Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/05/2026, 02:44
Behavioral task
behavioral1
Sample
2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe
- Size 13.8MB
- Sample260505-c8d28sfs7x
- SHA256 472a0cd984b5312ba6eea630af6a12e95ba46124a03a07ab5e61152c4c02d6e7
- MD5 738a5cfbbeabd6c8d4e27768f0bace0f
- SHA1 fc61d2112afa31c5c65ba5525888b690ef6f1925
- SHA512 28551412324911d6d8afcb8953c14d10d987e6de149117ee374d6b488864471f91b0075dfc6802455ae8a1d6e7ba577d6ceb93550117287157284148f563a4cb
- SSDEEP 98304:espjxAZWak7ODUbYZfgs0QlxdtLK3BDhtvS0Hpe4zbpaAKQkroGITd2:77ODU64scBnvjeApaAvkt8d2
- TLSH T114E66C036EAC45B1C15FBA308951C3B6D6B17C454822AA1B2ED0FE9EAF736D17E5C321
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netsh.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\choice.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\find.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mode.com- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sc.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Dism.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\replace.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\logman.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\charmap.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\comp.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\getmac.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\label.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe -
resource yara_rule behavioral1/memory/5724-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0009000000021698-5.dat upx behavioral1/memory/5724-436-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/5724-3204-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\dotnet.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Program Files\ConvertSuspend.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_4eec2752c7ea16f8\r\backgroundTaskHost.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_425d54d86cc1f3e2\tttracer.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-calc_31bf3856ad364e35_10.0.19041.1_none_6a03b910ee7a4073\calc.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.19041.789_none_b38221af158e5881\f\EDPCleanup.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\r\CustomInstallExec.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1151_none_ae854961a06058b2\r\dmcertinst.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_c5675ea732c2eaa0\r\LockApp.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.19041.1_none_6c56c3651a911f63\waitfor.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1_none_cc2783ead104d62a\winrs.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\sftp.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\f\relog.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\unsecapp.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1_none_0e22056af4d5d874\mstsc.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.19041.1_none_a2eda420e70d2fc8\dsacls.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15805.0_none_f04c7dcfd4283324\AppLaunch.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.1266_none_d92abf553d8a282c\MusNotification.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_510ebdd9292eed06\diskpart.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.1_none_9478227a478f23d5\Build.bat- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\f\CallingShellApp.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.19041.1266_none_69f1a169b4d96a7c\pcwrun.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.19041.1_none_8a11dbe22c9bf6e1\msfeedssync.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\LaunchTM.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.19041.1_none_6b761570d2ba1947\certutil.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\f\ShapeCollector.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.19041.1_none_10bddbfab734fa42\VSSVC.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.546_none_f8b0afde1e951639\r\WmiPrvSE.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.19041.1266_none_23ae8c0349f1b325\r\UsoClient.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.789_none_9beee4eb02a5f8c7\f\Narrator.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.19041.1_none_fc9bfaeba32d6cd5\dpnsvr.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.19041.1202_none_33e8c5dac6801a49\r\CompatTelRunner.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_15114cf4ffe3136a\cmdl32.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\r\WmiApSrv.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.19041.1_none_fad576d8cf74b38a\dispdiag.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.19041.1_none_825521fc8f4a22ac\fsutil.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\wscript.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\SearchIndexer.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\r\SearchFilterHost.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\winhlp32.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\f\hvix64.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\hvix64.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_e95531bdadf3df5c\wmpshare.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\sdclt.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\EaseOfAccessDialog.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.264_none_9b436d497f039d6d\smartscreen.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.264_none_223a5768a6257099\eshell.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\f\explorer.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.19041.1_none_ee822d264112a470\powershell_ise.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.19041.844_none_95c651508e565d13\provtool.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.19041.1_none_9219c799710d7e86\userinit.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.1_none_255ef7c1a8ec5bf0\fsquirt.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceproperties_31bf3856ad364e35_10.0.19041.1_none_a03b7086d9468b36\DeviceProperties.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.264_none_2f9647f4d89dc6f5\explorer.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\iisreset.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.19041.1202_none_cd68049c9076546f\mighost.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\ssh-keygen.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1_none_ef1691668a233417\appidtel.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\explorer.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\iisreset.exe- 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_738a5cfbbeabd6c8d4e27768f0bace0f_elex_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 14.3MB
- SHA256 60ec95b26b5b254aacebb90def40a30affb86a5111b6755aacd103f50ccb0f8d
- MD5 56adb63e48d0e918854317c70c6d8446
- SHA1 46583d34fd4922e1772ea85a17d17e35a40be611
- SHA512 1feba3b7851411e443e5584ee8f8c7675a24d24cca594cdf4ceafab80a031dec1103bef014365903c20215e0c4bfcc65ecc78d2cc8d4b2de8fc55e84efa4a12e
- SSDEEP 98304:espjxAZWak7ODUbYZfgs0QlxdtLK3BDhtvS0Hpe4zbpaAKQkroGITdKjoe:77ODU64scBnvjeApaAvkt8dsoe
- TLSH T14FE66D036EAC41B1C16FBA308951C3BAD6717C454822AA1B1ED0FE9EAF736D17E5D321
- MD5 SHA1 SHA512 SSDEEP TLSH