cde423d941dde9abafd21998a195c384c573b32d5d67e0fcbfc27d350585f963

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_7b556b249d9c351cfd12eaef8e455a63_elex_icedid.exe
Size 205KB
Sample260907-tmlnmacn4z
SHA256 cde423d941dde9abafd21998a195c384c573b32d5d67e0fcbfc27d350585f963
MD5 7b556b249d9c351cfd12eaef8e455a63
SHA1 8e9ab859ee51cfa8e2bb81af9612fb5611f654a3
SHA512 9ce1221b79205b005886503b45287887c93ae083821037583fce8bb9e0f82a701cbc01d0d07e45697c83e70801c5e689bda213693a0c9a845e21a16e840e9e8a
SSDEEP 6144:m+dTTUFgEs3XojAdI+dTTUFowLuLahmZ2uB:mgUFgEsnojAKgUF2AmZH
TLSH
T1D6243A19F58300F5D82B41B04CCBE2BFCB71FA2285218F6FD75987576E23BA15C28A65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3412	svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe
5880	svchost_ACBBBABCCAABBBAABCBCACCCBBCABACCBCCCBBBABBCBBBCACBBBACB.exe
3172	svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBACCACCBBBACBAABCAABBCCCCCABAACCBACAACABCABBAABBCBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe"	2026-09-05_7b556b249d9c351cfd12eaef8e455a63_elex_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACBCBCCCCCAAACCAAACACCAABBACBCAABABBABAABBBBCBBACAACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBBABCCAABBBAABCBCACCCBBCABACCBCCCBBBABBCBBBCACBBBACB.exe"	svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
944	sc.exe
4208	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4864	cmd.exe
4156	cmd.exe
1128	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBBABCCAABBBAABCBCACCCBBCABACCBCCCBBBABBCBBBCACBBBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_7b556b249d9c351cfd12eaef8e455a63_elex_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4204	2026-09-05_7b556b249d9c351cfd12eaef8e455a63_elex_icedid.exe
4204	2026-09-05_7b556b249d9c351cfd12eaef8e455a63_elex_icedid.exe
4204	2026-09-05_7b556b249d9c351cfd12eaef8e455a63_elex_icedid.exe
4204	2026-09-05_7b556b249d9c351cfd12eaef8e455a63_elex_icedid.exe
3412	svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe
3412	svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe
3412	svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe
3412	svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe
5880	svchost_ACBBBABCCAABBBAABCBCACCCBBCABACCBCCCBBBABBCBBBCACBBBACB.exe
5880	svchost_ACBBBABCCAABBBAABCBCACCCBBCABACCBCCCBBBABBCBBBCACBBBACB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4204	2026-09-05_7b556b249d9c351cfd12eaef8e455a63_elex_icedid.exe
Token: SeDebugPrivilege	3412	svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe
Token: SeDebugPrivilege	5880	svchost_ACBBBABCCAABBBAABCBCACCCBBCABACCBCCCBBBABBCBBBCACBBBACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4864	4204	2026-09-05_7b556b249d9c351cfd12eaef8e455a63_elex_icedid.exe	92
PID 4864 wrote to memory of 980	4864	cmd.exe	94
PID 3412 wrote to memory of 1084	3412	svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe	95
PID 4204 wrote to memory of 4156	4204	2026-09-05_7b556b249d9c351cfd12eaef8e455a63_elex_icedid.exe	98
PID 4156 wrote to memory of 944	4156	cmd.exe	100
PID 4204 wrote to memory of 1128	4204	2026-09-05_7b556b249d9c351cfd12eaef8e455a63_elex_icedid.exe	101
PID 1128 wrote to memory of 4208	1128	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-05_7b556b249d9c351cfd12eaef8e455a63_elex_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_7b556b249d9c351cfd12eaef8e455a63_elex_icedid.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCBCCBCBACCACCBBCBAAABBACCBCCACAACBBACAAABCCBCBBABAAABBCABACACBCBCBBBBCBCAAABCBBCBBCCACCACACCBBCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCBCCBCBACCACCBBCBAAABBACCBCCACAACBBACAAABCCBCBBABAAABBCABACACBCBCBBBBCBCAAABCBBCBBCCACCACACCBBCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBABAAAACCBBCAAABAAABBCBAACCCBCACABACCBAACBCACCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe" start= auto displayName= "UserDataSvc_CCBABAAAACCBBCAAABAAABBCBAACCCBCACABACCBAACBCACCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBABAAAACCBBCAAABAAABBCBAACCCBCACABACCBAACBCACCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe" start= auto displayName= "UserDataSvc_CCBABAAAACCBBCAAABAAABBCBAACCCBCACABACCBAACBCACCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBABAAAACCBBCAAABAAABBCBAACCCBCACABACCBAACBCACCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBABAAAACCBBCAAABAAABBCBAACCCBCACABACCBAACBCACCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4208

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABCCAABBBAABCBCACCCBBCABACCBCCCBBBABBCBBBCACBBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABCCAABBBAABCBCACCCBBCABACCBCCCBBBABBCBBBCACBBBACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe
1⤵
- Executes dropped EXE
PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1a80639ad112e7ba220712efd53e8f24dd5a06f39157214d2c8457971633fdad
MD5 e1514b1c84dd0a1f44652a48f652e0a2
SHA1 980ac54be302e398efb8881b6f07ea0a5d049bcd
SHA512 81e4cadd2e0ccc3883401b35aea8c28b17d9d3115c56cda5fd4752730b308d18c8e7821fbd5bdb26a5f1155717fce31206111c8269f792cb283a68c5a128a631
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7f18abcc4f1437372854801f07d0b72a2c0a13b6850d8c84a2fc3775a6a48af8
MD5 5677dd139ae78aabca5b600dc3a0fcf1
SHA1 1f6d5e70cc15d845baecb739b16aeb6f680759f7
SHA512 3ca9f5cd35dec96bea49387acb1c3d86d9f237bf0e4a4f49506583f128c92b2cdf5deff010acfca18c94776864ba7e1a38e8564c7d911e2dfe7da18c61dc0502
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d4535f152f33240055c747aa390a1df2bf62ce6c7167452aaa197b8164028104
MD5 7edf77bd30d9cb2974c2cb73e596fdd9
SHA1 71b24b3aa37b5c85830c265845d675c729ecefce
SHA512 4c3f80c0f4a3975941b92031edc5c65b635f182a01e074a2554cf5890ab5119e29ab0420af34f5cee232baca91024616ed5f681c60e8419e6ceacf9f0dee7d3b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7f5832436c38e88f257a7ac7f40ad9fcdc571714aa78fa0e6f17d65866792a27
MD5 bd582c2bbabf60f214eadbe044037d96
SHA1 02baf149f83bc2b1a90da36405276a8fc38998ba
SHA512 5f1faec889da7f520bdcdf5feda593dc18e1838b4de2e0b5bdacd84d3499ae1ea0ed496cbe0dc85c43a1aa5fb5c2e86dbdcf35ad743360881ab13b8b2cdce556
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9e3d7340d3870a84c417be18cbcd9af024c5dabff64f1063653c9bbbfd627312
MD5 d3605ddbc70d4fcc825974bbca876fe1
SHA1 eb4d05774ed87c1632345be30c59cffb95823bb2
SHA512 6dcdca0ce8a79e2f232dfc752721e73ebda14794e72370421f7cdfa6b22f4fc4809e0ce8a61c08894633b7347fc417053e675ea5e51328a0ced68470fa739a6a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 acfae2e1ef32cce8841d36278f8b2b633fffb01e506c9953327529a98442848f
MD5 0c6dff9fc80882774b83da57e2c87ca0
SHA1 dd4cb1b467653a848cab6282b2666efb2e56ba57
SHA512 435e260ffc41a3b789c649dc0f9399e5c3578d83122557b22de2fb4f24be86415334f99a88e1e7b7b394bd3173ecc8b720a83b19d5db1a780ebc9f4e4b233925
MD5 SHA1 SHA512

Submit Download

svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBBCBBABABABABCCAACBAACBABAAABAABACBBBAACCCBCCAA.exe
Size 205KB
SHA256 cde423d941dde9abafd21998a195c384c573b32d5d67e0fcbfc27d350585f963
MD5 7b556b249d9c351cfd12eaef8e455a63
SHA1 8e9ab859ee51cfa8e2bb81af9612fb5611f654a3
SHA512 9ce1221b79205b005886503b45287887c93ae083821037583fce8bb9e0f82a701cbc01d0d07e45697c83e70801c5e689bda213693a0c9a845e21a16e840e9e8a
SSDEEP 6144:m+dTTUFgEs3XojAdI+dTTUFowLuLahmZ2uB:mgUFgEsnojAKgUF2AmZH
TLSH
T1D6243A19F58300F5D82B41B04CCBE2BFCB71FA2285218F6FD75987576E23BA15C28A65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 776B
SHA256 854c8309a33cd6996fc456ff1373b266fb481c843d4184c1b3f8accd5bce25fd
MD5 0b2087a2d58e6d8656a76e8fc8711922
SHA1 1b33c3681b74be96b8bfd24aae42fc40c4e6f4cd
SHA512 f92e6c10f1ba36f6dcd65f30989bca78d92ff0dadc8ea7034b1000804a948429685931f306029e4cdb3c5cabcc8ee19b470aff063e753d2a4f28d148a6383a4b
TLSH
T1CB014980F0A5D4D3E03164875B29DAD708D83BDF9958AF282302521CBAAFC374F150E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3172-72-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/3412-33-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/3412-23-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/4204-0-0x0000000000350000-0x0000000000371000-memory.dmp

Download

memory/4204-7-0x0000000000350000-0x0000000000371000-memory.dmp

Download

memory/5880-70-0x0000000000060000-0x0000000000081000-memory.dmp

Download