Analysis
- max time kernel
146s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 06:22
General
- Target 2026-07-18_c8cf582c08864deef8a2c950bea4d03d_icedid_vidar.exe
- Size 685KB
- Sample260718-g45rlsd16w
- SHA256 4bb326b81d3e346687ea2958d8ed2ff91f29fb79a1100150985b72f163d81291
Malware Config
Signatures
- Executes dropped EXE 20 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 24 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_c8cf582c08864deef8a2c950bea4d03d_icedid_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_c8cf582c08864deef8a2c950bea4d03d_icedid_vidar.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
AppVShNotify.exe
IntegratedOffice.exe
MavInject32.exe
OfficeC2RClient.exe
appvcleaner.exe
LICLUA.EXE
OSE.EXE
VSTOInstaller.exe
chrmstp.exe
setup.exe
chrome_pwa_launcher.exe
elevated_tracing_service.exe
elevation_service.exe
notification_helper.exe
os_update_handler.exe
chrome_proxy.exe
appletviewer.exe
extcheck.exe
idlj.exe
jabswitch.exe
jar.exe
jarsigner.exe
java-rmi.exe
java.exe
dotnet.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SearchIndexer.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/928-232-0x00007FF76B060000-0x00007FF76B128000-memory.dmp
memory/928-234-0x00000260F9B70000-0x00000260F9BD6000-memory.dmp
memory/928-309-0x00007FF76B060000-0x00007FF76B128000-memory.dmp
memory/928-233-0x00000260F9B70000-0x00000260F9BD6000-memory.dmp
memory/1032-246-0x00007FF60E6A0000-0x00007FF60E7B9000-memory.dmp
memory/1032-328-0x00007FF60E6A0000-0x00007FF60E7B9000-memory.dmp
memory/1032-247-0x000001C04F850000-0x000001C04F8B6000-memory.dmp
memory/1032-248-0x000001C04F850000-0x000001C04F8B6000-memory.dmp
memory/1236-312-0x000002BC1C8E0000-0x000002BC1C946000-memory.dmp
memory/1236-310-0x00007FF766520000-0x00007FF7665D3000-memory.dmp
memory/1236-375-0x00007FF766520000-0x00007FF7665D3000-memory.dmp
memory/1236-311-0x000002BC1C8E0000-0x000002BC1C946000-memory.dmp
memory/1548-26-0x000001DDC2F80000-0x000001DDC2FE6000-memory.dmp
memory/1548-28-0x000001DDC2F80000-0x000001DDC2FE6000-memory.dmp
memory/1548-27-0x000001DDC2F80000-0x000001DDC2FE6000-memory.dmp
memory/1548-25-0x000001DDC2D80000-0x000001DDC2EA4000-memory.dmp
memory/2284-263-0x0000013231A40000-0x0000013231AA6000-memory.dmp
memory/2284-261-0x00007FF7B9B90000-0x00007FF7B9CD9000-memory.dmp
memory/2284-336-0x00007FF7B9B90000-0x00007FF7B9CD9000-memory.dmp
memory/2284-264-0x0000013231A40000-0x0000013231AA6000-memory.dmp
memory/2352-292-0x000001A08FAB0000-0x000001A08FB16000-memory.dmp
memory/2352-290-0x00007FF6EE010000-0x00007FF6EE0BD000-memory.dmp
memory/2352-291-0x000001A08FAB0000-0x000001A08FB16000-memory.dmp
memory/2352-359-0x00007FF6EE010000-0x00007FF6EE0BD000-memory.dmp
memory/2400-283-0x000001F38BF00000-0x000001F38BF66000-memory.dmp
memory/2400-284-0x000001F38BF00000-0x000001F38BF66000-memory.dmp
memory/2400-356-0x00007FF657940000-0x00007FF658083000-memory.dmp
memory/2400-282-0x00007FF657940000-0x00007FF658083000-memory.dmp
memory/2420-381-0x0000023D0D1F0000-0x0000023D0D256000-memory.dmp
memory/2420-380-0x00007FF737240000-0x00007FF73736E000-memory.dmp
memory/2420-382-0x0000023D0D1F0000-0x0000023D0D256000-memory.dmp
memory/2736-374-0x00007FF6D16B0000-0x00007FF6D1AC6000-memory.dmp
memory/2736-299-0x00007FF6D16B0000-0x00007FF6D1AC6000-memory.dmp
memory/2736-300-0x000001B65A490000-0x000001B65A4F6000-memory.dmp
memory/2736-301-0x000001B65A490000-0x000001B65A4F6000-memory.dmp
memory/3184-276-0x0000000000880000-0x00000000008E9000-memory.dmp
memory/3184-270-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/3184-271-0x0000000000880000-0x00000000008E9000-memory.dmp
memory/3184-338-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/3192-37-0x000001E9D3990000-0x000001E9D39F6000-memory.dmp
memory/3192-34-0x000001E9D3740000-0x000001E9D3864000-memory.dmp
memory/3192-36-0x000001E9D3990000-0x000001E9D39F6000-memory.dmp
memory/3192-35-0x000001E9D3990000-0x000001E9D39F6000-memory.dmp
memory/3496-55-0x0000023E0DDB0000-0x0000023E0DED4000-memory.dmp
memory/3496-57-0x0000023E0E030000-0x0000023E0E096000-memory.dmp
memory/3496-56-0x0000023E0E030000-0x0000023E0E096000-memory.dmp
memory/4100-319-0x00007FF7DAEC0000-0x00007FF7DB162000-memory.dmp
memory/4100-379-0x00007FF7DAEC0000-0x00007FF7DB162000-memory.dmp
memory/4100-321-0x0000015375CE0000-0x0000015375D46000-memory.dmp
memory/4100-322-0x0000015375CE0000-0x0000015375D46000-memory.dmp
memory/4120-22-0x00007FF7B2500000-0x00007FF7B25E9000-memory.dmp
memory/4120-19-0x000001B112630000-0x000001B112696000-memory.dmp
memory/4120-0-0x00007FF7B2500000-0x00007FF7B25E9000-memory.dmp
memory/4120-1-0x000001B112630000-0x000001B112696000-memory.dmp
memory/4120-2-0x000001B112630000-0x000001B112696000-memory.dmp
memory/4120-4-0x000001B112630000-0x000001B112696000-memory.dmp
memory/4200-347-0x00007FF69AA70000-0x00007FF69AD90000-memory.dmp
memory/4200-345-0x000001B676400000-0x000001B676466000-memory.dmp
memory/4200-340-0x000001B676400000-0x000001B676466000-memory.dmp
memory/4200-339-0x00007FF69AA70000-0x00007FF69AD90000-memory.dmp
memory/4200-341-0x000001B676400000-0x000001B676466000-memory.dmp
memory/4684-352-0x000001D06D1A0000-0x000001D06D206000-memory.dmp
memory/4684-351-0x000001D06D1A0000-0x000001D06D206000-memory.dmp
memory/4684-350-0x00007FF6E7A00000-0x00007FF6E7C8A000-memory.dmp
memory/4692-61-0x00007FF6D47C0000-0x00007FF6D48E2000-memory.dmp
memory/4692-14-0x000001E09DC40000-0x000001E09DCA6000-memory.dmp
memory/4692-13-0x000001E09DC40000-0x000001E09DCA6000-memory.dmp
memory/4692-12-0x000001E09DC40000-0x000001E09DCA6000-memory.dmp
memory/4692-11-0x00007FF6D47C0000-0x00007FF6D48E2000-memory.dmp
memory/4780-240-0x00007FF76B060000-0x00007FF76B128000-memory.dmp
memory/4780-243-0x000002D28B8F0000-0x000002D28B956000-memory.dmp
memory/4780-318-0x00007FF76B060000-0x00007FF76B128000-memory.dmp
memory/4780-242-0x000002D28B8F0000-0x000002D28B956000-memory.dmp
memory/4908-52-0x00007FF7965A0000-0x00007FF796707000-memory.dmp
memory/4908-43-0x00007FF7965A0000-0x00007FF796707000-memory.dmp
memory/4908-44-0x000002055B520000-0x000002055B586000-memory.dmp
memory/4908-45-0x000002055B520000-0x000002055B586000-memory.dmp
memory/4908-50-0x000002055B520000-0x000002055B586000-memory.dmp
memory/5036-360-0x00007FF7715D0000-0x00007FF771AA0000-memory.dmp
memory/5036-362-0x00000196EE620000-0x00000196EE686000-memory.dmp
memory/5036-361-0x00000196EE620000-0x00000196EE686000-memory.dmp
memory/5332-368-0x00007FF7C21B0000-0x00007FF7C26B6000-memory.dmp
memory/5332-369-0x000001E584CC0000-0x000001E584D26000-memory.dmp
memory/5332-370-0x000001E584CC0000-0x000001E584D26000-memory.dmp
memory/5568-387-0x00007FF6F3340000-0x00007FF6F34D4000-memory.dmp
memory/5568-331-0x00000208DBDA0000-0x00000208DBE06000-memory.dmp
memory/5568-330-0x00000208DBDA0000-0x00000208DBE06000-memory.dmp
memory/5568-329-0x00007FF6F3340000-0x00007FF6F34D4000-memory.dmp
memory/5756-390-0x000001F965F70000-0x000001F965FD6000-memory.dmp
memory/5756-392-0x000001F965F70000-0x000001F965FD6000-memory.dmp
memory/5756-391-0x00007FF7EA450000-0x00007FF7EA78E000-memory.dmp