322eed6b29c297f26f931be977c3547d0ed05145f61051e30c10e4cc035ca325

Analysis

max time kernel
150s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 06:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
Size 663KB
Sample260816-hq3krseq9t
SHA256 322eed6b29c297f26f931be977c3547d0ed05145f61051e30c10e4cc035ca325
MD5 9bff83442404290a6f96405c7b8e0920
SHA1 db97f22fcdbfe35ace3868aa822a4d8210721028
SHA512 07cd2bca2a14f436832a826b0bbcb302082c562ff9fd4e63c9825f2dbf3634a3b562edcad836380202d02098947e26fef414208672f546ce92c12c0a89385006
SSDEEP 12288:gbSiZbbSoCU5qJSr1eWPUntBB0sP0MugCAjHUzTsh:uSi1SoCU5qJSr1eWPSCsP0MugC6eT
TLSH
T112E46B55769C33F5D1FBD239CA4E7A51ED727C020B20A64F13A953AA1F233615B2E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 3 IoCs

pid	Process
2616	Logo1_.exe
3816	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
4996	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.Exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX1915.tmp	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCX297D.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCX2BC7.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe.Exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCX259C.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCX2C37.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe.Exe	Logo1_.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
File created	C:\Windows\Logo1_.exe	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3672	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe
2616	Logo1_.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 4412	3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe	85
PID 4412 wrote to memory of 1456	4412	net.exe	87
PID 3384 wrote to memory of 3672	3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe	88
PID 3384 wrote to memory of 2616	3384	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe	89
PID 2616 wrote to memory of 2928	2616	Logo1_.exe	91
PID 3672 wrote to memory of 3816	3672	cmd.exe	93
PID 2928 wrote to memory of 1412	2928	net.exe	94
PID 2616 wrote to memory of 3824	2616	Logo1_.exe	98
PID 3824 wrote to memory of 716	3824	net.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a875B.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Users\Admin\AppData\Local\Temp\2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe"
    3⤵
    - Executes dropped EXE
    PID:3816
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1412
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:716

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX2269.tmp

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX2269.tmp
Size 139KB
SHA256 e67eea2cee7507cfd4a187853682a669037c91f0e07408cfc58eb6a210735e73
MD5 dd4e3d09ab88d70b3061bb9542abc6c6
SHA1 88d6c448a4ebe85364b0de2e2aae4eeed5785727
SHA512 e1dac8db951b872bb00d32ddda51a9bd60e5780edf57f747068fe7a2cdd8810aa29814d2ebd93e541a28724632c98681fca0a95d74a0608199959e7da75547f8
SSDEEP 1536:v7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxQ:+CSjGoLpWM6bblmjxQ
TLSH
T160D36F6DB18FB3F2D3E198BC8D1CF2D5ED28FE20DE19285A75993B0E967A0C34508195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX250B.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX250B.tmp
Size 77KB
SHA256 028649a91c195ab5042e72d1fad73a32251dc71069177a1a2277d0615c6c00aa
MD5 9336abf7b3f5399899208876ea94f373
SHA1 39b8e199bc30f00e834a52308ebdb26a81eb73f7
SHA512 863421dd0becf5d822b9ce6889158b96b95f4fe9913fe79e912dca29b3200bebd2ece8866984fffbf06d70b2f40f84dbc1f3b0810bdfc8c052f734a0aa964587
SSDEEP 1536:a7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxC:TCSjGoLpWM6bblmjxC
TLSH
T19173D755B18CB3B6D0E299BC8E0FF2E5BC257E201E1D589FB5AA2F0DDA7A0C1550C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe.Exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.Exe
Size 5.7MB
SHA256 6605c1e735d8876f0423bf33aaadc63ea6715fcc41efecc76e0886a99c873b21
MD5 43440388872a6e9bfebffd6c5a5fb8bf
SHA1 b9ee5268341688d49f519a5f00afa6a0227df71d
SHA512 28a7a5bba46295b97fb6c3f7dc503faecdcb08fd8a691ea3815b693c9c607de9bf7ccdd28d7f68637aa0e586d67e7b3c55472c19e4aad7900f495ddc7060096e
SSDEEP 98304:+og5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7ws:+og1P9fIlOuz6IgF+I3m2MXP6HG8Qzb
TLSH
T119567B23A4E46130E5F332756D2CA7395D327FA29F3145CB86906C946FB82D3293936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe.Exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.Exe
Size 3.3MB
SHA256 a131de49271d26c522881a399bce0c5ca4cfcedd4ff29e5214be4872d174bcb4
MD5 543d33d594696bfec6f84aaafb2badd9
SHA1 c215a6c938522e1c9598348e4798d9b86b021263
SHA512 09af2717475ea427f7dd9ade5aae80af63cc06a263e0cb4220b159ee6b3244790dbfd794e42213e63bc244dc2895cece4160fcf3ecc41a3d7b90309862877b0b
SSDEEP 49152:KglZ4ThD+gGTZbqZK95S4pTiX2EUqMzADxulO7Udq+KqOuBk7bVnU7wF62JtY0:es6Gwxul1EE4wsH
TLSH
T132F53703E29D22D5D099C074CE4EA222EF627C8D47F562EF3290B6D52A77AD47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe.Exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe
Size 4.0MB
SHA256 d2d287fddb11f16c7888cbdea89e1d66ebcd9488a110c469005456ea118eb401
MD5 151817c956276dbb57538a1b0ce8c2bb
SHA1 d4100d4bae5a8fa49ebd88b1acdda7cacda86461
SHA512 40eb5f748f64c774fed0c4071a6a8cbaf6bb7626483da3f1f9462edf6c00c56fc7142d4809296b3d5184f2ca1b55a96160240a905aa35d35793b60de6b14c75a
SSDEEP 49152:6udQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:WijnUdYd+RaAj
TLSH
T171164903B29D62D4D089C074CE5AA232AF617C8947F161EF3690B7DA2A73AD47B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX2DEA.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCX2DEA.tmp
Size 83KB
SHA256 9bc88b64513c13d1e985663607abe3c035bbda135e14d2a89b8a32bfb7599fb7
MD5 a0dddffc7250dfaf486bbc0037089a91
SHA1 bb4fbf1bd0ea661ad8a890d0ee6a4ebb3f11555d
SHA512 aa1f4ec19ae2d17cf8554f7b5b4ffc048b3f836b7359a637c906b67307ef96a89bb24270ff26bf996dd6b713c62a43b826425612e4032caa85c126679b270854
SSDEEP 1536:u7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx5qkSZZZ3o:/CSjGoLpWM6bblmjx7Uo
TLSH
T106832855B68DB3B2D0F189B89D1CF3E5BD257E301E59185FB2AE3B0E9A770C2150C18A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX1626.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCX1626.tmp
Size 75KB
SHA256 7a158f6ee26d83f7ff1fb350c6952abe1ed1064d8fe0e609e2d72fa0578826b6
MD5 a9d0096ece063528e33aa653fab52bbb
SHA1 5c66f237fc935a909072fdb981bbcdd857506e1a
SHA512 aea57dbf26fc893d926da7d93b4bafa70762f60b061ff7fb1c0e58388a881171f135260e6caa5bd8388501d11429a1d9762a8b928bc7d81a51e4323c85479c00
SSDEEP 1536:O7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx5:fCSjGoLpWM6bblmjx5
TLSH
T129730965B28CB372C0F699B89E0DF1E5BC257E301E19186BB5AE3F1DDA7B1C1150C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX1977.tmp

Path C:\Program Files\Mozilla Firefox\RCX1977.tmp
Size 74KB
SHA256 dccf9536e114b6c88c1708df04c5992e1e4226d1c2e680f2de9f536bf45d07dc
MD5 2a77b6a1378afb07887bf0bbfaf868ac
SHA1 7c2140530059fcfc4ec6a42317c43f588bf36fbc
SHA512 71023fcb236fd8e634b009f40139f53dfd6ddc2513514fe93ad96e237fade0211c9f9250f33dc9fa402483070817063ad5477f2b8c4bee9759c82d186494b442
SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxq:DCSjGoLpWM6bblmjxq
TLSH
T1A5730955B28CB376D0F2A9B89E0CF1E5BC247E301E19185BB5EE2F0DDA7B1C2560C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX3231.tmp

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCX3231.tmp
Size 75KB
SHA256 498142b8705f35eed5ec813fde537a373d13e71c45ace1d317d7a29f08e08c1b
MD5 e20eccc4357214db3ab49e1a78fb1f1d
SHA1 20c2a71032111fb13802927b505a4fbea4e45fbe
SHA512 70d060e3609615e49e12781edcaa4ec855f6716a6d00c62b9546367dc89be759bd7ed9a58e5b2567f70850db6202a12503a797515c6f816d5a82bf5bcd99483c
SSDEEP 1536:O7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxZ:fCSjGoLpWM6bblmjxZ
TLSH
T154732A65B68DB772D0F199B88E0DF1E5BC287E301E19186FB69E2F0DDA7B0C2550C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX329F.tmp

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCX329F.tmp
Size 75KB
SHA256 2cd7679bee8d5e4a918f3254bfc8687dec01ca6ee30874aa9a87b955854cab69
MD5 5a0bd02bfd0f1e5d8e55c96a0c2efd8a
SHA1 8542a3e4caea6380569f275a008f3f7e2aca8e8d
SHA512 6604b83ead89cc67f624c11ddd5b29d8fb4c3619bf72b5cf5027b733846d9470aa3c89e36a86cb4751c7e38082505a640bcda33cc0488a7bdd2d4ba49a07f5bb
SSDEEP 1536:W7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxH5:HCSjGoLpWM6bblmjxH5
TLSH
T165732A65F28CB7B6C0F299B88E0DF1E5BC247E305E29186B759E2F0DDA7B1C2550C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a875B.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a875B.bat
Size 704B
SHA256 82fea8bc84600f644b7b6c6e8d20adcd75d7125f5b7b276473293fb66afc3623
MD5 da8fc59c401a96343aa3a46c41fb9bd7
SHA1 29bd759a30a77be040cf6f7ac5bcfd8952202d8b
SHA512 85213997550b6488e39caa5fd901df0dd6b1215cb4443313d20f23581c386fc63e148c364c9e0c87f2cc88baa9aeb07d92d97bc988b09a55f6d595ae69543bdb
TLSH
T14501441183F96D6A6D1571BF1AF3ADDEC42B3EAA7F242211E325C99523C101DADD1241
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe.exe
Size 574KB
SHA256 0cf9864ae3a8679ed503f954a453452c93fa44f99ca6f39bbc5860abde7fd35e
MD5 6503efe0a01c2d50c97be27f3cb10a43
SHA1 a0cb3708603a18f02352d01ec672020e5bad5073
SHA512 ebdbc553ba4348676fd3f2ca12e48af53a229b449a36e653dbfca90efb34d21033e41d1157dcca28c2b1e5f91368c0839298992247cf7d2e8feca5feab8ecea4
SSDEEP 12288:jSiZbbSoCU5qJSr1eWPUntBB0sP0MugCAjHUzTsh:jSi1SoCU5qJSr1eWPSCsP0MugC6eT
TLSH
T12FC48C5A779006F5D17BD239CA524B56EAB278024720A64F03EA43BB1F233215F7F726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 89KB
SHA256 63f8bdd85d83ca365d8a0fa102912d8fda7c965848b0570f91652e589bdb75e3
MD5 f8f53140fdd7f9ba29343c6792319be6
SHA1 bedf518c5a3b4c3c171000da801fba03287c9317
SHA512 99f442884003e944e8fb0f276f5e0c2afeac810da5a1789a33fa47939418bde3430d0aaf0d1a932ed362a5cea008db07b21c4b11cebc2643bcc02a95bcfb8123
SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx1q9D:DCSjGoLpWM6bblmjxE9D
TLSH
T14F934A59B28DB3B2D0F699B88E0DF1D5FD787D301E29185FB7A92B0D9A771C1250C282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2616-811-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/2616-18-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/2616-1257-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/3384-10-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4996-16-0x0000000000400000-0x0000000000425000-memory.dmp

Download