Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 08:13
General
- Target 2026-07-27_91096eca8746f19ee62ba5004d59b982_icedid_njrat_vidar.exe
- Size 2.9MB
- Sample260727-j4vmraywcv
- SHA256 54678fbbcc21a56e9e94fa4503daef6c6e0050173ef9409090578082a7667a16
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_91096eca8746f19ee62ba5004d59b982_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_91096eca8746f19ee62ba5004d59b982_icedid_njrat_vidar.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
AutoHotkey.MemoryModule.temp.manifest
memory/2252-59-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-60-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-25-0x0000000180000000-0x000000018016D000-memory.dmp
memory/2252-31-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-32-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-33-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-34-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-35-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-15-0x0000000002640000-0x0000000002707000-memory.dmp
memory/2252-40-0x00000000077D0000-0x000000000793D000-memory.dmp
memory/2252-45-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-46-0x00000001400E9000-0x00000001400EA000-memory.dmp
memory/2252-47-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-48-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-49-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-50-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-51-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-0-0x00000001400E9000-0x00000001400EA000-memory.dmp
memory/2252-53-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-54-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-1-0x0000000180000000-0x0000000180263000-memory.dmp
memory/2252-55-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-52-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-61-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-63-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-64-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-65-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-62-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-66-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-68-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-67-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-69-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-70-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-71-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-72-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-73-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-74-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-75-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-76-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-77-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-78-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-79-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/2252-80-0x0000000140000000-0x00000001402FA000-memory.dmp