6becdbd2c709cce236abf7f770981a166de71613b702d670da27440bd4d4d1f0

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_92e7376c0a0a8cfc5e61f200c1fcc346_elex_icedid.exe
Size 977KB
Sample260816-aj461sal71
SHA256 6becdbd2c709cce236abf7f770981a166de71613b702d670da27440bd4d4d1f0
MD5 92e7376c0a0a8cfc5e61f200c1fcc346
SHA1 5e2c496867a32047614c1a688126d0e568d15c52
SHA512 7d3c29eda7ecdf6b7fe90ec5780e4b9d316977f41266c768438e349a32268637b3d88525d6764520d9a848499d2330833691d570f96ea2d2ecc53cd6ddacbbfc
SSDEEP 24576:m9+EM0q9+EM0q9+EM0O9+EM0q9+EM0q9+EM5AhYsv9+EM0O9+EM0qt:U+ES+ES+E2+ES+ES+Eks+E2+E6
TLSH
T14A250A09F94340B1D92A54B049CBE2BF8720BA25C5134EE7F6498FDFFBE2B915828175
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6012	svchost_BAAACABACABCABCBAABAACCBACABBACAABAABCCAACBCABCCAACBABB.exe
7036	svchost_ACCBABCAAACACABCABAACACCCCACCACCCBAACABABBCCAABCBBCCBBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAACCCABBBBAACBCBCAABCAABBCCAABCCACBABCBAAACCAABBAAACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAACABACABCABCBAABAACCBACABBACAABAABCCAACBCABCCAACBABB.exe"	2026-08-15_92e7376c0a0a8cfc5e61f200c1fcc346_elex_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABABCBCBACCAACACCCCCCBBACBCBCBBCAAABAABABBCCBBAAAACCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBABCAAACACABCABAACACCCCACCACCCBAACABABBCCAABCBBCCBBA.exe"	svchost_BAAACABACABCABCBAABAACCBACABBACAABAABCCAACBCABCCAACBABB.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3424	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBABCAAACACABCABAACACCCCACCACCCBAACABABBCCAABCBBCCBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_92e7376c0a0a8cfc5e61f200c1fcc346_elex_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAACABACABCABCBAABAACCBACABBACAABAABCCAACBCABCCAACBABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1260	2026-08-15_92e7376c0a0a8cfc5e61f200c1fcc346_elex_icedid.exe
1260	2026-08-15_92e7376c0a0a8cfc5e61f200c1fcc346_elex_icedid.exe
1260	2026-08-15_92e7376c0a0a8cfc5e61f200c1fcc346_elex_icedid.exe
1260	2026-08-15_92e7376c0a0a8cfc5e61f200c1fcc346_elex_icedid.exe
6012	svchost_BAAACABACABCABCBAABAACCBACABBACAABAABCCAACBCABCCAACBABB.exe
6012	svchost_BAAACABACABCABCBAABAACCBACABBACAABAABCCAACBCABCCAACBABB.exe
6012	svchost_BAAACABACABCABCBAABAACCBACABBACAABAABCCAACBCABCCAACBABB.exe
6012	svchost_BAAACABACABCABCBAABAACCBACABBACAABAABCCAACBCABCCAACBABB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	2026-08-15_92e7376c0a0a8cfc5e61f200c1fcc346_elex_icedid.exe
Token: SeDebugPrivilege	6012	svchost_BAAACABACABCABCBAABAACCBACABBACAABAABCCAACBCABCCAACBABB.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 3424	1260	2026-08-15_92e7376c0a0a8cfc5e61f200c1fcc346_elex_icedid.exe	93
PID 3424 wrote to memory of 1152	3424	cmd.exe	95
PID 6012 wrote to memory of 848	6012	svchost_BAAACABACABCABCBAABAACCBACABBACAABAABCCAACBCABCCAACBABB.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-15_92e7376c0a0a8cfc5e61f200c1fcc346_elex_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_92e7376c0a0a8cfc5e61f200c1fcc346_elex_icedid.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCAAAABCCAAAABABAAABBABACCBABCABCCCCCCBACACCCCACAACCBCABBACBCCCCACBCBACBACBACBABBCCAACCACBCCABBACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACABACABCABCBAABAACCBACABBACAABAABCCAACBCABCCAACBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCAAAABCCAAAABABAAABBABACCBABCABCCCCCCBACACCCCACAACCBCABBACBCCCCACBCBACBACBACBABBCCAACCACBCCABBACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACABACABCABCBAABAACCBACABBACAABAABCCAACBCABCCAACBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACABACABCABCBAABAACCBACABBACAABAABCCAACBCABCCAACBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACABACABCABCBAABAACCBACABBACAABAABCCAACBCABCCAACBABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6012
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:848

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABCAAACACABCABAACACCCCACCACCCBAACABABBCCAABCBBCCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABCAAACACABCABAACACCCCACCACCCBAACABABBCCAABCBBCCBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 13e560e25b6b87dd6e49034770581a82a73413683f6d6c682f75489020eabe6e
MD5 aa6aa6693a610e9d802e74c230f3b333
SHA1 f80132210b07b45cd0e970dc5416e9ddebca0156
SHA512 59c45e8cbdb8bdfea608edd4cbd3cac1428c5dd4adc2f2cede0c748f9aed25069a50aa258d35d3d31716b0f0e2df898eaca32bf090b3233bbf6120d6be2c7d09
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cdb85f6e5908b11b56af6a3d9d82c62c4075a0ba524c4b48f9f8667d971d84b6
MD5 7d9867bba63048ba96df6dff76ef8163
SHA1 288bef1613b87db4f5cfaafdfcb6c0d792b61ee3
SHA512 d4920ead78f4cb00909145ceb86d35e70cd62e691cc742f8816df7b2e0663f6f08ce705e7e35b92d75fab98f6f1a7803c99fe0f5187dabf9898ce5baf4853470
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ec5113b78545259561c5aa18774cbbd167c5943918d814e5547a58c2eca1a8a4
MD5 fe1710e2a7bf81dbf76b5635a4240deb
SHA1 23f6a5e9a497f0a51667173ceebaadc665c74675
SHA512 ce265eb3017c25fc35c563ccc831012b2fab32c3052ff1175faae497acade226787cfc4174d5f23c4a5c4baba79b43e11938546a9b07366b2361777e633da92b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4488c10ad5cac3278333ec6f12630ce7e84d448dc172e77d12e39237f743a64a
MD5 54c8c36789e4b4d65612f571d4c08d53
SHA1 30b4d18171bea7fd9baf97e4496339535f7ae63b
SHA512 960b9a60ed6e704d2b18a8a11ef19aeb917ce3a41692591e4569e954ef7761f693d5cfa7f913e2693a9f6e04bee640e1368d15b49c722843dc07ae0cdf5e00b5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fe373a49b848f3cac593449cd33adecc28c74a8b465442ee30093013cb1d427e
MD5 85135353edae7216ee2476291066cec3
SHA1 7e7aacd3a9562a2cfba4f97d2f030e1bd7ff7e30
SHA512 89806161d1c81d3b54754082c55cbd40ba62ea7ef5bfdefab87912597fdb9dc9334d133c719ee1bf9f88b9c23aa6f3f2752576f84231dbaf4d11d9f458c71180
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f70f955057e05f3ce96ee99a8b71bc0558e1920118fa3fb93ef9d506dc2ec3e6
MD5 0c94771f48d5d05b06c9d2a8f048626d
SHA1 09bbcb07c32934d605da3717460bf29c450988a1
SHA512 4c5db0e38632c0a4cf86beee31d7a8d3d7e0fe2cf0535c6e86e1c99c1ff71e3c17eae2738a9da0aaf859f43cff6655bd8d9cdea9c500e658e507b9e0b5850da6
MD5 SHA1 SHA512

Submit Download

svchost_BAAACABACABCABCBAABAACCBACABBACAABAABCCAACBCABCCAACBABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACABACABCABCBAABAACCBACABBACAABAABCCAACBCABCCAACBABB.exe
Size 977KB
SHA256 6becdbd2c709cce236abf7f770981a166de71613b702d670da27440bd4d4d1f0
MD5 92e7376c0a0a8cfc5e61f200c1fcc346
SHA1 5e2c496867a32047614c1a688126d0e568d15c52
SHA512 7d3c29eda7ecdf6b7fe90ec5780e4b9d316977f41266c768438e349a32268637b3d88525d6764520d9a848499d2330833691d570f96ea2d2ecc53cd6ddacbbfc
SSDEEP 24576:m9+EM0q9+EM0q9+EM0O9+EM0q9+EM0q9+EM5AhYsv9+EM0O9+EM0qt:U+ES+ES+E2+ES+ES+Eks+E2+E6
TLSH
T14A250A09F94340B1D92A54B049CBE2BF8720BA25C5134EE7F6498FDFFBE2B915828175
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1260-0-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/1260-8-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/6012-35-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download