196cf696f3e15c5d7ea839f310a07fb5bf0839112e214507c1b5ca9d7b7d7c86

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 00:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_4d8426e6084fa8f261b22e7e4a89861b_amadey_elex_icedid_njrat.exe
Size 735KB
Sample260816-ax825axtes
SHA256 196cf696f3e15c5d7ea839f310a07fb5bf0839112e214507c1b5ca9d7b7d7c86
MD5 4d8426e6084fa8f261b22e7e4a89861b
SHA1 f1f9fc470c5a52418d2e497e8d15075017481b80
SHA512 48b5ea78fd1c7e5cca745831a054c34b252e46ed2cfad00d20699a4f4647937cd603f4f8bcb4398144e96a3187b307d8d670287f3a45ee7695fa6a7d5343a9d2
SSDEEP 12288:mgUFgEsnojAKgUFgEsnojA9gUFgEsnojA9gUFgEsnojAxLZagw9eBrCB1igsNBfl:m9+EM0v9+EM0q9+EM0q9+EM0g4LfslZX
TLSH
T189F49D06F98244F5D96B41704DCBD27EC671BE224611CEEBF798C71B6E23BA0AC29711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3448	svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe
4520	svchost_CCABCBBCACBBCCCABACAACACBAAAACBABCCCACBCCACCBACBCACCBAB.exe
3408	svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCACCABBACCAACBCABCAACACCCCCBBAAACBABABBBBBABCCBCCBAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABCBBCACBBCCCABACAACACBAAAACBABCCCACBCCACCBACBCACCBAB.exe"	svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAAABACCABBCBCACBBABBBABBABCBBBCABCCCBCBACBCABCCACABACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe"	2026-08-15_4d8426e6084fa8f261b22e7e4a89861b_amadey_elex_icedid_njrat.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5040	sc.exe
932	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4700	cmd.exe
2760	cmd.exe
5284	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_4d8426e6084fa8f261b22e7e4a89861b_amadey_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABCBBCACBBCCCABACAACACBAAAACBABCCCACBCCACCBACBCACCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4676	2026-08-15_4d8426e6084fa8f261b22e7e4a89861b_amadey_elex_icedid_njrat.exe
4676	2026-08-15_4d8426e6084fa8f261b22e7e4a89861b_amadey_elex_icedid_njrat.exe
4676	2026-08-15_4d8426e6084fa8f261b22e7e4a89861b_amadey_elex_icedid_njrat.exe
4676	2026-08-15_4d8426e6084fa8f261b22e7e4a89861b_amadey_elex_icedid_njrat.exe
3448	svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe
3448	svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe
3448	svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe
3448	svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe
4520	svchost_CCABCBBCACBBCCCABACAACACBAAAACBABCCCACBCCACCBACBCACCBAB.exe
4520	svchost_CCABCBBCACBBCCCABACAACACBAAAACBABCCCACBCCACCBACBCACCBAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4676	2026-08-15_4d8426e6084fa8f261b22e7e4a89861b_amadey_elex_icedid_njrat.exe
Token: SeDebugPrivilege	3448	svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe
Token: SeDebugPrivilege	4520	svchost_CCABCBBCACBBCCCABACAACACBAAAACBABCCCACBCCACCBACBCACCBAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4700	4676	2026-08-15_4d8426e6084fa8f261b22e7e4a89861b_amadey_elex_icedid_njrat.exe	91
PID 4700 wrote to memory of 5220	4700	cmd.exe	93
PID 3448 wrote to memory of 1576	3448	svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe	94
PID 4676 wrote to memory of 2760	4676	2026-08-15_4d8426e6084fa8f261b22e7e4a89861b_amadey_elex_icedid_njrat.exe	97
PID 2760 wrote to memory of 5040	2760	cmd.exe	99
PID 4676 wrote to memory of 5284	4676	2026-08-15_4d8426e6084fa8f261b22e7e4a89861b_amadey_elex_icedid_njrat.exe	100
PID 5284 wrote to memory of 932	5284	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-15_4d8426e6084fa8f261b22e7e4a89861b_amadey_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_4d8426e6084fa8f261b22e7e4a89861b_amadey_elex_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCBCACCABCAACAACAAAABCBBACCBCACAACBBBCCCBABCCABBAABBBABCABABACCCCBBBCBCAACAABABBCCCCCBCABBBBABCCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCBCACCABCAACAACAAAABCBBACCBCACAACBBBCCCBABCCABBAABBBABCABABACCCCBBBCBCAACAABABBCCCCCBCABBBBABCCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBBBBCABCBACAACBBCBCABCCCCCBBACBACBACBCAAABBABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe" start= auto displayName= "UserDataSvc_CABBBBBCABCBACAACBBCBCABCCCCCBBACBACBACBCAAABBABACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBBBBCABCBACAACBBCBCABCCCCCBBACBACBACBCAAABBABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe" start= auto displayName= "UserDataSvc_CABBBBBCABCBACAACBBCBCABCCCCCBBACBACBACBCAAABBABACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBBBBCABCBACAACBBCBCABCCCCCBBACBACBACBCAAABBABACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5284
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBBBBCABCBACAACBBCBCABCCCCCBBACBACBACBCAAABBABACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:932

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1576

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBCACBBCCCABACAACACBAAAACBABCCCACBCCACCBACBCACCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBCACBBCCCABACAACACBAAAACBABCCCACBCCACCBACBCACCBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe
1⤵
- Executes dropped EXE
PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fb7e516b3b74be0accf40093f7286242d8ac75b555eee1b403ff1803e747983e
MD5 d0ef4c03f7915a6d6b5f245f837521dc
SHA1 d3c512edb1f74858279e5e4f1a9ae3f609942099
SHA512 f3442251e435055aca7db629cbf63260a6417f59c30d5fe85ba0d8d48c6c744ba887ebd0d903218bdba28cea7a30e84e970cacd454df749ff310f350d5c7c9dc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 237e9e45f2d38d5c660deac4ebd13b1449b4b078f8b60a29869bcfd9796b816b
MD5 9a5241ffa0a884375db972e2de0ae6b9
SHA1 94bf65146bc33eeb863c5548cad6ed8f4b3bb370
SHA512 868902494bcc5f0fbaf15b3385ad2e924e7357b8e96959a4a66d19fe3c3a9dd159f91b4d80b413d2367cc53952b998866600c1ceccd02684cd3e04d37acf4b25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dd88d0664cad8be741e370dca8039146c11bde4d9001ff0489b7c4076ab3ede9
MD5 867d50dc7513c0c296bab5cb46143acf
SHA1 11a766eceb2b232ea7844c4f491dfeb3aabd997b
SHA512 5a4cf59115344ac1d68fbfffe5e57c0d09446dbdeb27768190965a5e7ed317a1f41dd24e42301db34be35bbec6a8cbe04d633ba86a47bdf23aa75b2f27b64cfd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b8d290efea8d40d1bf0a6ec8a3d7d16836761ef3d26f8bdf9b3cdf00222db150
MD5 377c4481ed212c83ec03e0e6f9293c8c
SHA1 2aed96ef9953bea4fe2f40774152dee7d2032c10
SHA512 d6cb81d564f31895597e5de789204f04a509d0f9da0406ee9f7efdbdb6950b77eb07a9a66849f9ea6671a1d143c981137d9d5b01e3d933bc4899fbcdaf480ca2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9445bb0564116daefcb54e27ca0ea33cfdc3a4cd193e74c735f862194f286094
MD5 f73a489999df534752648f61345752ed
SHA1 e934f5ab871248e55235e6b1783de87ae0cb469b
SHA512 0b239ec5debc8e83afa6c20dda7e4056dc807250c99a03e8cbb1d3532f81aef078de80bb0ba0cdcf2c3f48aaea5a8812073b828f85751d2ed7d6736835dff392
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa4ee82c97c1f0ee9d8c39bef7d658b6f5e905bf820f421aa1a25f0dc30aa952
MD5 4b0872aed120e3d4e8de520b762030a4
SHA1 510780787b1f6dfce44a976cdc1de5d7441b619a
SHA512 f84e81b44f65a3d5b55c8d78b4d74825045fc765ae6127d4993cc853e30933610134f2223c434c62b81196d92da4e15d8bf04139c6e29508cf5189cb622df4a8
MD5 SHA1 SHA512

Submit Download

svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCBCACABABBABCCAAAABAACBBBCAACAAAACBBAABCBBCACCBCA.exe
Size 735KB
SHA256 196cf696f3e15c5d7ea839f310a07fb5bf0839112e214507c1b5ca9d7b7d7c86
MD5 4d8426e6084fa8f261b22e7e4a89861b
SHA1 f1f9fc470c5a52418d2e497e8d15075017481b80
SHA512 48b5ea78fd1c7e5cca745831a054c34b252e46ed2cfad00d20699a4f4647937cd603f4f8bcb4398144e96a3187b307d8d670287f3a45ee7695fa6a7d5343a9d2
SSDEEP 12288:mgUFgEsnojAKgUFgEsnojA9gUFgEsnojA9gUFgEsnojAxLZagw9eBrCB1igsNBfl:m9+EM0v9+EM0q9+EM0q9+EM0g4LfslZX
TLSH
T189F49D06F98244F5D96B41704DCBD27EC671BE224611CEEBF798C71B6E23BA0AC29711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 487405b11f31ff50d903d1fbcaa9630419f167c2986368cdb23a9a750b316b39
MD5 8d6f78125dd44bd121539d6ddcad9aa9
SHA1 4bbf5b0d42bec78914abb908d3df52b950063919
SHA512 be0d5081ed7d7fdb18b31f501a3bdb4ea9ed89e8dadd74cbef540d8ad22966b8a848f8c3a41982ff139fffc8a7220f1d7dfe7a5aab115df3c1d25fb9a48fab15
TLSH
T19211E765B4EA9877F93368CB681D9F520D953B9FBD58BA24230D8319EB81C318D150F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3448-34-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/3448-24-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/4520-70-0x0000000000380000-0x00000000003A1000-memory.dmp

Download

memory/4676-8-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/4676-0-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download