a9aeb390cad05df5b3dd2da5383ed407c65325eb842e43f63e8fb6322262926f

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_fb505a84858ad2f32f22a297a329f743_elex_icedid_stop.exe
Size 4.1MB
Sample260901-2vr5dacl7x
SHA256 a9aeb390cad05df5b3dd2da5383ed407c65325eb842e43f63e8fb6322262926f
MD5 fb505a84858ad2f32f22a297a329f743
SHA1 2ade688757a106b3e06c863776f9580f76a0944d
SHA512 0e1d5ceeb13e7a10261932f2365e33d0675946086115e81e14c9b2251fde866a931319abe30fc6b1a6233e8b603c8a2d92efc2493d3575d001d3036bff9300e2
SSDEEP 49152:U+ES+EAh+ES+EI+ER+ES+ES+ES+ES+EAR+ES+ES+ES+ES+EAh+ES+EI+ER+ES+Eh:6AQAAWp7V
TLSH
T1F9161A05F94240B1D82614B049CBE3BE8720BA25C5134EEBE6498FDFFBF2B915D28675
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1396	svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe
1668	svchost_CCABBCCABCCABABCAABBABABBCBACCAAAABBBBCCAAACAAACCCCCAAB.exe
4492	svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBBBACAACBCBBAABABCACACBCAACACBBABBABBACCCCBCBACCBCAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe"	2026-08-31_fb505a84858ad2f32f22a297a329f743_elex_icedid_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABCBCCCACAACBACCAACCAACBCAAABCAACCBCBBABCABBCABCCCABCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABBCCABCCABABCAABBABABBCBACCAAAABBBBCCAAACAAACCCCCAAB.exe"	svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1040	sc.exe
1876	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2212	cmd.exe
8	cmd.exe
2932	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_fb505a84858ad2f32f22a297a329f743_elex_icedid_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABBCCABCCABABCAABBABABBCBACCAAAABBBBCCAAACAAACCCCCAAB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3936	2026-08-31_fb505a84858ad2f32f22a297a329f743_elex_icedid_stop.exe
3936	2026-08-31_fb505a84858ad2f32f22a297a329f743_elex_icedid_stop.exe
3936	2026-08-31_fb505a84858ad2f32f22a297a329f743_elex_icedid_stop.exe
3936	2026-08-31_fb505a84858ad2f32f22a297a329f743_elex_icedid_stop.exe
1396	svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe
1396	svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe
1396	svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe
1396	svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe
1668	svchost_CCABBCCABCCABABCAABBABABBCBACCAAAABBBBCCAAACAAACCCCCAAB.exe
1668	svchost_CCABBCCABCCABABCAABBABABBCBACCAAAABBBBCCAAACAAACCCCCAAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3936	2026-08-31_fb505a84858ad2f32f22a297a329f743_elex_icedid_stop.exe
Token: SeDebugPrivilege	1396	svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe
Token: SeDebugPrivilege	1668	svchost_CCABBCCABCCABABCAABBABABBCBACCAAAABBBBCCAAACAAACCCCCAAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3320	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 2212	3936	2026-08-31_fb505a84858ad2f32f22a297a329f743_elex_icedid_stop.exe	96
PID 2212 wrote to memory of 4496	2212	cmd.exe	98
PID 1396 wrote to memory of 2292	1396	svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe	99
PID 2292 wrote to memory of 3836	2292	notepad.exe	100
PID 3936 wrote to memory of 8	3936	2026-08-31_fb505a84858ad2f32f22a297a329f743_elex_icedid_stop.exe	104
PID 8 wrote to memory of 1040	8	cmd.exe	106
PID 3936 wrote to memory of 2932	3936	2026-08-31_fb505a84858ad2f32f22a297a329f743_elex_icedid_stop.exe	107
PID 2932 wrote to memory of 1876	2932	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-31_fb505a84858ad2f32f22a297a329f743_elex_icedid_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_fb505a84858ad2f32f22a297a329f743_elex_icedid_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCAABABBBCAAABAACCBCACCAABAAACCBCABCBCCBCCABAACBBCCCCAAABBACBACCAAAAAABACBACABCBBCBBBBBBBCBBCACABACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCAABABBBCAAABAACCBCACCAABAAACCBCABCBCCBCCABAACBBCCCCAAABBACBACCAAAAAABACBACABCBBCBBBBBBBCBBCACABACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBAAAABAAABAAACCCBABACCAAABCCBACCBCACABBABCBCCBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe" start= auto displayName= "UserDataSvc_CBBAAAABAAABAAACCCBABACCAAABCCBACCBCACABBABCBCCBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBAAAABAAABAAACCCBABACCAAABCCBACCBCACABBABCBCCBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe" start= auto displayName= "UserDataSvc_CBBAAAABAAABAAACCCBABACCAAABCCBACCBCACABBABCBCCBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBAAAABAAABAAACCCBABACCAAABCCBACCBCACABBABCBCCBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBAAAABAAABAAACCCBABACCAAABCCBACCBCACABBABCBCCBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3836

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3320

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBCCABCCABABCAABBABABBCBACCAAAABBBBCCAAACAAACCCCCAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBCCABCCABABCAABBABABBCBACCAAAABBBBCCAAACAAACCCCCAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe
1⤵
- Executes dropped EXE
PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 91864ab8800e0a46335c94b986b0f3d6615d8a83ecb4d01562cb32ce2f4195ce
MD5 3a9d0663d61a5d60157749b7d5eaff0f
SHA1 1890e16b360dd6ea1c7e66ea2427447e5a6ba1a4
SHA512 1a5caf1ff16084549a69826c3f47d06c11dafdb2092f19d144b6f234a494e0d64c6fd5d04e9c8e64c56ec63fe1ce1a6141c3f9e1e3b43bfb0b3d1a07a5fc7391
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4530ecae323cb169ba1fa8f6260b7cf9c529acfe53ec0221a5f008c6e0ddae04
MD5 5f8b58d64e917728f4b9f3b78684e42e
SHA1 2d0dd07295935e4335f7ec91a0ef4f5f3e4c0bf4
SHA512 ae1e091835713d3f7aac6e96637b1fece1522c9fd4091f81838b27256fb22927193fa28e9dfb12ebdf57aa7f100efa3c1281b64ed1af2f4d1ddd8c623caae520
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d9e1461367449c28e2d5341eac5ab4cec5714590677707d9ba562812a82210b6
MD5 6b8431bc5876a4aae07e6cda14962670
SHA1 b88df97f3b68189a52d609a607250d8b2eb451e6
SHA512 0e59a733b2ecf685604cb1016adc8adcf81dae886ae1120b0ad3cfacf62707ffa1d217f1f1fa7e3181d71dec06c0fed61a981c9c319b15bb915b12d2f4245915
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 832a2d06ad72f471f4381642a50a501be7fad6c7521e57f80a2c0768ab0094dd
MD5 ba210270260f6f60c4f07a8092d828b7
SHA1 9139b3e39e4c29a2ef7c298466c88726c6891508
SHA512 6d67d80d4cb114f96e7d7043b988166b5fe685f1a47a635a5454854d233375d2c8b0296580f5d894d6bd0a7ce83dc4ef7933e995e4757498c4be2147c323a391
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0a418007f78df831445ddb70aaa5d2a1139b0a4d8234572e1f3590315cc891ee
MD5 5a4c48044da529653f33849767394032
SHA1 b0d571f5da7d5555e663a5ce451209811ff8980e
SHA512 751f9c2fa1cf830ead11dc710edd044807c00f5654c86fb69040f15295a5072efb2e6d5e485eac82fdb2aceebe0ee0722774bb1d1f0332baf28cc6ea243c5585
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8a05913d747b8dbc8afee9231f022e765603994be23c7fad007fc0776e4c9f9a
MD5 a6ecde146c8477663b0340c50982a51a
SHA1 26a74d0d4cad04a9f343868252f3cfbf39e66d3a
SHA512 9ba26a84157b504f7053f98ee72a7295b2af179a4cc881fe090c8315cc8bdb9a19625105260795b0363757d85c5826eaa31ddcce4fc128ee4fe2439b7bfce26c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9c400b57c8094e70ef30d0fcad75f1608cd82d6730d24d14d5eec4601b47b545
MD5 ae5dcd13416d7ee3cfd5f9a85262ee73
SHA1 2a2fd8997eff0de45f48bbca4b7041825baf4997
SHA512 1ab0aa95e8e13c648e97be100c6dc8af0fcbdf399b3df8aabb0c3d777303da9c75ab713192e7ab6f38309b5bac73e8b82d549c5a44efb0c346605f1997093b4d
MD5 SHA1 SHA512

Submit Download

svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCBBCACCCAACBCACCACAABABBBCCAAACBCACAACBAAABABBBBCA.exe
Size 4.1MB
SHA256 a9aeb390cad05df5b3dd2da5383ed407c65325eb842e43f63e8fb6322262926f
MD5 fb505a84858ad2f32f22a297a329f743
SHA1 2ade688757a106b3e06c863776f9580f76a0944d
SHA512 0e1d5ceeb13e7a10261932f2365e33d0675946086115e81e14c9b2251fde866a931319abe30fc6b1a6233e8b603c8a2d92efc2493d3575d001d3036bff9300e2
SSDEEP 49152:U+ES+EAh+ES+EI+ER+ES+ES+ES+ES+EAR+ES+ES+ES+ES+EAh+ES+EI+ER+ES+Eh:6AQAAWp7V
TLSH
T1F9161A05F94240B1D82614B049CBE3BE8720BA25C5134EEBE6498FDFFBF2B915D28675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 1a1c22d3e816490c039f3f29829e6400130d91ad576f472c0872424335e0c1af
MD5 7ca0356a3216dc2a3cbdbf3d423f64ec
SHA1 da0fe3f9111b121811bf972c4ef91543a7e2c043
SHA512 f354a6d37e753182c700ef92a540daed1470a87c7488a77b9f3836f17676452b6a4f02377d9acae89419f6456c0d213bb9e636b2bd85e9045c7f66d36516ca90
TLSH
T15C01422160F5D897F031685691187FC70CE53BCF68DC9B08274D820C5A84C7ECD15CD1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1396-36-0x0000000000EA0000-0x0000000000EC1000-memory.dmp

Download

memory/1668-72-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/2292-59-0x0000000005600000-0x0000000005601000-memory.dmp

Download

memory/3936-0-0x0000000000BE0000-0x0000000000C01000-memory.dmp

Download

memory/3936-7-0x0000000000BE0000-0x0000000000C01000-memory.dmp

Download

memory/4492-92-0x0000000000EA0000-0x0000000000EC1000-memory.dmp

Download