575756ebfe171f2ee7992a5aee659fe636ea64b93ad54bfcadd439a903b8aac6

Analysis

max time kernel
149s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_655045151456f03489e59c2b783ff2cf_elex_icedid.exe
Size 476KB
Sample260814-qs2egsvcle
SHA256 575756ebfe171f2ee7992a5aee659fe636ea64b93ad54bfcadd439a903b8aac6
MD5 655045151456f03489e59c2b783ff2cf
SHA1 1954e8422b98ea0c7758b8ee058473cd82bed8b6
SHA512 65ce9bb0ff2775a80601ceb6185756e48406ed5f0950c496e4d8e168b63fb3d6562997557398e6a224241d105a3a4c4f9a0ae198f9a4a546276da3273af2ceed
SSDEEP 12288:mgUFgEsnojA9gUugUFgEsnojA9MAmZXuYu:m9+EM0q9u9+EM0qMAhYu
TLSH
T114A4F909FA4240F1D82608704987E3BE8720BA25C5134EABF6999FCFFFF2A915D18575
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1968	svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe
916	svchost_ACCCCCAACABACCBBBBBCAAABBBBCCBAACBCBCCABBCACACCCCCCCBBB.exe
3400	svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCCCBCCBBCCABCAACBCBACBABAABBBBACCACAABCCAAAAACABAACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCCCAACABACCBBBBBCAAABBBBCCBAACBCBCCABBCACACCCCCCCBBB.exe"	svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBCCABBBACCBBBBBCBACBAAABCACACACBCACCCBBABCCBCBBAAACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe"	2026-08-14_655045151456f03489e59c2b783ff2cf_elex_icedid.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2856	sc.exe
2400	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1492	cmd.exe
5664	cmd.exe
1088	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_655045151456f03489e59c2b783ff2cf_elex_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCCCAACABACCBBBBBCAAABBBBCCBAACBCBCCABBCACACCCCCCCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2196	2026-08-14_655045151456f03489e59c2b783ff2cf_elex_icedid.exe
2196	2026-08-14_655045151456f03489e59c2b783ff2cf_elex_icedid.exe
2196	2026-08-14_655045151456f03489e59c2b783ff2cf_elex_icedid.exe
2196	2026-08-14_655045151456f03489e59c2b783ff2cf_elex_icedid.exe
1968	svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe
1968	svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe
1968	svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe
1968	svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe
916	svchost_ACCCCCAACABACCBBBBBCAAABBBBCCBAACBCBCCABBCACACCCCCCCBBB.exe
916	svchost_ACCCCCAACABACCBBBBBCAAABBBBCCBAACBCBCCABBCACACCCCCCCBBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	2026-08-14_655045151456f03489e59c2b783ff2cf_elex_icedid.exe
Token: SeDebugPrivilege	1968	svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe
Token: SeDebugPrivilege	916	svchost_ACCCCCAACABACCBBBBBCAAABBBBCCBAACBCBCCABBCACACCCCCCCBBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1492	2196	2026-08-14_655045151456f03489e59c2b783ff2cf_elex_icedid.exe	92
PID 1492 wrote to memory of 5644	1492	cmd.exe	94
PID 1968 wrote to memory of 5584	1968	svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe	95
PID 2196 wrote to memory of 5664	2196	2026-08-14_655045151456f03489e59c2b783ff2cf_elex_icedid.exe	98
PID 5664 wrote to memory of 2856	5664	cmd.exe	100
PID 2196 wrote to memory of 1088	2196	2026-08-14_655045151456f03489e59c2b783ff2cf_elex_icedid.exe	101
PID 1088 wrote to memory of 2400	1088	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_655045151456f03489e59c2b783ff2cf_elex_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_655045151456f03489e59c2b783ff2cf_elex_icedid.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCCCACACBAACCCCACCABCBCCAABCBBAABBBBAAAACCCBACCCBABBACACABABABAAAAAABACACCBCBAAAABABBCCAAABCAABCBBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCCCACACBAACCCCACCABCBCCAABCBBAABBBBAAAACCCBACCCBABBACACABABABAAAAAABACACCBCBAAAABABBCCAAABCAABCBBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCBCBACCACBBBAACCBBBABAABCABCAABBCBBCABCCCABABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe" start= auto displayName= "UserDataSvc_CCCCBCBACCACBBBAACCBBBABAABCABCAABBCBBCABCCCABABCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCBCBACCACBBBAACCBBBABAABCABCAABBCBBCABCCCABABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe" start= auto displayName= "UserDataSvc_CCCCBCBACCACBBBAACCBBBABAABCABCAABBCBBCABCCCABABCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCBCBACCACBBBAACCBBBABAABCABCAABBCBBCABCCCABABCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCBCBACCACBBBAACCBBBABAABCABCAABBCBBCABCCCABABCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2400

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5584

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCAACABACCBBBBBCAAABBBBCCBAACBCBCCABBCACACCCCCCCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCAACABACCBBBBBCAAABBBBCCBAACBCBCCABBCACACCCCCCCBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe
1⤵
- Executes dropped EXE
PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2840c279f3848eed8e8e3ae95cc7d9b2f52e6af4bebada32b0b9110ff2d8073f
MD5 4cbf32aa2264c06ae7ca5508a9483682
SHA1 cfbc095cd3a4b92806c6a558310d3eb6bf04ef74
SHA512 065f3a95f42e656a55ba3f6023e4e6bbb3daa335f27c4f5b03e6cc12374226749f3659193fd2160a9fbd5757b0935d785b0cfb46be50c7a0c7f05f9f52a819d2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7e149890b5966f157f274a3ff200e9ba6964b0dc4e116bf16cfe0629bf66b803
MD5 709962cad6ec562ddc95e1dce664c528
SHA1 f67879adf15f511f2746bc2dfecbfb578cbaa555
SHA512 5b1d01cdb19ea32e64b75b263a9d371c4eabbf92569822f093e2073860385bede7a99d014e8acb068a610fae0150fec8bf0343ccc5a07cd82aa0372887082de5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b1c6d18146861706b95a09c051d1caa4c9055ca458a3fb953de6ab4e6cf6e1be
MD5 3d7f6fa24f4568aea0f162cfc5ab14bf
SHA1 489d415de53c6d9665914398da9786b5ea9a98fc
SHA512 d0e8419e75ac807498698711651a674631b7c89493d001828a9b0e9eedb16a54f236e61f89cecc693cbe2664771d1460aec8856818bccd27e7fc6684f484a213
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e057876e0ab831e0a1d4fb1525cbfac252d96426e76adba9391c22f128f450f9
MD5 162955023cdd87be5ac31d46cb414285
SHA1 b9b3c869d5508e8e5881d53b3512cb52de022e57
SHA512 9f9798b6099be4539776d03580d8eaf181b74cf9a7f3d72a98d59d4d8aff1651cafb4b99cb9c34fb2eb401aa34a47d92f20533146f863a80c88bc4b0d439cd73
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 83244a6204150f81d3e3050d63c489be679743756d5ae71e17b2a27fb1378b72
MD5 146b68abb73e096f64e522cb42248b9f
SHA1 e55ed4cad88acf39e57786dddda1c2983f165af4
SHA512 8a86ca374f1c9213bf64613ef90df56ec92904f3da26c056aa5a1f091d83aeeb43c39afe5cdff1d99b0793e4d9fb9ad0609db51ca1c5de2f1f46da70a428685e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8fbc154b84a3cce2a2f43624ed04211df372e6c84aab0ce8a8eb22d205274c6d
MD5 1339be5a1a1b7de479ed0a47f7fa266e
SHA1 f5d0164b07422709b1765c5cf6e4af6a377987a2
SHA512 e547d841b9f215bcc405942a019385d4e8d1ba3bccbdc47f1e7c23c9160fc2e835afe5545ee790879865eed84d0c8c39e4c34fe4452b9fcc565083d81f39c341
MD5 SHA1 SHA512

Submit Download

svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBABBABBABABCCBBCCCAACBCCAAACCBBCABCCBACAAACACCBAB.exe
Size 476KB
SHA256 575756ebfe171f2ee7992a5aee659fe636ea64b93ad54bfcadd439a903b8aac6
MD5 655045151456f03489e59c2b783ff2cf
SHA1 1954e8422b98ea0c7758b8ee058473cd82bed8b6
SHA512 65ce9bb0ff2775a80601ceb6185756e48406ed5f0950c496e4d8e168b63fb3d6562997557398e6a224241d105a3a4c4f9a0ae198f9a4a546276da3273af2ceed
SSDEEP 12288:mgUFgEsnojA9gUugUFgEsnojA9MAmZXuYu:m9+EM0q9u9+EM0qMAhYu
TLSH
T114A4F909FA4240F1D82608704987E3BE8720BA25C5134EABF6999FCFFFF2A915D18575
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 6686a4d1e74a0bbbce0bea19886774ee185cdcd7934f59a9c6df81b6714cac22
MD5 02eacbef90f04456fb9c52e5ff1c6ec2
SHA1 34b5114bad1febcb576b7a0ba791377f293c8673
SHA512 ca45352083319918a503f8551419abb5e3a0fe997b530f20f1eeb63c816fda476c9e6d37c29e80286581280fbad6507a2f0f1906d61a7f732f8f45bc3ff3185d
TLSH
T12E112790E4E6D873FA7364CE463BDF8208F873AF9958EA061304C118AF81C31CE154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/916-79-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/1968-24-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/1968-34-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/2196-0-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/2196-7-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/3400-81-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download