Analysis
- max time kernel
149s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/11/2026, 21:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-09_4280a5e0087a9cd0b1f512bc683b554a_elex_icedid_njrat.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-11-09_4280a5e0087a9cd0b1f512bc683b554a_elex_icedid_njrat.exe
- Size 632KB
- Sample261110-1aywrabc86
- SHA256 0f96ae89c5362868b972305bfa64451590735b63707c4b21674ae8089505d479
- MD5 4280a5e0087a9cd0b1f512bc683b554a
- SHA1 6756272d5b77f07548e1f93296365c26a26cb079
- SHA512 6b6b075b6d0bcd62393091784157f0c3701ca89718bf12e3b3ac9dfda6908f8e60c5fbae487dc97f3b0527f4adab9bea2523434369f26b5781531cd7d7421ad1
- SSDEEP 12288:B5hVESiZbbSoCU5qJSr1eWPUntBB0sP0MugCAjHUzTsh:B5hVESi1SoCU5qJSr1eWPSCsP0MugC6M
- TLSH T1B9D48D5677A046F6D17BD23DCA424B56E9B278024720A64F03EA43AB1F233615F3F726
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4088 Logo1_.exe 4380 2026-11-09_4280a5e0087a9cd0b1f512bc683b554a_elex_icedid_njrat.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Defender\MpCmdRun.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe Logo1_.exe File opened for modification C:\Program Files\Windows Mail\wab.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\dotnet.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe Logo1_.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 2026-11-09_4280a5e0087a9cd0b1f512bc683b554a_elex_icedid_njrat.exe File created C:\Windows\virDll.dll Logo1_.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4468 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Logo1_.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_4280a5e0087a9cd0b1f512bc683b554a_elex_icedid_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4088 Logo1_.exe 4088 Logo1_.exe 4088 Logo1_.exe 4088 Logo1_.exe 4088 Logo1_.exe 4088 Logo1_.exe 4088 Logo1_.exe 4088 Logo1_.exe 4088 Logo1_.exe 4088 Logo1_.exe 4088 Logo1_.exe 4088 Logo1_.exe 4088 Logo1_.exe 4088 Logo1_.exe 4088 Logo1_.exe 4088 Logo1_.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5480 wrote to memory of 4468 5480 2026-11-09_4280a5e0087a9cd0b1f512bc683b554a_elex_icedid_njrat.exe 89 PID 5480 wrote to memory of 4088 5480 2026-11-09_4280a5e0087a9cd0b1f512bc683b554a_elex_icedid_njrat.exe 90 PID 4468 wrote to memory of 4380 4468 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_4280a5e0087a9cd0b1f512bc683b554a_elex_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_4280a5e0087a9cd0b1f512bc683b554a_elex_icedid_njrat.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2AEE.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\2026-11-09_4280a5e0087a9cd0b1f512bc683b554a_elex_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_4280a5e0087a9cd0b1f512bc683b554a_elex_icedid_njrat.exe"3⤵
- Executes dropped EXE
PID:4380
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4088
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 607KB
- SHA256 1dcb57d98da808adcd3db01f2184d7933966b9a4eb9a0a92b7fd383917679385
- MD5 43206d0a359043e2faa73e904f70c6e3
- SHA1 0ff1cfeef9c6dfe25ed1ace30f3e2a831fdeb149
- SHA512 7e9bf13bc05a9cbc589988cae9446de5f3ed847f2fd25fca09ed7ef0489a13acef949ca9aa8d83d283e07763b02d7d6a275053a2b26db89993181b6fe3b62e0e
- SSDEEP 12288:B5hVqXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:B5hVe0Le5ji0hmxNrM
- TLSH T182D41916F6748731D073C0B9C5D2A68EE97230821B308ACB5296D77C7E677E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a2AEE.bat
- Size 704B
- SHA256 c2c96302c11de4f9b547244d4733f2e9d68e6fcd7ddbf276d710a122310eec47
- MD5 5f54789bc5f7ed90cc28df21315f5bdd
- SHA1 209c6bf910b39731cd7280710a4353fdd5eee08f
- SHA512 4992554ee355b5f98047924bc07a3ef6c06c412502a993f071c50fc8b83530b1681bf5861f5a6e0275bf365509ae66097b0196ad3607dc259b840ed46f186692
- TLSH T1C601A240838DC99A0618B02709F56EDEC4633BE6EF363768D336CA566CC141EFAD6711
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-11-09_4280a5e0087a9cd0b1f512bc683b554a_elex_icedid_njrat.exe.exe
- Size 574KB
- SHA256 0cf9864ae3a8679ed503f954a453452c93fa44f99ca6f39bbc5860abde7fd35e
- MD5 6503efe0a01c2d50c97be27f3cb10a43
- SHA1 a0cb3708603a18f02352d01ec672020e5bad5073
- SHA512 ebdbc553ba4348676fd3f2ca12e48af53a229b449a36e653dbfca90efb34d21033e41d1157dcca28c2b1e5f91368c0839298992247cf7d2e8feca5feab8ecea4
- SSDEEP 12288:jSiZbbSoCU5qJSr1eWPUntBB0sP0MugCAjHUzTsh:jSi1SoCU5qJSr1eWPSCsP0MugC6eT
- TLSH T12FC48C5A779006F5D17BD239CA524B56EAB278024720A64F03EA43BB1F233215F7F726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 58KB
- SHA256 781254982f9c4e247ed1813409ff7b6a2189180fea181e207abda0c26f150302
- MD5 38a94b3a9d1363feefed82779f2390e4
- SHA1 5db8126110533cd2722b08bd268b38d43f018e3f
- SHA512 fe07d30fe2401137c4bc4488b00fc661b1328a0586b01405f2fececf0c486993e377a452552f33960e75585cdc17a0f251c520beb0f013e1c9c2968f2c63b439
- SSDEEP 1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmitA:qKtfDwsjPThTYszDH2f
- TLSH T152438E57FAB0C833D02819FC5D1AC2D5B6B675702D1A0962BAF6AF0CDC7A2D2651C24F
- MD5 SHA1 SHA512 SSDEEP TLSH