General
- Target 2026-09-28_dc5e78e090b2e083d851db871168e1d4_agent-tesla_elex_icedid_stealc
- Size 20.1MB
- Sample260928-nc6cdssdja
- SHA256 375648636910692f644439c376b80d97193c3522dffb190e5ac92e373b7a8dd4
Malware Config
Targets
-
- Target 2026-09-28_dc5e78e090b2e083d851db871168e1d4_agent-tesla_elex_icedid_stealc
- Size 20.1MB
- SHA256 375648636910692f644439c376b80d97193c3522dffb190e5ac92e373b7a8dd4
Score10/10-
Modifies WinLogon for persistence
-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender Real-time Protection settings
-
Modifies Windows Defender notification settings
-
UAC bypass
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Disables taskbar notifications via registry modification
-
Disables use of System Restore points
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates new service(s)
-
Executes dropped EXE
-
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify Tools
4Modify Registry
6