322eed6b29c297f26f931be977c3547d0ed05145f61051e30c10e4cc035ca325

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 06:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
Size 663KB
Sample260816-hq3krseq9t
SHA256 322eed6b29c297f26f931be977c3547d0ed05145f61051e30c10e4cc035ca325
MD5 9bff83442404290a6f96405c7b8e0920
SHA1 db97f22fcdbfe35ace3868aa822a4d8210721028
SHA512 07cd2bca2a14f436832a826b0bbcb302082c562ff9fd4e63c9825f2dbf3634a3b562edcad836380202d02098947e26fef414208672f546ce92c12c0a89385006
SSDEEP 12288:gbSiZbbSoCU5qJSr1eWPUntBB0sP0MugCAjHUzTsh:uSi1SoCU5qJSr1eWPSCsP0MugC6eT
TLSH
T112E46B55769C33F5D1FBD239CA4E7A51ED727C020B20A64F13A953AA1F233615B2E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (260) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 3 IoCs

pid	Process
1764	Logo1_.exe
1316	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
4512	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX28DD.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCX353E.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\RCX392E.tmp	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe.Exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX28ED.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\RCX2F75.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\RCX38CE.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX26CD.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\RCX24C2.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX262F.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.Exe	Logo1_.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
File created	C:\Windows\Logo1_.exe	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5012	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 6068	6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe	89
PID 6068 wrote to memory of 2800	6068	net.exe	91
PID 6020 wrote to memory of 5012	6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe	92
PID 6020 wrote to memory of 1764	6020	2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe	94
PID 1764 wrote to memory of 1404	1764	Logo1_.exe	95
PID 1404 wrote to memory of 4920	1404	net.exe	97
PID 5012 wrote to memory of 1316	5012	cmd.exe	98
PID 1764 wrote to memory of 1492	1764	Logo1_.exe	101
PID 1492 wrote to memory of 2332	1492	net.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9735.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Users\Admin\AppData\Local\Temp\2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe"
    3⤵
    - Executes dropped EXE
    PID:1316
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4920
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2332

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX32C2.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX32C2.tmp
Size 77KB
SHA256 028649a91c195ab5042e72d1fad73a32251dc71069177a1a2277d0615c6c00aa
MD5 9336abf7b3f5399899208876ea94f373
SHA1 39b8e199bc30f00e834a52308ebdb26a81eb73f7
SHA512 863421dd0becf5d822b9ce6889158b96b95f4fe9913fe79e912dca29b3200bebd2ece8866984fffbf06d70b2f40f84dbc1f3b0810bdfc8c052f734a0aa964587
SSDEEP 1536:a7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxC:TCSjGoLpWM6bblmjxC
TLSH
T19173D755B18CB3B6D0E299BC8E0FF2E5BC257E201E1D589FB5AA2F0DDA7A0C1550C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX36BB.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX36BB.tmp
Size 86KB
SHA256 7a2de934fdf412b48b30ac5b341def2043753d4b4a8d8d825182f2273bd7b9d2
MD5 6c98fa966f2db6fbddae5e904c2cf56d
SHA1 8beaf0125dc42f7df53cc6c359fff017335408b4
SHA512 007ba556ef2fa78aa4b9868a0da8f3c2986658d0856f985302660bf412be73e6642b85b7790af23179f1fdf5c001aebb31dede451e566cd981a777570382d82f
SSDEEP 1536:67qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxS1XkSPsULMHi4:zCSjGoLpWM6bblmjxSdtPlLq5
TLSH
T1D6833A59B68DF372D0F299BC8E0CF2E5BC247E301E19185FB69E2F0D9A7A5C2150C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX371C.tmp

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCX371C.tmp
Size 74KB
SHA256 4ed4ee6b2c6e94f158b2f68460e2048b84f6e81fc30e9381cade7dd6bcbec896
MD5 32a80cd8e3bd605bc679c6a6668e9b98
SHA1 1140db715a74093ab144f15c17cf8bf6ea28fb40
SHA512 75cdc36d67fbdb3619cb8beb52ddac083f96706a90ce5a69c754f5f3d4bf69876b2b00641773f2e7059176ad1e2221b34f7831eea2e4b8aeeaf745e2ee151193
SSDEEP 1536:m7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxw:3CSjGoLpWM6bblmjxw
TLSH
T1CF732B65B68DB372D0F299B89E0DF1E5BC283E301E19185FB6AE2F0DDA7B1C1150C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX34D0.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX34D0.tmp
Size 101KB
SHA256 11d32c6d34e38cf2564f3c635ad36f1d019490cf81ba44b512ca4c5f7be3a045
MD5 386fd048193a5bfb66ff3aa8138fdbc8
SHA1 2091bdf9fae4024ab8559569407cd7a86a30984e
SHA512 40845d3301e52d487e25d4ecad5179af7a021cb28ad436e8a0f498173ffd3f050ac3ace6ad5d2a54fd904f1a033a9a80191d300c27ba2ace862d0104764ac067
SSDEEP 1536:C7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxh4GZjzQwK5WW7VCn6Kyl:7CSjGoLpWM6bblmjxPe5BV04
TLSH
T165A38C65B68CF3B7C0E298B88E0CF1E5BD657E301E29185FB59A2F0DCA7B5C1550C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX39DC.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCX39DC.tmp
Size 83KB
SHA256 9bc88b64513c13d1e985663607abe3c035bbda135e14d2a89b8a32bfb7599fb7
MD5 a0dddffc7250dfaf486bbc0037089a91
SHA1 bb4fbf1bd0ea661ad8a890d0ee6a4ebb3f11555d
SHA512 aa1f4ec19ae2d17cf8554f7b5b4ffc048b3f836b7359a637c906b67307ef96a89bb24270ff26bf996dd6b713c62a43b826425612e4032caa85c126679b270854
SSDEEP 1536:u7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx5qkSZZZ3o:/CSjGoLpWM6bblmjx7Uo
TLSH
T106832855B68DB3B2D0F189B89D1CF3E5BD257E301E59185FB2AE3B0E9A770C2150C18A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX263F.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCX263F.tmp
Size 75KB
SHA256 7a158f6ee26d83f7ff1fb350c6952abe1ed1064d8fe0e609e2d72fa0578826b6
MD5 a9d0096ece063528e33aa653fab52bbb
SHA1 5c66f237fc935a909072fdb981bbcdd857506e1a
SHA512 aea57dbf26fc893d926da7d93b4bafa70762f60b061ff7fb1c0e58388a881171f135260e6caa5bd8388501d11429a1d9762a8b928bc7d81a51e4323c85479c00
SSDEEP 1536:O7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx5:fCSjGoLpWM6bblmjx5
TLSH
T129730965B28CB372C0F699B89E0DF1E5BC257E301E19186BB5AE3F1DDA7B1C1150C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX294E.tmp

Path C:\Program Files\Microsoft Office 15\ClientX64\RCX294E.tmp
Size 139KB
SHA256 1ed639030c2a897f86d5826293675b9c309cecd512c9013a0e547717fd7f9eb1
MD5 21bf985efdfb02d87a24cfee1358a1d4
SHA1 626c0e38eaf9acb37c0fdbc251a518da75a09077
SHA512 3aa3d922a56f8c91761e4517cbdd88aec72081ca0184fc4ead925a69ebc65563f4d710ee37014c257abb888449a11baa8b5711025a87b1cec757567ad768180a
SSDEEP 1536:v7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxPnv:+CSjGoLpWM6bblmjxPv
TLSH
T151D39275B25CB776E0E599B84E1CF1E1AC1D3E202E2BCC6A755A3F0DBB761C11A0818D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX2990.tmp

Path C:\Program Files\Mozilla Firefox\RCX2990.tmp
Size 74KB
SHA256 dccf9536e114b6c88c1708df04c5992e1e4226d1c2e680f2de9f536bf45d07dc
MD5 2a77b6a1378afb07887bf0bbfaf868ac
SHA1 7c2140530059fcfc4ec6a42317c43f588bf36fbc
SHA512 71023fcb236fd8e634b009f40139f53dfd6ddc2513514fe93ad96e237fade0211c9f9250f33dc9fa402483070817063ad5477f2b8c4bee9759c82d186494b442
SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxq:DCSjGoLpWM6bblmjxq
TLSH
T1A5730955B28CB376D0F2A9B89E0CF1E5BC247E301E19185BB5EE2F0DDA7B1C2560C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX3EEE.tmp

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCX3EEE.tmp
Size 75KB
SHA256 2cd7679bee8d5e4a918f3254bfc8687dec01ca6ee30874aa9a87b955854cab69
MD5 5a0bd02bfd0f1e5d8e55c96a0c2efd8a
SHA1 8542a3e4caea6380569f275a008f3f7e2aca8e8d
SHA512 6604b83ead89cc67f624c11ddd5b29d8fb4c3619bf72b5cf5027b733846d9470aa3c89e36a86cb4751c7e38082505a640bcda33cc0488a7bdd2d4ba49a07f5bb
SSDEEP 1536:W7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxH5:HCSjGoLpWM6bblmjxH5
TLSH
T165732A65F28CB7B6C0F299B88E0DF1E5BC247E305E29186B759E2F0DDA7B1C2550C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a9735.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a9735.bat
Size 704B
SHA256 54a0aa06ccc4e06f315eca3dc7007940947dabe7f9e965e0c2f1ac6f5b3a1642
MD5 70699dce71067d7452beb8fbf049fe1f
SHA1 5a70a711ddf080c2db28de79c64a584c19ea55c1
SHA512 32f6b811247159b306c5c34c6aa4ea704388bd84a43c17a70ec6124afae78083f48bf56863b5b311b5aacd655ceb5261207d08f45f1b0d59d5fc06aa18c2720f
TLSH
T14001671183F96D6A6D0571BF1AF3EDDEC42B3EAB7F202211E325C99523C101DADD1641
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-16_9bff83442404290a6f96405c7b8e0920_elex_icedid_njrat.exe.exe
Size 574KB
SHA256 0cf9864ae3a8679ed503f954a453452c93fa44f99ca6f39bbc5860abde7fd35e
MD5 6503efe0a01c2d50c97be27f3cb10a43
SHA1 a0cb3708603a18f02352d01ec672020e5bad5073
SHA512 ebdbc553ba4348676fd3f2ca12e48af53a229b449a36e653dbfca90efb34d21033e41d1157dcca28c2b1e5f91368c0839298992247cf7d2e8feca5feab8ecea4
SSDEEP 12288:jSiZbbSoCU5qJSr1eWPUntBB0sP0MugCAjHUzTsh:jSi1SoCU5qJSr1eWPSCsP0MugC6eT
TLSH
T12FC48C5A779006F5D17BD239CA524B56EAB278024720A64F03EA43BB1F233215F7F726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 89KB
SHA256 63f8bdd85d83ca365d8a0fa102912d8fda7c965848b0570f91652e589bdb75e3
MD5 f8f53140fdd7f9ba29343c6792319be6
SHA1 bedf518c5a3b4c3c171000da801fba03287c9317
SHA512 99f442884003e944e8fb0f276f5e0c2afeac810da5a1789a33fa47939418bde3430d0aaf0d1a932ed362a5cea008db07b21c4b11cebc2643bcc02a95bcfb8123
SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx1q9D:DCSjGoLpWM6bblmjxE9D
TLSH
T14F934A59B28DB3B2D0F699B88E0DF1D5FD787D301E29185FB7A92B0D9A771C1250C282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1764-20-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/1764-947-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/1764-1268-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4512-18-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/6020-10-0x0000000000400000-0x0000000000425000-memory.dmp

Download