Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/05/2026, 13:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe
- Size 1.1MB
- Sample260516-q6sphaew3x
- SHA256 6d4096470f6d324ca648394756f19ceeaad7ea5a7625fba2f0a6190f9cec9287
- MD5 0888e542dbceed910076664a7f0843f2
- SHA1 6851bf48ada1da70ef14bd031974108c88c0ac9d
- SHA512 1ed3c846779da7b4f1a6e72d9d3b9d8b5cf9c3eebc3b0e53dbf99f87d03675b808a94988f893cefbeb333f22a73408afc983ea908b8fcbae6de4b4fa73f9818a
- SSDEEP 24576:vTC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:v+6AqSPyC+NltpScpzbtvpJoMQSq/jre
- TLSH T16D356D0663A4419EFE67F172D61BC61BD6B1784E0336962F02A86F626F337711A1E331
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCX6B0F.tmp 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX7523.tmp 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX7961.tmp 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX7950.tmp 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX75E2.tmp 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX7631.tmp 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX6956.tmp 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX6955.tmp 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX7553.tmp 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX6A70.tmp 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX6A81.tmp 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX6AD0.tmp 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX7593.tmp 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX7930.tmp 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX7503.tmp 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_0888e542dbceed910076664a7f0843f2_agent-tesla_amadey_elex_icedid_njrat_vidar.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4844
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 72KB
- SHA256 60ad05256bc72ec802b8e23c38a5dc0e0e7145572a97ef927524422fc4277641
- MD5 8dab4fb0508f5d8555f626c6f65d0620
- SHA1 ae9845ca1191b08a0f8b0f341408ce7f1c5f8657
- SHA512 7dc2cce679a58934b141fb067fde857d66113c8084390d1cdeee0e2d92cbb1da4ef5e365cd76e01097a9efcb127ecd7657257562b8ba8a68286302525db6f0c1
- SSDEEP 768:W+Lv0SpxeAidabHtydtZlNojvQAqcDP8WBosd0bHazf0Tye4pr2+9If:W+AkZVtUWyu0uZp2+9If
- TLSH T1E973F503AE8A9653D403B930B15FEBBF57619C1F2725763B97AC7F47E8642804C0A672
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
- Size 190KB
- SHA256 289b7fd6541aa33ca8dea6639bedccffcbff544ca602b7754bd5ca1c265cec53
- MD5 6832b08398df5bb0d123a7ed444ab339
- SHA1 1a4f13cdee765ab9cbec03c1ca2005a249e8c629
- SHA512 b7e3c5db44e836eda93d77596d382f95631087ff69e5ee7d7bad50bd37a8bdddeb2c5b4fd3c8fc04ee392af3ea1b73e217134591e105ce00b5df70ac0ac2f8d9
- SSDEEP 3072:dAkZAWy4ZoxcpGnRppeQBMWRywl4/5vndNI3Kk4+NLlzt4++++YdbeV:dHBZ0nRpAFWcwl4hvndNIaINY++++YtE
- TLSH T164141707669660D7E0237930A15FC7AF9B76BC2F23217ABF476C2F065E522C04D29A71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
- Size 1.5MB
- SHA256 9da719253c98c2b56145883d1e86c2508e5b6cc1bb5bfe0ce7936610abc88a56
- MD5 f799aca6b461caa093c645d2ab14553b
- SHA1 0516ec9d3f10ca0a7bc2640a74527ec54a85440d
- SHA512 935b7b3656032b15327044392984160a4f9b34a2c4cb956ecacebde0c01f9e3c36175d0940f55bc848881402b4283d068ed6581996fa0b678264b2e16bc20890
- SSDEEP 24576:DmjDvw6qZ04SuTjPn68TQuD3g9gZLfChjyosZ9HT1zYeHNrk9NrfZB:cDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9l
- TLSH T1A4657C03B28900E9D05AE1B4C75B8636EAB17C4A0B34B6EF0794B7551E37BE45B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e5868b8.tmp
- Size 2.8MB
- SHA256 aa0a34300a93a2882b241b7fbf23e590f594f811fabfb8fccbc789796b7fa80e
- MD5 5fb303dcaf8de9324c9e4824718c0195
- SHA1 068710eaefe9da6aac750553546c08d2ad723b3e
- SHA512 1b117e044862a9a6bfc55984e6fd5093e0baa413507ca3055becd321ee602dbd5fb41c1bfa5e21327390e83ed50f6d1dabfea6e84896c11bb284578df8e7e7ee
- SSDEEP 49152:jY2fF8FhmS86IUJWQn+6h27d+Y2fF8FhmS86IUJWQn+6h27d6:jbOjjst4bOjjsts
- TLSH T1B6D57B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH