5a412eb20584187f631a2ef79f7ccee5d7be5897763e7339a1f6e36744a3d488

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_c2f86129e3081425f5560c0f57f98cde_elex_icedid_njrat.exe
Size 1.7MB
Sample260823-basmasdk8t
SHA256 5a412eb20584187f631a2ef79f7ccee5d7be5897763e7339a1f6e36744a3d488
MD5 c2f86129e3081425f5560c0f57f98cde
SHA1 2c508ba12e4176b5f494fc7dc2bc7e37e23d3b52
SHA512 59b96f2866ff1c9137d3e9018a1aa56be486ed52e15e35a947fd2f6b739c39d47d94d951cda99c35a87145bae411636c5765c689f169fb1176b8da51047ce98c
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOsWYA+w2+nSi1SoCU5qJSr3:w6F0eMpAAYEhptPhwdvS7PLjeTJ
TLSH
T109857C54F78384F5E92341F0854BEBBAE530AD1640318D1BE7C8EF527F73A62262A716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1860	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_c2f86129e3081425f5560c0f57f98cde_elex_icedid_njrat.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1860	2544	2026-08-22_c2f86129e3081425f5560c0f57f98cde_elex_icedid_njrat.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-22_c2f86129e3081425f5560c0f57f98cde_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_c2f86129e3081425f5560c0f57f98cde_elex_icedid_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:1860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 3.5MB
SHA256 66e4591b65ed5590cd90b3830ec53b995f203528a4119331c0c05b969d09e392
MD5 9ac381a90922c1602ee4218c9570ed2d
SHA1 f69655d567fd400a07921da555f2f8c8e5fc958c
SHA512 402d53f0f4a37aa12e86be3c863784ad9b7636383833340ee358d1122840f3ec4d394e474e08fb849baf7dc4eb04de241e4a9109da088caa3a1ea446574ed36a
SSDEEP 24576:b7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO9qf/Rs47WXnueVulvspdb3:46F0eMpAAYEhpkqn37WXnu6ulvKdfLME
TLSH
T164F539E2BE92F0B1E4D20CB1390BE6BED5237C348C238997B783F72D6573651562A116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5CA5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX5CA5.tmp
Size 1.2MB
SHA256 53190119134f382de7376cd961f4f7ad14900f981a29ea16da6de839b9dd8f87
MD5 d716c344b67ea813364f3667d0217dec
SHA1 fa6b58f937281b3de0ed808b4ec62fc54903b935
SHA512 3f88be424ae3462f572b4b04f59a7cb5d071b5e89e669662625f47e03df4cccefb148b5fe1df317e6652dda44d120ec4d4b10edebc9a73332b678844e7de9bb7
SSDEEP 24576:37VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOOWYA+w2m:c6F0eMpAAYEhp7PhwF
TLSH
T18D455C54E783C4F5FD2314F1444FE7FBA5309E1980318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 574KB
SHA256 0cf9864ae3a8679ed503f954a453452c93fa44f99ca6f39bbc5860abde7fd35e
MD5 6503efe0a01c2d50c97be27f3cb10a43
SHA1 a0cb3708603a18f02352d01ec672020e5bad5073
SHA512 ebdbc553ba4348676fd3f2ca12e48af53a229b449a36e653dbfca90efb34d21033e41d1157dcca28c2b1e5f91368c0839298992247cf7d2e8feca5feab8ecea4
SSDEEP 12288:jSiZbbSoCU5qJSr1eWPUntBB0sP0MugCAjHUzTsh:jSi1SoCU5qJSr1eWPSCsP0MugC6eT
TLSH
T12FC48C5A779006F5D17BD239CA524B56EAB278024720A64F03EA43BB1F233215F7F726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 768b726083f780a87ac9f7c9f12194f3adba64053b9c7b8b4e8b308f4d760ae7
MD5 995a31db6c9eba522ecb6f628707282c
SHA1 e949f9f2853641066f71c69de96d0ea1a2d5e498
SHA512 65c1c4ace066efba48b53c2c9bd55e7f1ffc3f46ceab5924ce109b825bf944630e17252966773642ac6863c67459d2c9e1228531af3bff2ed77c61e8e73c94cf
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOsWYA+w2+:w6F0eMpAAYEhptPhwd
TLSH
T1CC455B94E783C4F5FD2314F1444FE7FBA5309E1940318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2544-267-0x0000000000400000-0x0000000000533000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads