7044debe69dd9aeaa86194b68f2aa6d7dfa26d1011be1d10a5549cda481aaf20

Analysis

max time kernel
12s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_a22a6e20d80f0171ccf7e12f7c6483d5_elex_icedid_ipamor_njrat_vidar.exe
Size 1.2MB
Sample260701-d3mmvsfv4t
SHA256 7044debe69dd9aeaa86194b68f2aa6d7dfa26d1011be1d10a5549cda481aaf20
MD5 a22a6e20d80f0171ccf7e12f7c6483d5
SHA1 9411f6dd252b00fd95c41aabe766073e02afefc2
SHA512 d55fe29f548235e3c40d586cf7b09f7fc8cf3132ddf30cbb1be26172641f651d0d515af2dd109ddaa0dc44adb86548d2d165e06b3fe98204569fdbef7b7c4866
SSDEEP 24576:xfcS9in6bxcqbFpJVJTt4D7/SAOZi+5v48cKfk:xfcS4neHbRVBXdcV
TLSH
T112454902B280DFB2D06F5176C55646F19A27AC06CF20D3CB1398FE593E726D19A7A723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 7 IoCs

resource	yara_rule
behavioral2/memory/4264-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0008000000016d07-8.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1680-9-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4264-12-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1744-17-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1680-16-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4804-18-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0008000000016d07-8.dat	aspack_v212_v242

Executes dropped EXE 4 IoCs

pid	Process
1680	MSWDM.EXE
1744	MSWDM.EXE
5756	2026-06-30_A22A6E20D80F0171CCF7E12F7C6483D5_ELEX_ICEDID_IPAMOR_NJRAT_VIDAR.EXE
4804	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-06-30_a22a6e20d80f0171ccf7e12f7c6483d5_elex_icedid_ipamor_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-06-30_a22a6e20d80f0171ccf7e12f7c6483d5_elex_icedid_ipamor_njrat_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-06-30_a22a6e20d80f0171ccf7e12f7c6483d5_elex_icedid_ipamor_njrat_vidar.exe
File opened for modification	C:\Windows\devB6D8.tmp	2026-06-30_a22a6e20d80f0171ccf7e12f7c6483d5_elex_icedid_ipamor_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_a22a6e20d80f0171ccf7e12f7c6483d5_elex_icedid_ipamor_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1744	MSWDM.EXE
1744	MSWDM.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 1680	4264	2026-06-30_a22a6e20d80f0171ccf7e12f7c6483d5_elex_icedid_ipamor_njrat_vidar.exe	88
PID 4264 wrote to memory of 1744	4264	2026-06-30_a22a6e20d80f0171ccf7e12f7c6483d5_elex_icedid_ipamor_njrat_vidar.exe	89
PID 1744 wrote to memory of 5756	1744	MSWDM.EXE	90

C:\Users\Admin\AppData\Local\Temp\2026-06-30_a22a6e20d80f0171ccf7e12f7c6483d5_elex_icedid_ipamor_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_a22a6e20d80f0171ccf7e12f7c6483d5_elex_icedid_ipamor_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1680
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\devB6D8.tmp!C:\Users\Admin\AppData\Local\Temp\2026-06-30_a22a6e20d80f0171ccf7e12f7c6483d5_elex_icedid_ipamor_njrat_vidar.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Users\Admin\AppData\Local\Temp\2026-06-30_A22A6E20D80F0171CCF7E12F7C6483D5_ELEX_ICEDID_IPAMOR_NJRAT_VIDAR.EXE
    3⤵
    - Executes dropped EXE
    PID:5756

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSWDM.EXE

Path C:\WINDOWS\MSWDM.EXE
Size 768KB
SHA256 080f1939d9ec8ef53f7eb6bae105488c04fe264efb616a3f3d22f3a915fb0cf2
MD5 32d2b3d05fc68709076f97af8c33618d
SHA1 5b372e1c38b43aa4b39f2a43231aafb7cf1d03d9
SHA512 0e3006a0ce0b1b376f3868b62b91c4b704c5c86d1e65eb475ddb44012c4c5c0d9b4f71bdba6beea27e1e45c49d913073c6cebad4a9f3b6b3a3bcdc97d3e51df1
SSDEEP 12288:xfcS9XynvI6XsR+rEhAPJ2F8kmjI4eVYaH892LgZgjp4602zmgWYFaE8DqYSU8Ab:xfcS9in6bxcqbF4
TLSH
T1CDF43902F281DFB2D44F01B2C55682F1572BDE42CF1193D7A399FE1838B26D2A6B5267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devB6D8.tmp

Path C:\Windows\devB6D8.tmp
Size 430KB
SHA256 5d96bbc4e5b726d87c7cf547f5fe98f8f05434ec2130bd60cbf5671fd3a7381b
MD5 ffca2fbcc7e4637f2acc0a8a3b0dbaaa
SHA1 3697f037e527a31c013a2ff3ee2f6c373e67a2a7
SHA512 3d9bb3641bdb7d89d30a7d552c8eca7355ab64e56d6d1657dbfe4f4f66c93ced1aa75ffb1fc0326f5e06310bad6e51c94d57e7ef74e9db215ac2c72da1a20faf
SSDEEP 12288:WD+k3HVJ5xDfp4D7/SAOZi+5v4+rcKfth:UJVJTt4D7/SAOZi+5v48cKf3
TLSH
T127947C16B7A405F5E177E23DCA624A11E9767C165B30E74E03AC826A0F237619E3EF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1680-9-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1680-16-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1744-17-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4264-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4264-12-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4804-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4804-19-0x0000000002040000-0x0000000002046000-memory.dmp

Download