55a6d83ab4588bc68fc77c35cea74528b90ada5e0bcaad920fc122e10d6d6ce4

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 23:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_1bebfddb4ad70ab76334cfc709255ce8_elex_icedid_njrat.exe
Size 1.0MB
Sample260909-3jp2batya1
SHA256 55a6d83ab4588bc68fc77c35cea74528b90ada5e0bcaad920fc122e10d6d6ce4
MD5 1bebfddb4ad70ab76334cfc709255ce8
SHA1 631488e2a18ebcbafca83fae5d3416bdae7f41b6
SHA512 4138f4e7c721ad3b43cb557ccd953e5c438c7afac983060e78763a4ee45102288f340395b957c14510f80fcb133c7e4831810b10c753ba79a59a09a8f892788e
SSDEEP 24576:m9+EM0q9+EM0l9+EM0q9+EM0qpslZOZD9+EM0q9+EM0q9NslZOZo:U+ES+E1+ES+E1G+ES+ESYF
TLSH
T137257C09F99204F1D96B41B049CBD27FCA71BA224611CFABE759C71B6F23B61AC2C711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2368	svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe
4480	svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe
2448	svchost_BBABCBBBCABAABBCBCBACAABCCBACACABBCABCCBCCAACBCBACCABCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCABBAABCACBCBCACCBABBABACACBBABABBACBBACCBAABAAAAABABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe"	2026-09-09_1bebfddb4ad70ab76334cfc709255ce8_elex_icedid_njrat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAACAACABBCAABCBCBACBCBCABBBAAAABCBCCBAAAACBABCCACCBCBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABCBBBCABAABBCBCBACAABCCBACACABBCABCCBCCAACBCBACCABCB.exe"	svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2212	sc.exe
704	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1200	cmd.exe
4116	cmd.exe
3864	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABCBBBCABAABBCBCBACAABCCBACACABBCABCCBCCAACBCBACCABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_1bebfddb4ad70ab76334cfc709255ce8_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2312	2026-09-09_1bebfddb4ad70ab76334cfc709255ce8_elex_icedid_njrat.exe
2312	2026-09-09_1bebfddb4ad70ab76334cfc709255ce8_elex_icedid_njrat.exe
2312	2026-09-09_1bebfddb4ad70ab76334cfc709255ce8_elex_icedid_njrat.exe
2312	2026-09-09_1bebfddb4ad70ab76334cfc709255ce8_elex_icedid_njrat.exe
2368	svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe
2368	svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe
2368	svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe
2368	svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	2026-09-09_1bebfddb4ad70ab76334cfc709255ce8_elex_icedid_njrat.exe
Token: SeDebugPrivilege	2368	svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 1200	2312	2026-09-09_1bebfddb4ad70ab76334cfc709255ce8_elex_icedid_njrat.exe	91
PID 1200 wrote to memory of 2648	1200	cmd.exe	93
PID 2312 wrote to memory of 4116	2312	2026-09-09_1bebfddb4ad70ab76334cfc709255ce8_elex_icedid_njrat.exe	94
PID 4116 wrote to memory of 2212	4116	cmd.exe	96
PID 2312 wrote to memory of 3864	2312	2026-09-09_1bebfddb4ad70ab76334cfc709255ce8_elex_icedid_njrat.exe	97
PID 3864 wrote to memory of 704	3864	cmd.exe	99
PID 2368 wrote to memory of 3204	2368	svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-09_1bebfddb4ad70ab76334cfc709255ce8_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_1bebfddb4ad70ab76334cfc709255ce8_elex_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCABABBBBAABCBBCCBCCCABAAABAAACCBACAACBCCCBBCCAACCCCCBCBAACBACBACACBCCCACBBACCBCBCCAACBBAACBCCCBCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCABABBBBAABCBBCCBCCCABAAABAAACCBACAACBCCCBBCCAACCCCCBCBAACBACBACACBCCCACBBACCBCBCCAACBBAACBCCCBCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACAACCBACABCCBACABBBBACABCBACBAACCBABCABCBBBBBCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe" start= auto displayName= "UserDataSvc_BACAACCBACABCCBACABBBBACABCBACBAACCBABCABCBBBBBCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACAACCBACABCCBACABBBBACABCBACBAACCBABCABCBBBBBCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe" start= auto displayName= "UserDataSvc_BACAACCBACABCCBACABBBBACABCBACBAACCBABCABCBBBBBCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACAACCBACABCCBACABBBBACABCBACBAACCBABCABCBBBBBCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACAACCBACABCCBACABBBBACABCBACBAACCBABCABCBBBBBCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3204

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe
1⤵
- Executes dropped EXE
PID:4480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBBBCABAABBCBCBACAABCCBACACABBCABCCBCCAACBCBACCABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBBBCABAABBCBCBACAABCCBACACABBCABCCBCCAACBCBACCABCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 77070be3d6fcb7d15366d27626ca4c464d8f9eccfb201aa2826cee4f8527f895
MD5 a14f7ef40d4609f4e1ba1aa2252c25d0
SHA1 c31a3637ea988372c03d57f18a4540e5388194d9
SHA512 8455667428fdbf15b65988629364a70221f397b4a7d2828e6ba496b54a937eaef14184f6f65d77fe8476dd63800c2087570ca0afad862a5a3389eac5ebb626dc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 82497372d5fc725e08820131362f39789511de4443a210519e3a61bb3b82ba52
MD5 15ad8f16f21523af784b46fe7298c248
SHA1 98bf6cdb8da4b5994c38ab4cb43253051350c712
SHA512 c5aa5643c9f2c25177806e8ebd1bd99d2f825bce85dc9a2cf9501e5cd5f1bda63235f2d47c200a9d3e4d952dc5b33433cef8f7c747713c2783423f64d4c06471
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a83e7ef69caf5e2330445b7e38d3c622c6c1f76cb1909a56d973fccc0646b37e
MD5 c9e618841bcb70ef1974844b3a282d08
SHA1 1ca85639e2ddf871c046cab470658c7a93960ee7
SHA512 969b3fd04c4ee3b821e43f864cda4b35e6cb3381b0cf86cc830571355b55f70425d7bd22e323958c0b7137358d00b6b2cb1b4981129aae25979e11e3a0c9ef5a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 54e2a239cbef8d3321a41738992308a22f39a8c85101d3610edf965f296a8fe2
MD5 211e9efbe8138baa7601cf461bfb060e
SHA1 b1106ac068221aed87400368d6e66995c7029fd3
SHA512 d31d90181f68f6c14314bf3ffdddd55e3ab9eff19b6350846a170621fcaefded6d4f1d8ae802e85c405b508441ae9919bb4a734c33641764dcb1bdf04c596cbc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6e21fc9b9efb9eba232623c7ab8e19d31a01d61e5228f77d70b1b2abfde2cb24
MD5 92a0c16a0401f632eb107e981224f971
SHA1 8b6ef12bf7a2170a0d9478dfc92f406eda84589d
SHA512 112305af597fc11fa0fd5f5b59c03e754305cbbe1614e865cd5c0230bf15786159782805dcb87703babb6adb663fe3be63a75f725a10219e8a2c27d187661d86
MD5 SHA1 SHA512

Submit Download

svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCAAABBBBBBBBABACBBAABCAACCACBBCACBAAACBAACABCBCCCA.exe
Size 1.0MB
SHA256 55a6d83ab4588bc68fc77c35cea74528b90ada5e0bcaad920fc122e10d6d6ce4
MD5 1bebfddb4ad70ab76334cfc709255ce8
SHA1 631488e2a18ebcbafca83fae5d3416bdae7f41b6
SHA512 4138f4e7c721ad3b43cb557ccd953e5c438c7afac983060e78763a4ee45102288f340395b957c14510f80fcb133c7e4831810b10c753ba79a59a09a8f892788e
SSDEEP 24576:m9+EM0q9+EM0l9+EM0q9+EM0qpslZOZD9+EM0q9+EM0q9NslZOZo:U+ES+E1+ES+E1G+ES+ESYF
TLSH
T137257C09F99204F1D96B41B049CBD27FCA71BA224611CFABE759C71B6F23B61AC2C711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2312-6-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/2368-22-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/2368-35-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/2448-74-0x0000000000190000-0x00000000001B1000-memory.dmp

Download

memory/4480-66-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download