ccd17e602567078c67f2dee328357816bc54ace258cb163b8ae5dbaa4d421622

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_87adf9ca1f220f9341b0132df266d94d_elex_icedid_vidar.exe
Size 722KB
Sample260825-kd8mcsvydt
SHA256 ccd17e602567078c67f2dee328357816bc54ace258cb163b8ae5dbaa4d421622
MD5 87adf9ca1f220f9341b0132df266d94d
SHA1 b407d015f9589177f56428dd9226c553ff342550
SHA512 ad364fc2bca67e0356e476f23a6f852ae10a0d98603b2a4d6401a2d38a54fda5416a86b012268d98162dc30e3d24b4678f9d765158610f5ff04e1d1c82c854f8
SSDEEP 12288:mgUFgEsnojAkLRYymh7vagqgUFgEsrAmZXuY9:m9+EM0dRIh7Ct9+EKAhY9
TLSH
T125F4F809B69600B4D47249704966926D8731B821C7238EDFA2D4DDFEFFE2AD4AD34B31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3104	svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe
4184	svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe
748	svchost_BACBABAACBBBAAAACCBBACAACABCBBBCCCBAACAAABCCCBAACBACBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACABBCBAAACABBBACCCBBABAAABACAACABABBCCBBBCBBCBCCBCBAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe"	2026-08-24_87adf9ca1f220f9341b0132df266d94d_elex_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABACABBCAACACCBAACAAAABAABABAAABABBAACBAABBBBCACCACBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBABAACBBBAAAACCBBACAACABCBBBCCCBAACAAABCCCBAACBACBAC.exe"	svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4268	sc.exe
4996	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5952	cmd.exe
1068	cmd.exe
4936	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBABAACBBBAAAACCBBACAACABCBBBCCCBAACAAABCCCBAACBACBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_87adf9ca1f220f9341b0132df266d94d_elex_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4448	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1216	2026-08-24_87adf9ca1f220f9341b0132df266d94d_elex_icedid_vidar.exe
1216	2026-08-24_87adf9ca1f220f9341b0132df266d94d_elex_icedid_vidar.exe
1216	2026-08-24_87adf9ca1f220f9341b0132df266d94d_elex_icedid_vidar.exe
1216	2026-08-24_87adf9ca1f220f9341b0132df266d94d_elex_icedid_vidar.exe
3104	svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe
3104	svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe
3104	svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe
3104	svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1216	2026-08-24_87adf9ca1f220f9341b0132df266d94d_elex_icedid_vidar.exe
Token: SeDebugPrivilege	3104	svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 5952	1216	2026-08-24_87adf9ca1f220f9341b0132df266d94d_elex_icedid_vidar.exe	95
PID 5952 wrote to memory of 4448	5952	cmd.exe	97
PID 3104 wrote to memory of 4560	3104	svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe	100
PID 1216 wrote to memory of 1068	1216	2026-08-24_87adf9ca1f220f9341b0132df266d94d_elex_icedid_vidar.exe	102
PID 1068 wrote to memory of 4268	1068	cmd.exe	104
PID 1216 wrote to memory of 4936	1216	2026-08-24_87adf9ca1f220f9341b0132df266d94d_elex_icedid_vidar.exe	105
PID 4936 wrote to memory of 4996	4936	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-24_87adf9ca1f220f9341b0132df266d94d_elex_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_87adf9ca1f220f9341b0132df266d94d_elex_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBCCABACCABBBACACCAABBAAAAACACAAACCCAAABCCBCCCABABACAABBBBBABCBABAAACCCCCBCBCCCBCCABCCCAAACBACCCACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBCCABACCABBBACACCAABBAAAAACACAAACCCAAABCCBCCCABABACAABBBBBABCBABAAACCCCCBCBCCCBCCABCCCAAACBACCCACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABCBCCCBACABAABBACCCCCCBACCAABCACBAACBCBAACCABACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe" start= auto displayName= "UserDataSvc_AAABCBCCCBACABAABBACCCCCCBACCAABCACBAACBCBAACCABACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABCBCCCBACABAABBACCCCCCBACCAABCACBAACBCBAACCABACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe" start= auto displayName= "UserDataSvc_AAABCBCCCBACABAABBACCCCCCBACCAABCACBAACBCBAACCABACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABCBCCCBACABAABBACCCCCCBACCAABCACBAACBCBAACCABACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABCBCCCBACABAABBACCCCCCBACCAABCACBAACBCBAACCABACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe
1⤵
- Executes dropped EXE
PID:4184

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAACBBBAAAACCBBACAACABCBBBCCCBAACAAABCCCBAACBACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAACBBBAAAACCBBACAACABCBBBCCCBAACAAABCCCBAACBACBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CompareMount.exe

Path C:\Users\Admin\Desktop\CompareMount.exe
Size 2.4MB
SHA256 a823a9df66e6b3bf0b06096e139c00c2af1f684240ce9e71a6a1b38ff477977b
MD5 f17c9113bbcd24c4ac63d28d89eee114
SHA1 4c9f02cfc7d798dce88af23bc3295e287df7bd04
SHA512 179041012a8715196ca27ca2250e73d9cabcd7a2b7e1159711606882c81fa63d03f03f2aa713d49495a1b06a38ee7dc72678463178c76c1e533c04cadd8b82da
SSDEEP 49152:U+E+hOn+EKQ+E+hOn+EKQ+E+hOn+EKKWM:PFrFrFO
TLSH
T16BB52A09B69600B4D47249704966926D8731B821C7238EDFA2D4DDFEFFE2AD4AD34B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareMount.exe

Path C:\Users\Admin\Desktop\CompareMount.exe
Size 4.5MB
SHA256 1a25f456766b3cf1a5eab8bd7509bdc33cbb842d7e6b2603f4fda7af2fdcd7aa
MD5 c47361e4940130a6d1bd45d71b97521c
SHA1 60a49da06c2101719fa9301a3e5a08a7f5649926
SHA512 279593a2fcae18562605ea835dadf49a57ec9cdaf100efc2504bf54cf6f536bc7970cfb3ee34e6081d411c4e7b26944f60f45223b102182ccc088f2b85632ef9
SSDEEP 49152:U+E+hOn+EKQ+E+hOn+EKQ+E+hOn+EKQ+E+hOn+EKQ+E+hOn+EKQ+E+hOn+EKKWS:PFrFrFrFrFrFg
TLSH
T15B260909B69600B4D47249704966926D8731B821C7238EDFA2D4DDFEFFE2AD4AD34B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareMount.exe

Path C:\Users\Admin\Desktop\CompareMount.exe
Size 5.2MB
SHA256 523d8c015003bdb54453ac842b31650fd7aa4b7c684a4fd3730c7ee6c8a6729c
MD5 a5c420d25ef9a20646fe158696afa3ed
SHA1 1ffcb2b242650c24a0516704fb1671289bfa28a2
SHA512 09e7f452d69090176f279e4ace47a3df64ecb8d6d55975801b677ec04ce33e34cfec1b0cf963129a0d7836f342fbaf10708f2d55a246ddb7fe156e2df257de03
SSDEEP 49152:U+E+hOn+EKQ+E+hOn+EKQ+E+hOn+EKQ+E+hOn+EKQ+E+hOn+EKQ+E+hOn+EKQ+E5:PFrFrFrFrFrFrFS
TLSH
T1BE460909B69600B4D47249704966926D8731B821C7238EDFA2D4DDFEFFE2AD4AD34B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareMount.exe

Path C:\Users\Admin\Desktop\CompareMount.exe
Size 5.9MB
SHA256 e5a23c46937ed1da77ab9354b84547efa7ef4e1e12fe031f019406dc8a1470db
MD5 e1f68f4a75f39e5337399e5094b061a7
SHA1 c908dbb81d63b1322984c92581b4208029aa56ac
SHA512 1a4d5cfce55b140692671b773c04c664309ac0af8576deedd5fb0d6aab42a53c46f245f595cce76500a05f752b2d5e826d9b8bc855f34ce8f60a22f4e6c26b0e
SSDEEP 49152:U+E+hOn+EKQ+E+hOn+EKQ+E+hOn+EKQ+E+hOn+EKQ+E+hOn+EKQ+E+hOn+EKQ+Eb:PFrFrFrFrFrFrFrF4
TLSH
T124560909B69600B4D47249704966926D8731B821C7238EDFA2D4DDFEFFE2AD4AD34B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareMount.exe

Path C:\Users\Admin\Desktop\CompareMount.exe
Size 6.6MB
SHA256 34e9842316e5d284447ae08d28d77f6df7c45575d7a582591fa8561b7f280145
MD5 151ab819bb07c195a4a551ef9743a4fb
SHA1 9ad54c6890432a1d4e672ec723ab48edfcba47c1
SHA512 fd2b752327018bf4b08c17ca1de13d1cca50603a37bc3beeac5198d630cc0969f25dd05fae4a1f18f210565fb852c1e3a4a93beacaa2d8563137277026787c31
SSDEEP 49152:U+E+hOn+EKQ+E+hOn+EKQ+E+hOn+EKQ+E+hOn+EKQ+E+hOn+EKQ+E+hOn+EKQ+EL:PFrFrFrFrFrFrFrFrF8
TLSH
T118660909B69600B4D47249704966926D8731B821C7238EDFA2D4DDFEFFE2AD4AD34B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c81ffe5112d88c8591736d97abafd64cc6efad43ff740e96a73ed9272ac094ba
MD5 717bbc79b49e701c9f20e666d30e9069
SHA1 4940aa40925acb9bf1ce80d1674cd46dca80e347
SHA512 bc052d1c50d907f53ebcefbef4ef3da67d379d4226f821d13c6b57034061794d0838ca8a09ebd75b71f0f972ee9ae565fdd49e1f4bf472f9a1a5b8440bcb9c46
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3d66d230b476d81235ff84a38eeb01fb488fcf03668ee5bd811300c164658be8
MD5 59551a9326adc945f95896b0eaf097cc
SHA1 e6449428562913a6040d5eeb1e7614db4860d36b
SHA512 0386ec550bb94a87dad97940757f6fe741b9275cf6636fcf0d225560f331e5c2f462b5369ad1d428f21398ba079ea814338ddd7500b3ff1aa9d344d59485366d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 26b99edbf910ece7719d3eb545dca91c63a029f07138bd075d9bfa1cf6bb18ec
MD5 0e3559067473b7dfb3bb3328ed7c0e21
SHA1 c4efd01d2b0dd5de42673bb3f5d2b6b656b09df6
SHA512 1b4c85358218fb7e5b5ba75af6b5890695ff5cfd336e24ba792dec00f906dffac95bde13a42d158a9e4d5a0c5e81469591102731f66d27c438cc31ff24b7702e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 345fe9ee323c0b62e48a4f7084ebb85ff7b5a0cbcaf6fc66f6049169c8cba6e6
MD5 5fbe7c54cabc2cb5ab41dc2d0da88667
SHA1 942077a6e083467d81140502338253eb589b532c
SHA512 e5a42fcefb9f6a7f36c16821f3db264faf6bb8c4a51bfc2f2c66df0fe80de5ffc6bd49c378249bc492e50463062a923b69d658e8085a76418604ad47dcaf6ebb
MD5 SHA1 SHA512

Submit Download

svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBCCBBBABACCBACBBCCCABCBACCCCCBCAAABBCCCBABCBAABBA.exe
Size 722KB
SHA256 ccd17e602567078c67f2dee328357816bc54ace258cb163b8ae5dbaa4d421622
MD5 87adf9ca1f220f9341b0132df266d94d
SHA1 b407d015f9589177f56428dd9226c553ff342550
SHA512 ad364fc2bca67e0356e476f23a6f852ae10a0d98603b2a4d6401a2d38a54fda5416a86b012268d98162dc30e3d24b4678f9d765158610f5ff04e1d1c82c854f8
SSDEEP 12288:mgUFgEsnojAkLRYymh7vagqgUFgEsrAmZXuY9:m9+EM0dRIh7Ct9+EKAhY9
TLSH
T125F4F809B69600B4D47249704966926D8731B821C7238EDFA2D4DDFEFFE2AD4AD34B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-35-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/1216-61-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/1216-0-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/1216-23-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/1216-12-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/3104-49-0x0000000000380000-0x00000000003A1000-memory.dmp

Download

memory/3104-34-0x0000000000380000-0x00000000003A1000-memory.dmp

Download

memory/3104-73-0x0000000000380000-0x00000000003A1000-memory.dmp

Download