5a412eb20584187f631a2ef79f7ccee5d7be5897763e7339a1f6e36744a3d488

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_c2f86129e3081425f5560c0f57f98cde_elex_icedid_njrat.exe
Size 1.7MB
Sample260823-basmasdk8t
SHA256 5a412eb20584187f631a2ef79f7ccee5d7be5897763e7339a1f6e36744a3d488
MD5 c2f86129e3081425f5560c0f57f98cde
SHA1 2c508ba12e4176b5f494fc7dc2bc7e37e23d3b52
SHA512 59b96f2866ff1c9137d3e9018a1aa56be486ed52e15e35a947fd2f6b739c39d47d94d951cda99c35a87145bae411636c5765c689f169fb1176b8da51047ce98c
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOsWYA+w2+nSi1SoCU5qJSr3:w6F0eMpAAYEhptPhwdvS7PLjeTJ
TLSH
T109857C54F78384F5E92341F0854BEBBAE530AD1640318D1BE7C8EF527F73A62262A716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
120	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_c2f86129e3081425f5560c0f57f98cde_elex_icedid_njrat.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 120	2624	2026-08-22_c2f86129e3081425f5560c0f57f98cde_elex_icedid_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-22_c2f86129e3081425f5560c0f57f98cde_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_c2f86129e3081425f5560c0f57f98cde_elex_icedid_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXBD1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXBD1.tmp
Size 1.2MB
SHA256 8dc7dabe149802b30aae878451cd621c761ddc7ed552c8bcb7822d0ade3f764b
MD5 e655cc03254b241e86b565efe6467409
SHA1 eafab15c6bb53cd527cfe705863c2469173edfa9
SHA512 1174c4932b5a2dafec8910d07fd133864dacce632955257f601203a3729a07050ea7265b44a83a383d7aa1ae14abbb6d056a238080b08df8736bb8afd3b1fdc2
SSDEEP 24576:37VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOOWYA+wTm:c6F0eMpAAYEhp7Phw6
TLSH
T1E7455C54E783C4F5FD2314F1444FE7FBA5309E1980318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 574KB
SHA256 0cf9864ae3a8679ed503f954a453452c93fa44f99ca6f39bbc5860abde7fd35e
MD5 6503efe0a01c2d50c97be27f3cb10a43
SHA1 a0cb3708603a18f02352d01ec672020e5bad5073
SHA512 ebdbc553ba4348676fd3f2ca12e48af53a229b449a36e653dbfca90efb34d21033e41d1157dcca28c2b1e5f91368c0839298992247cf7d2e8feca5feab8ecea4
SSDEEP 12288:jSiZbbSoCU5qJSr1eWPUntBB0sP0MugCAjHUzTsh:jSi1SoCU5qJSr1eWPSCsP0MugC6eT
TLSH
T12FC48C5A779006F5D17BD239CA524B56EAB278024720A64F03EA43BB1F233215F7F726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 768b726083f780a87ac9f7c9f12194f3adba64053b9c7b8b4e8b308f4d760ae7
MD5 995a31db6c9eba522ecb6f628707282c
SHA1 e949f9f2853641066f71c69de96d0ea1a2d5e498
SHA512 65c1c4ace066efba48b53c2c9bd55e7f1ffc3f46ceab5924ce109b825bf944630e17252966773642ac6863c67459d2c9e1228531af3bff2ed77c61e8e73c94cf
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOsWYA+w2+:w6F0eMpAAYEhptPhwd
TLSH
T1CC455B94E783C4F5FD2314F1444FE7FBA5309E1940318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 9c85e8719a44de475b3600db041e2cd0c5c66a6854869e182ba329e063c8cb4d
MD5 8dbd41a418dfcd9a564ad8bbebb8c2a2
SHA1 f45d4d487a13e11b946911636dbf4425596ae681
SHA512 8c9b24af7037da13030ba3fe6f662af13989ce86a78c44e8443d127a63c07ac0053224ccf6414c02113779a4fb2dd2baeb0a84542eaa1ab7d9f059f42f425465
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOyWYA+wNy:w6F0eMpAAYEhpjPhws
TLSH
T140455B94E783C4F5FD2314F1444FE7FBA5309E1940318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 50cdb38a79774f604e4be4792e9022c5a83e3afe6b83059ac9c463313a7c48eb
MD5 9d2e4aa04ba7dbc94d076da15bdf084c
SHA1 e0044fb5b1b1cf3d6cbe7c464f5c06382d4b841a
SHA512 7a368938800857751fdc25a02dfe36d69ce1615707be719a8583d9c35f0f940f78608545411b10f03bfd5cbaa5f9d3900bde67ad181299f2262c921eaadb53be
SSDEEP 24576:lt7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOIWYA+wq9:Y6F0eMpAAYEhp9Phwq
TLSH
T1B2455C94E783C4F5FD2314F1444FE7FBA5309E1940318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2624-154-0x0000000000400000-0x0000000000533000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads