186214d40b0c7dd15f1343be2a868ed6f8bca05791835c67d83e884d162d
MD5 SHA1 SHA512

Submit Download

svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCBBCAAAACACBBCABBAABCACCAABAABCCCCCABCBBCAACACAAC.exe
Size 1.7MB
SHA256 7e3d8fe4d4c73254cb7429b87f581c513764debdc6aadbc0d750da0cf925dc2f
MD5 273f2cdf1eab4829f16d15f935976fea
SHA1 be89fd1000d8051b955268b4e87e6083725d0a66
SHA512 3e230168db1bd7841f392b95d173ed5770a32fd258a2666e4e5d276e29319ff15d763d6107d29f79c32fe7122814fa3f3309a255cbe70fe26c17b7a5b834220c
SSDEEP 24576:m9+EM0q9+EM5AhYELgV83LzXYJLKSMex9+EM0q9+EM5AhYELgV83LzXYJLKSMeT2:U+ES+Ek+LgVLKR++ES+Ek+LgVLKRswMi
TLSH
T149854912FA4148F1D96224304946E67E9B75B520C7138ECBA3985EEEFFE3AD05D38235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7d63b3e3da1b14f7d7b037a61737aa9b6ad6dd1183adf503b382326e0fe24b00
MD5 c6ae28c25d421a405f18abddcd8445d1
SHA1 6e22371820d4ee9515ebec8ba7056f7ede85273a
SHA512 c7d7880dbb323f6cc31a7933fe422ae41a6b0e70ede32ad825a70fd699d9d560d57d262fe5fc7caa6fdbbd2442a30ea3da1adcfd67c8d272b63b09da4c681a27
TLSH
T16C11E752E8E6D837FC33A8CB512ADBC20CB4769BBC146A14138D41287BDAE314D594E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/936-0-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/936-7-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/2204-81-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/3184-34-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/3184-24-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/4608-79-0x0000000000100000-0x0000000000121000-memory.dmp

Download