2758a5758c06abc89df30bda78456aec7e6bbc8a92c22d4b4fd13686ab8badc2

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_6648895989fa43d67129bf6dca8e7be6_amadey_elex_icedid.exe
Size 1.0MB
Sample260815-eaxsssybje
SHA256 2758a5758c06abc89df30bda78456aec7e6bbc8a92c22d4b4fd13686ab8badc2
MD5 6648895989fa43d67129bf6dca8e7be6
SHA1 e8c45b925fc8b3b34778f488566ad7ebe7002614
SHA512 10a59f80cb2f8d92f300518b1654e16988122230b3cb10769d6a3a8a13c347f376ce8081ecb6306cc52b6667f9dbf3c6b67c8b5f22f8f8b8512fd69c07c66139
SSDEEP 24576:m9+EM0q9+EMELdAhY79+EM0q9+EMELdAhYi:U+ES+Epx3+ES+Epxs
TLSH
T1EB353A06FA4280B5D46609704A96E67E8731BD25C4134FABF288AECFFFF2B915D14631
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5864	svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe
3588	svchost_ABBCCCAAAABBBCCBBAAACCBBCCBACCACCCCCABABAACABCCACCACBBC.exe
1940	svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACABAABCCCACCCBCCCBBCCBBABBCABBCCCAAAAACABCABBBBABBABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe"	2026-08-15_6648895989fa43d67129bf6dca8e7be6_amadey_elex_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACCABAABBCCBBBCCCCCBBCABCCABABABACCBAAAAAAACBBCCBCABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCCCAAAABBBCCBBAAACCBBCCBACCACCCCCABABAACABCCACCACBBC.exe"	svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1472	sc.exe
1772	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4752	cmd.exe
1744	cmd.exe
5040	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_6648895989fa43d67129bf6dca8e7be6_amadey_elex_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCCCAAAABBBCCBBAAACCBBCCBACCACCCCCABABAACABCCACCACBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4424	2026-08-15_6648895989fa43d67129bf6dca8e7be6_amadey_elex_icedid.exe
4424	2026-08-15_6648895989fa43d67129bf6dca8e7be6_amadey_elex_icedid.exe
4424	2026-08-15_6648895989fa43d67129bf6dca8e7be6_amadey_elex_icedid.exe
4424	2026-08-15_6648895989fa43d67129bf6dca8e7be6_amadey_elex_icedid.exe
5864	svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe
5864	svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe
5864	svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe
5864	svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe
3588	svchost_ABBCCCAAAABBBCCBBAAACCBBCCBACCACCCCCABABAACABCCACCACBBC.exe
3588	svchost_ABBCCCAAAABBBCCBBAAACCBBCCBACCACCCCCABABAACABCCACCACBBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4424	2026-08-15_6648895989fa43d67129bf6dca8e7be6_amadey_elex_icedid.exe
Token: SeDebugPrivilege	5864	svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe
Token: SeDebugPrivilege	3588	svchost_ABBCCCAAAABBBCCBBAAACCBBCCBACCACCCCCABABAACABCCACCACBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 4752	4424	2026-08-15_6648895989fa43d67129bf6dca8e7be6_amadey_elex_icedid.exe	92
PID 4752 wrote to memory of 5184	4752	cmd.exe	94
PID 5864 wrote to memory of 1372	5864	svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe	95
PID 4424 wrote to memory of 1744	4424	2026-08-15_6648895989fa43d67129bf6dca8e7be6_amadey_elex_icedid.exe	98
PID 1744 wrote to memory of 1472	1744	cmd.exe	100
PID 4424 wrote to memory of 5040	4424	2026-08-15_6648895989fa43d67129bf6dca8e7be6_amadey_elex_icedid.exe	101
PID 5040 wrote to memory of 1772	5040	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_6648895989fa43d67129bf6dca8e7be6_amadey_elex_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_6648895989fa43d67129bf6dca8e7be6_amadey_elex_icedid.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACCACABACAABACABCACCCCBBCCBACCCABCBACAACBBAAAABBBBCBBCBABAABBBACABACACBBABCCBABACBBCAACAACCBCBBACCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACCACABACAABACABCACCCCBBCCBACCCABCBACAACBBAAAABBBBCBBCBABAABBBACABACACBBABCCBABACBBCAACAACCBCBBACCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCAAABCAACCCACABBBBBBCBAACCBCCABABABCCCBACABBCACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe" start= auto displayName= "UserDataSvc_CCCAAABCAACCCACABBBBBBCBAACCBCCABABABCCCBACABBCACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCAAABCAACCCACABBBBBBCBAACCBCCABABABCCCBACABBCACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe" start= auto displayName= "UserDataSvc_CCCAAABCAACCCACABBBBBBCBAACCBCCABABABCCCBACABBCACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCAAABCAACCCACABBBBBBCBAACCBCCABABABCCCBACABBCACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCAAABCAACCCACABBBBBBCBAACCBCCABABABCCCBACABBCACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1772

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5864
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1372

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCCAAAABBBCCBBAAACCBBCCBACCACCCCCABABAACABCCACCACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCCAAAABBBCCBBAAACCBBCCBACCACCCCCABABAACABCCACCACBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe
1⤵
- Executes dropped EXE
PID:1940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2b3bfda3847de6fb3ec5528a976321b3084258ec6dda613b67b944cf1f5a4f3d
MD5 1a82231b02d675cfda9072c6c789fd15
SHA1 9e6172b452aa06a0660e5fbfa53f6d832b461420
SHA512 9d5f59fda4e0285f8b65078025b59ecbc94b5b63ac480ad8c0b8ea40f9f311196a229311d3652682278f002112aebbff73b58cf62fabf4eb4219e5c4ae5cdcb5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0deb1591083dc079eb27047ed0f7bfa9d9a5738acbca9973c0823b68a6384e2d
MD5 397f7db5e9bf5abc95ecd2ac164f6e9f
SHA1 a29a287ebfd02163aa1c216dfca51614d56f0248
SHA512 8b59448874d47634a226b4ca514d3485dede154567f01ae579132fc9f4748c33f867cf86d7946557bdbb5a34bb951e4982ba9d7391a0a290e7177f7b8bdea2ab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7d80f7f1c7a8d1bddf54ed32794cf07d078f4b5392d091351ac5f031506f6df8
MD5 ec1a670d04d946acaf017ca540da3001
SHA1 533e1bb2fcba49db70b12893dc4b743d0d11e8cf
SHA512 ab599de265098dcfb8dd171c092155c3afd29c47d2f00ebae6286e8fa72d330edf8956634196ff60879f890af8ae2af8d62d46ec89789b2b4e399ba497ea59e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9190676a2ba7071abc704dbe2e73d3cbb38ad34ac816ad351641def8dffbc47e
MD5 2b0511fb4950a0b47e482d0d6621b81a
SHA1 f739e292d56f214989a46a7cadc03370378bbfbc
SHA512 466cd1ae8488495cd9e52b1392961a99cb02cbc85956f53dbfbee56ff5bfa9b467ab936f5a9cfe3d14149888f7eb52179f96827ac90199ce6950fd62c4cbf722
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f58a0aea2270d3fd5527c6b50d4f1620ed0f3ae56714481edec3a092e9a32bf7
MD5 1e69199b39847c39d3e16beb6e2727cd
SHA1 03a8be5464e4996429de5e1b2f29107384e8416f
SHA512 80793f835b8084651e61afe4ae3946db6b40c6178e19c276c4649f76f55218044b17580021159e77f731c783ff1216319524c4c8205312b08ae84746e6b290a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b7f523a9cf1c9b1b41335d2236b2d8ac7f848afa42194f0bb6270585787f2cf7
MD5 ba7d5d88476dec251064a03d2d016add
SHA1 98ea3666a4a8d66aa2b75140d2d9567ebfc5214c
SHA512 90964494244f8220e3cc9eb70435b537f18b9671e727291dd9f1ab904905c996fcaa985b77ac55adc3d21b5780fe690e22705083a42a6c1486ea3e4acc95dde9
MD5 SHA1 SHA512

Submit Download

svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCACACBACCBABBAABABCACBACABCABACBCBAAAABBBAABCAABAB.exe
Size 1.0MB
SHA256 2758a5758c06abc89df30bda78456aec7e6bbc8a92c22d4b4fd13686ab8badc2
MD5 6648895989fa43d67129bf6dca8e7be6
SHA1 e8c45b925fc8b3b34778f488566ad7ebe7002614
SHA512 10a59f80cb2f8d92f300518b1654e16988122230b3cb10769d6a3a8a13c347f376ce8081ecb6306cc52b6667f9dbf3c6b67c8b5f22f8f8b8512fd69c07c66139
SSDEEP 24576:m9+EM0q9+EMELdAhY79+EM0q9+EMELdAhYi:U+ES+Epx3+ES+Epxs
TLSH
T1EB353A06FA4280B5D46609704A96E67E8731BD25C4134FABF288AECFFFF2B915D14631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 044533abb6041bab9a9ebdef6b49aaa4c1c00a218d97bbcc88a86bff8274f2b2
MD5 135592713f112c3a37f142ef29b3f80d
SHA1 276c16550769c369297d5fe89a100da78fb92b67
SHA512 14a32b75ea791875c5633ebf2b2f13366a1d4fb526968d4d4388c2d43d259dad129b2b96b0444f65b359440ea5ab4f84c90498d27c42cfb01c1981de945c20bc
TLSH
T1D811CA61D4E5DCA3FA2268DF992EAA830CF43F9B9C5C6E241305411CB795C73CE254E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1940-81-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/3588-79-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/4424-0-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/4424-7-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/5864-33-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/5864-23-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download