24cdf9920d26a602808851b8869606aa9fff915c8c77c082ede2b158a794c42d

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_4253194156679bf6f57279c9b86db9c6_amadey_elex_icedid.exe
Size 477KB
Sample260831-pfsfda1eqa
SHA256 24cdf9920d26a602808851b8869606aa9fff915c8c77c082ede2b158a794c42d
MD5 4253194156679bf6f57279c9b86db9c6
SHA1 df8cce4cd1e00244248cff37c5e6fc04562f36e3
SHA512 b89ef0a96273c5928d4561b53e9320829105ef5873b32a368cb384ee73295b5b2a78d601a232c07121101ed23c290719c62c34e2ad4a1f221e0c673d8e6f5d0a
SSDEEP 6144:m+dTTUFgEs3XojAdP+dm+wLuLahmZ2uhuYjzhQXJgw6:mgUFgEsnojA95kAmZXuYxagw6
TLSH
T1B8A43A06FA4180B5D46508704A96E6BE9735BD25C8134F9BB2C86ECFFFF2AD14E14A31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
120	svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe
1116	svchost_CCACBABAAACAACBABACCABCCAAAACBAACCBAACCBBACCABCACBCBCCB.exe
1568	svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBCACBABBCCCBACBCBCBBBACCBACACACABAABBACBCABBABBABABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe"	2026-08-30_4253194156679bf6f57279c9b86db9c6_amadey_elex_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBAACAAABCABACBAAABCCCBCBCAABBBBABCABACABABAAABBCCCBBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACBABAAACAACBABACCABCCAAAACBAACCBAACCBBACCABCACBCBCCB.exe"	svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
948	sc.exe
776	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4540	cmd.exe
1780	cmd.exe
4952	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_4253194156679bf6f57279c9b86db9c6_amadey_elex_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACBABAAACAACBABACCABCCAAAACBAACCBAACCBBACCABCACBCBCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4512	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2912	2026-08-30_4253194156679bf6f57279c9b86db9c6_amadey_elex_icedid.exe
2912	2026-08-30_4253194156679bf6f57279c9b86db9c6_amadey_elex_icedid.exe
2912	2026-08-30_4253194156679bf6f57279c9b86db9c6_amadey_elex_icedid.exe
2912	2026-08-30_4253194156679bf6f57279c9b86db9c6_amadey_elex_icedid.exe
120	svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe
120	svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe
120	svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe
120	svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe
1116	svchost_CCACBABAAACAACBABACCABCCAAAACBAACCBAACCBBACCABCACBCBCCB.exe
1116	svchost_CCACBABAAACAACBABACCABCCAAAACBAACCBAACCBBACCABCACBCBCCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	2026-08-30_4253194156679bf6f57279c9b86db9c6_amadey_elex_icedid.exe
Token: SeDebugPrivilege	120	svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe
Token: SeDebugPrivilege	1116	svchost_CCACBABAAACAACBABACCABCCAAAACBAACCBAACCBBACCABCACBCBCCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 4952	2912	2026-08-30_4253194156679bf6f57279c9b86db9c6_amadey_elex_icedid.exe	91
PID 4952 wrote to memory of 4512	4952	cmd.exe	93
PID 120 wrote to memory of 4604	120	svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe	94
PID 2912 wrote to memory of 4540	2912	2026-08-30_4253194156679bf6f57279c9b86db9c6_amadey_elex_icedid.exe	97
PID 4540 wrote to memory of 948	4540	cmd.exe	99
PID 2912 wrote to memory of 1780	2912	2026-08-30_4253194156679bf6f57279c9b86db9c6_amadey_elex_icedid.exe	100
PID 1780 wrote to memory of 776	1780	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-30_4253194156679bf6f57279c9b86db9c6_amadey_elex_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_4253194156679bf6f57279c9b86db9c6_amadey_elex_icedid.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACBCAABBBABCAABCCBBCABCABBABCCABAACBABCCCBCCBABCBAACABABCACCBBCBABBBABBBBABCCCBCCABBACBAAABBACACABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACBCAABBBABCAABCCBBCABCABBABCCABAACBABCCCBCCBABCBAACABABCACCBBCBABBBABBBBABCCCBCCABBACBAAABBACACABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBACBCCACCCCBBCAACBCABBAACAABBAABABAACCBACAABABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe" start= auto displayName= "UserDataSvc_ACBACBCCACCCCBBCAACBCABBAACAABBAABABAACCBACAABABCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBACBCCACCCCBBCAACBCABBAACAABBAABABAACCBACAABABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe" start= auto displayName= "UserDataSvc_ACBACBCCACCCCBBCAACBCABBAACAABBAABABAACCBACAABABCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBACBCCACCCCBBCAACBCABBAACAABBAABABAACCBACAABABCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBACBCCACCCCBBCAACBCABBAACAABBAABABAACCBACAABABCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:120
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4604

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBABAAACAACBABACCABCCAAAACBAACCBAACCBBACCABCACBCBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBABAAACAACBABACCABCCAAAACBAACCBAACCBBACCABCACBCBCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe
1⤵
- Executes dropped EXE
PID:1568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3afeb88900ebeee5eacb547bc3e11550d08f6e3a27dbc197e04ea2b35c416042
MD5 7aff02b223c9fde166298d9b014ec711
SHA1 ff63e90c9096692b91ebc46e4815dccb19df31a1
SHA512 9a179305fdadc9235b05bdac0c65ec1068072dba56510f72cbb2b2a6d062e1ae802a16b437a8a3a258beba216cbd0a51c8e4e6676351f5b7247181429e0a6530
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 33357cc0a056b336990d1aba6d9e110ffb117eb7d2d169713393c7ca84dec8fb
MD5 fecf014153a28e5e3f0826e1cb66f956
SHA1 b5646124643a43278e666694104309ba616fb198
SHA512 d9b1a77d665236ad83b356f18ed4d600aa7a0895225482664207f1b79143ba0c189d42f45988912d0d3709ad1ee56e15d11b3ac9f22f734b068e5c7643f42545
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1b4dbd94b4a566d722c878727ba365fec1c17b14baf0298ad0bc2ae954993098
MD5 1f5d78f5dc7da56da8523f23cc491dcb
SHA1 80a6983852e492b390635822db908b52ae2abf03
SHA512 67029f7af1a5116ad96ded0e16bdb3a8383c8633078e6b1f00fdcff2462c47d9a1dec8ed7e67285ecc58a1612e86de97e7f21bf80b9654f8ebbded78a9b3f872
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a62578d9f470b91f587e602ded7509299efd59217b8bbf5687923e588c3ada68
MD5 91ffb1744d787947a161c3e1a74dd581
SHA1 7acb629a83c7ddb8bf76887b3f9c2207be2ef601
SHA512 f862736c69976e44ec0cf37f161a63aef272f82d2b385a5c77e2e78f6920ace0fff7545837e168f88c55d7eb611dcfed304f7e6a15d43e16cb8ba14268f8b79d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 15f51f85b8e1bc15086f688d080288dd3abda5cc26c8f75390b84795b87ef885
MD5 8f7d75ac5c304a5f6e65b45b9711345e
SHA1 d21f405585be381f42dc6cfc4384313435829577
SHA512 78abf8614fff8689617f6c2a16e84d345f9a3df85691ba77a7e7da0504ccd9d8151396525fbb7c8b99068dd8d2e759ff5d630cf4fb94ab0fc842974a8fd560d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e0f93dbcb9e7d88658ee5d4cdcf63306ddac27dff84d516de887f79d82a34b7c
MD5 c22c4e62eabef70c83137e7cdbb65a91
SHA1 38a37ddd810fc28e93d1de5b6e0d24cbf36ebc62
SHA512 9972881ff6bc2ad8a0f831558c0c364b8619e9571cfdbaf49fd1a0a10f924f73a6a83f306a3b20da25bea8557a91b1cbd78c55706f088d0bb935bc937588188c
MD5 SHA1 SHA512

Submit Download

svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABBABCABCCCAABABCCCCBCCBCABABBACCCACBCBCCBABCCCCA.exe
Size 477KB
SHA256 24cdf9920d26a602808851b8869606aa9fff915c8c77c082ede2b158a794c42d
MD5 4253194156679bf6f57279c9b86db9c6
SHA1 df8cce4cd1e00244248cff37c5e6fc04562f36e3
SHA512 b89ef0a96273c5928d4561b53e9320829105ef5873b32a368cb384ee73295b5b2a78d601a232c07121101ed23c290719c62c34e2ad4a1f221e0c673d8e6f5d0a
SSDEEP 6144:m+dTTUFgEs3XojAdP+dm+wLuLahmZ2uhuYjzhQXJgw6:mgUFgEsnojA95kAmZXuYxagw6
TLSH
T1B8A43A06FA4180B5D46508704A96E6BE9735BD25C8134F9BB2C86ECFFFF2AD14E14A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 33f4bbf286bb1f122bb106960c0de9446bd6e93231f484a6b42154734e66981b
MD5 bf8914d2ea2d48ab434563cd56b98bb3
SHA1 405e30be62be6fbcad8ab269fe391360da6f3583
SHA512 fc53600692faf766232f088ebb667ce42b46fd7c119057ff553502e625e6078030b66582dd35ef62c692f77d349ab7e7e6a35405559035e82decc3493a4d9118
TLSH
T13A11E360F0F5DCA7FD222CCB95299A974CA037DF6C6C7A15231D825867A9C314F118E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/120-33-0x0000000000620000-0x0000000000641000-memory.dmp

Download

memory/120-23-0x0000000000620000-0x0000000000641000-memory.dmp

Download

memory/1116-79-0x00000000005E0000-0x0000000000601000-memory.dmp

Download

memory/1568-81-0x0000000000620000-0x0000000000641000-memory.dmp

Download

memory/2912-0-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/2912-7-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download