0b568012c235053dde0abbeebbf2a7b930f147e43051da5d5aa9cc868b66a69e

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe
Size 4.2MB
Sample260727-rtbe5avckd
SHA256 0b568012c235053dde0abbeebbf2a7b930f147e43051da5d5aa9cc868b66a69e
MD5 8a2ad865f0bbe2463f5fb089fdf0c74d
SHA1 14e1aabdc932c83322243cf03068f8530490d56f
SHA512 25c02443f289af5d52731887a0dac62c94465243d1b49e9c4adb0917efd4f3884607ca262fc9c2c5969b4e3613eb2402d02de2549c6df382caf3a87a3b021514
SSDEEP 49152:e4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3Tf:e4QvGAdlCEL8c/bRNw5CO
TLSH
T1E2165C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6424	svghost.exe

Executes dropped EXE 2 IoCs

pid	Process
6424	svghost.exe
4264	2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe

Loads dropped DLL 34 IoCs

pid	Process
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe
6424	svghost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	svghost.exe
File opened (read-only)	\??\P:	svghost.exe
File opened (read-only)	\??\U:	svghost.exe
File opened (read-only)	\??\X:	svghost.exe
File opened (read-only)	\??\Y:	svghost.exe
File opened (read-only)	\??\A:	svghost.exe
File opened (read-only)	\??\B:	svghost.exe
File opened (read-only)	\??\D:	svghost.exe
File opened (read-only)	\??\G:	svghost.exe
File opened (read-only)	\??\H:	svghost.exe
File opened (read-only)	\??\I:	svghost.exe
File opened (read-only)	\??\K:	svghost.exe
File opened (read-only)	\??\N:	svghost.exe
File opened (read-only)	\??\J:	svghost.exe
File opened (read-only)	\??\M:	svghost.exe
File opened (read-only)	\??\O:	svghost.exe
File opened (read-only)	\??\Q:	svghost.exe
File opened (read-only)	\??\R:	svghost.exe
File opened (read-only)	\??\S:	svghost.exe
File opened (read-only)	\??\V:	svghost.exe
File opened (read-only)	\??\W:	svghost.exe
File opened (read-only)	\??\T:	svghost.exe
File opened (read-only)	\??\Z:	svghost.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svghost.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svghost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svghost.exe	2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe
File created	C:\Windows\svghost.exe	2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svghost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4264	2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 6424	1932	2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe	90
PID 6424 wrote to memory of 4264	6424	svghost.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\svghost.exe
  "C:\Windows\svghost.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6424
- - C:\Users\Admin\AppData\Local\Temp\2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 630KB
SHA256 6fdb73165561baf410937d158e2dfc656264d013a07f915d5751d23aa65897e5
MD5 9fc16a35ac3399d360eb332db53ba2b1
SHA1 e0a3ac828a996e1b7c282246377ac381cd7d0788
SHA512 7d38af997c847a208bfb562513840517f4d8e3a62b058cd4b8a76be24f5f822767ab2c5c712cc8bc39c36c971bbcee0655c5c7074e8fdddb461610e0efbcb942
SSDEEP 12288:vXZNYVLeIYSWXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:h0LeIPa0Le5ji0hmxNrM
TLSH
T14DD40926F6748335D073C0B9C5D2A68AE971308657308ACB4296C77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 630KB
SHA256 dec99a6b5feb7bb8f6a908cc6683ff30bba4a0562b518c74acb13e8bae5bfde4
MD5 76a669146d2a71053a09b81dee598e8b
SHA1 9b556dfac8073eb07eaade5e4888919f4010d650
SHA512 0ae1da1c543d17de1a6ce565b238f09d9562104f9ec94a16ac25f6b501ef53b12df29d0f88f940d4ad5ef53ab09ce824d415992a2e7602f7d57694f970a7981b
SSDEEP 12288:MkVyYSWXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:tkPa0Le5ji0hmxNrM
TLSH
T1A1D41A16F6748335D073C0B9C5D2A69AE97130825B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.0MB
SHA256 93e8d2dca26b8b2aa195da53b80e0d9bbf1eb42ae462d8777a2d926208e22eba
MD5 83cae25c127c376c9cb0f01ab3202623
SHA1 6c0b7d67cc244c094a0837160c93953b454f27bb
SHA512 2e96bb020ada17567bc3f4c86998362debdc263cb5a6d6ca2db42f19f2cffa053a4ef6bb6cd94b66d44b952a5cc59035e0370c65848a77b93e59c909d4e928ae
SSDEEP 12288:MkVyYSZ8vaa81soeyezSC6v/ciLKK3kg5aqghpSy1TIPxTmqCLwKzu/:tkPaa7/ezSC6vUyD/aqgrvWx6q8wyu
TLSH
T16E35F915F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 773KB
SHA256 b6d64569b95479ecac7b8b2bdfbe9c27cc88e5da2b5d45467cb4781a2e5ebbe9
MD5 fb098955df41775691c6ef38d1e6be4a
SHA1 a61aee13094337ef1b80702f710cc98033ea7a6a
SHA512 638d7e9c6fbf35318040ea67dced1eb1705deb2df2453f328a876dea4dc9a7fc87203afca01b6818fae1ee731ac0e538ee5358ab1b770bcd5844b501353193a2
SSDEEP 12288:MkVyYSaVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:tkPaVbqPb88hv/l+7
TLSH
T1BAF43B66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 95KB
SHA256 39aaa86712b5ce2f0418d89579272d0535fa6b414a0f5fce979253001ff7a8e6
MD5 ec964ba678d5a80ed56dc5842afaffad
SHA1 c0ae53ebaa609b362f638b122fddbdc541a4b7ca
SHA512 cf2cadf1bfcfffb195e43133e32f374124a70a5e952cfad7a5e7042cd35c64250319b9952e59c8d99abeb915d2b18e014ea89e7e64b7de4df76c5524aebfca08
SSDEEP 1536:YA1V5CfA/L3WiukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IAW:DCiyiukvvVHC6++uq3eqW14k/EyK9fSt
TLSH
T1BEA301178B516056F7F70130BABF2A96917E1D62DDA8DB0E4B907ACD0E78314E862733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 95KB
SHA256 83884cb0039b4d84e3dca683c0b8f5f526f96554b4b0611bdc6beaf8a3896f53
MD5 2aaa3dc21795cf4984ecfd8c7ae062a0
SHA1 a3b10b124cc44ad91b020616eaa9740dbf5c43ac
SHA512 fa150038373f62f3645a7a1d835ae470aef4ca213b1c889a8079b51c4550e5b86beea15658c5c31814f572441fe7c1d1ff4d6628ef8aee281402a4c9a72b5c81
SSDEEP 1536:uHqaN6qHZukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IAZw4Rq:jaNVHZukvvVHC6++uq3eqW14k/EyK9fW
TLSH
T1E6A3D007CB9020A2F7FB0534B5FE2997967AAD2089A4DF4E47607BDD0C38255E962373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 362KB
SHA256 87e6fceed9fa58b318c1d9a0a5167874cdbaca248ba0e40c2aa18f69f959804e
MD5 daceb281547c6a874f25525b0dd11128
SHA1 1626c6cecf4f59b92682a08d97488a5440e863f3
SHA512 75623dce54278c6cc1dd38c1e2dff28029b4b50e561931cc1436ef3bac641dcd1991f15978628b851e50d0b90209c8f9e3a76e442390c7663839a1d3291da4c5
SSDEEP 6144:TK9faaOOr/BJ/GKWWBNU6ITLBi0qttclOKgU91Bg:TYSVeBNUbTVO86Uq
TLSH
T1C184F83BEE28FCD2C27A8DB85A918640E77278314B61A3CBD165830EDE135E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 362KB
SHA256 13b7bad19cce2d408a47bdede942dff27d41a0f35023881490df2e53db19eae6
MD5 9c562637c3902b75b20c9c5d3f5df15c
SHA1 88094b7b5ed9a29fdd1570a755165dcc89f25193
SHA512 ede6fdc3c5baec40942db8b3ab1006a99bd9eafd9e458198dc97424d85c5c0b26bafb18454d7a1a3b67fde28a64dee9a4673faacb39ad194f4eaedbece928d53
SSDEEP 6144:MknVuOGK9faaOOr/BJ/GKWWBNU6ITLBi0qttclOKgU91Bg:MkVyYSVeBNUbTVO86Uq
TLSH
T1AF843A3BEE28FCD2C27A8DB857918640E77274704F61A3CBD165820E9E136E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 130KB
SHA256 86e5f3f3e3d35f220d71354e1bebbe7f73e29927871e8473dbbaf91eb4206569
MD5 ac350d6f41740ce78caa08f6a3b64a0f
SHA1 59174f6da0d205b0f80541236c33180f8e97e816
SHA512 411185fa5a4f08d7377ea435a5aa191abdcec5d4e2f24b7378845500826a2f402eb36a54d4e0cae0aa9547cd3c4749b6e00dccdf2efc05a4a55b6b6376b6d261
SSDEEP 3072:xrecrS2aozwLseqW14k/EyK9fq4nzrecrS2aozwL9:wcr0XdK9fqpcr0X9
TLSH
T1BBD37D41A7A88217F9FB1F34B5F485521E7DBBC63C31C61E1889B49A2D637C09A11B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.2MB
SHA256 a8a2fe3b7cd21d591d680c9a0372dca3fa29f37cad3fdbf9056da7b5cc4a906e
MD5 f82231fc7dbdf0ed07a1777a307a761c
SHA1 453d49816662f6ec2c5823155ae7f7dfaf91261d
SHA512 e776e6036f0b020217e563c8d5aa6499952c3128dc9a2650f4aab57e11cf847896ce90cc97c97f4c94df4673872a6262c10cffc5d62e9ea5145201879dfeee94
SSDEEP 49152:Ze4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3j:Ze4QvGAdlCEL8c/bRNw5CO
TLSH
T1C1165B656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.5MB
SHA256 b2bf5bbfc43e1cf4f91fc40b14d6dd269d59d0b997f3ed311af81f6fe8be966e
MD5 fbd86f7dc06ae9e73459aaaddc7205e1
SHA1 ee50e3f0bc7fa74f282ee1a690b6fc3ebd9d8349
SHA512 6dbab3a11e8b4a8f69547959235ca8c2db624ad377b3f8795c9fd1d66e85e73ff752d3bb7eba2fa278d3c4349154bacdec390ad991c010b9dc600cf8e75bfe66
SSDEEP 196608:XMEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHi:XMEtQevvqc2W1cpV2XI32i
TLSH
T1AF474A91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.5MB
SHA256 50a42bbcc08444d3548463740b5d336f0c94542c4951aefd896c7e6350ca7c3a
MD5 1474e56c94d79d98ef4974c48575bfd6
SHA1 1f393a05dc9009a3d6aab8f86896c583bff656ea
SHA512 b01b3a0577ec742341ae03c8925d3550b6f7bff0f1f227323cae780bd2e4b67fcaa00a786a49a20825096c4bfb17cff239d9d3afa9657abde269c2172e043727
SSDEEP 196608:XsEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHi:XsEtQevvqc2W1cpV2XI32i
TLSH
T121474A91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.2MB
SHA256 9d540970a3479294bb8ae4bdf320ec31499c741248a440117763b5a28a7d6116
MD5 86687ade3e1f0cccacc5d6aeb218c0a9
SHA1 9a499e351d38c1cb8698990922afb7ea8d0728ba
SHA512 ba616fcc4cefe568bcfb5a97636e5b29014a1ebfaec9706e0712c62c646755bd258e0e58a3e3fc84eb80ca2604a0b31a2d8e9c035d9b95f2f983938a9fc8feaa
SSDEEP 24576:tkPhCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344:eZCbRquA/m2yL5zbfFiV+XenmE3/z
TLSH
T108B55C0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 660KB
SHA256 ae2f4ea05caa487db83200dd38933895b4e12e1ec429c6122c6094149ac52fc7
MD5 934fa5415009862a8b17793e5597f728
SHA1 1dfa12c06ecb5eddd51fa0355715a3c133d80f74
SHA512 e4bf1320b0d639add3eaa432cb293158d1dadd61e746a1658984729797c0dda0366b9cccc087257310841f06bd95f48e64188c9652fdef3df6935b23af359666
SSDEEP 12288:MkVyYSaAZ/GLAIFoiwtA5qy97S9uaYFLq3Oq:tkPaAhGLAIFoiwtA5l7S53f
TLSH
T14AE42881EBF955D4F5B3AA7899B69171EA76BCA65E30C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 338KB
SHA256 9e46ba02b6d49bf6831c45d0ca9f58239a2035eb7496c0b956a5fe998525bf7d
MD5 fe60083c15f8e0d2eeac0f34b1a945f2
SHA1 2b0f07bb306e12dddb259ca889db8c66ac538548
SHA512 53f21c0af13dddb0c2d845368dd1f688038c45db3814de5a91264a838c5771cbb196be93957491f1b66752d720d4b7f4013ca7fa6f79d3a22aa5e97778966a7a
SSDEEP 6144:bmw5HEiIsC0K9faimw5HEiIsCCINUGBZjgXwYz4WDZSFxgHiGfE:bmw5HEjsC0YSimw5HEjsChNVBFgl0WDu
TLSH
T17C746C4666E818F9E6A795388687C136FBF2B8013A21DB1F1760C65B1F37361BD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 177KB
SHA256 72011d12a6c2135e686be92c31ed9b1c7fe509ac9d92a8d91dfdc7de4d974e92
MD5 08a994996b67751690ad5030fd08aa5b
SHA1 35f2ea6e46f12b225664b4511efded6143f355a8
SHA512 6fd25dd6133b75caadbccd3e7011403cf1ca535e10bc74ca568c2a6dd8072bdfdca9fe7f1323895e95d1d962339b163e4e21e187bf005dca666eb3e2b69d6372
SSDEEP 3072:TCiyiukvvVHC6++uq3eqW14k/EyK9fa4UXkv57OsX2T3TH0XzZP1Pwe8UXDCsCys:MknVuOGK9fa857L2DTH0Z1Ie8YDfvat
TLSH
T1F204CF5A33E430FAE2A35238D9F55A46E7727463673583CF066042AA1F23BD15E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 137KB
SHA256 e6367a6428bd0aa37df5c510d4af674f75927b28fa55dc338d2c0c71b34963f4
MD5 77881c7d70ad95e5839c0070812a8937
SHA1 6fbd90c9abec47da825aa44de2e9850b83b84e23
SHA512 023edb27d2bd5c5d29957cd46ffbaf42af7cc62f3763307263056714ac1bfba1ad14748157f1e9a1468b070dc4e7421dda6db3e3e4312c9a5c80bdadecee51f0
SSDEEP 3072:TCiyiukvvVHC6++uq3eqW14k/EyK9fa4UR4WJgkt:MknVuOGK9faXJJ
TLSH
T1DBD3E10A67B600DAD06781B0C6E25B56F97DF553A75092CF0FA9C21A1F633C49E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 145KB
SHA256 d03d966fb37f8b371da927fd13e733736295a584804d270a172b5fb808435604
MD5 a6155167a4d4c52ffacf2fbc80387787
SHA1 c8e18fa3c55ad3c725d56cd791de025b0525a3ab
SHA512 fae292763eb1f176e678b6d208af6d2aa6d5e6158c3e1e30a873f9576ef82e894425ba0980ab347ac97382810c92cad4fa59f1683a39f34195749eca8f15d57a
SSDEEP 3072:TCiyiukvvVHC6++uq3eqW14k/EyK9fa4UTkIvQnkraVTxoQG:MknVuOGK9faJk3nkraVT8
TLSH
T129E3E04513E600EAD25B4278D2A35A45F57AF42387A0E6EF0FE5C21A1F53BC0DE3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 60KB
SHA256 b9f519a9b6b129464e7a9b349e40aadb5de40dc8c6a4ebee43997293b07c14b0
MD5 179199a2d5113344848be9a9142e7a92
SHA1 a216515623f22fca86695e47d78d6c19956861b3
SHA512 99faefb02e82b3a3db233ceb594cb7b1ee35a1f2aab537170d8762905dd83c5808b00caa66f3385b4e46a3b662c2ee1689e48d2aff68380e9001205f2b0fbac3
SSDEEP 768:ApwLsWZ7D774wTlENE9Kb8lS8i73PWG01Ekks3uN2wP22NjQtaOY7Og9zn:ApwLsWZ/4Ntb8lxmD22RQcOSfzn
TLSH
T1E1538D8522E900EEE16B41F8C1B35647FA75F85217A0D6DF0BA882091F637C1DE3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe
Size 4.1MB
SHA256 78425e626d0830c35ee05307ad6958055493acebbb8a2548ba3de4af6d6378f7
MD5 2864c8b005a6414e2fa9b06c1e089dcc
SHA1 3041fbd63ae570b537c38a315050c06aa566362f
SHA512 bf8fd10e7d517c183f0273b9b997c57c552154e8e65889a4277dea81c3d8104eebf12b4e5b179e95f5f261b5be01d3db13b7c46b8d723d951fbdaa0b15ec70c3
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:ZQvGAdlCEL8c/bRNw5CO
TLSH
T1F2165B656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ipkgk

Path C:\Users\Admin\AppData\Local\Temp\ipkgk
Size 440KB
SHA256 76963b7bd4c28e3218bb472299157c77e5968e0e5f9e8e99eb92df967d6f8b8e
MD5 5c5dea08333fa84e4b1aecb0ffe620e9
SHA1 b03ed6250f04378d06271949a6c5b322270fb881
SHA512 9d0ef551b0b78b8b2491d5ecade71f40175be03e768fda2361d3d6bda4dc14a1d558b068f61c2afd23dc0d454037a6f8d5595b60b49a914cdd8daaaad7fb4a0c
SSDEEP 12288:EkVyYMhAwSfxL/2Dc3jDLLmt0LDQewsAjRE:1klCaewsAju
TLSH
T1B4A48D31FE74E036C7BB0DB21B35C716183D7A604F611AC3E3A88A9D59602D26776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lcvqd

Path C:\Users\Admin\AppData\Local\Temp\lcvqd
Size 4KB
SHA256 9246c24b939c3aff800b14303e845d3f5b4757b07894e3b039fb2d5b1021e3c7
MD5 4f8b0cc1b83412f2299292f56e32910d
SHA1 f1315c9b1e2bc609d2d5f8349c7f73b6946a444b
SHA512 9578a0d16ade65b4425af88bd552266101fc9ab0bbf75281de2d6678f8cbb731cb8cf692bacd6f52727a7b975d43bce7de06e5268fe2465946f0c4830b10d3db
SSDEEP 96:2nnQTcTvcxPIBfxSQcy3Nk+0cl9/l8KnM:m0eMd
TLSH
T16D918E63630C2D36FC28A8F5ACA26362415CBF5107E4AC429A3DF42CA43EEC259F4438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wegwa

Path C:\Users\Admin\AppData\Local\Temp\wegwa
Size 130KB
SHA256 5d6b0fefd20999430da9409e99bfce3168aa3f78078ea2977f2573758f93d01d
MD5 d86d4d97300c56942ce07468a79b0599
SHA1 18a94032baf0031e40afad0dcfa60898b4da91ca
SHA512 33bc075e5f91df5e2e4cf36292bb8a7ee0b8a5beb180dd02d029cd33c83cfee3b15b66160db77eb11e0666e88fc98749918d2208857a72ec5a4edee20a41fcc0
SSDEEP 3072:zCiyiukvvVHC6++uq3eqW14k/EyK9fq4nzrecrS2aozwL9:sknVuOGK9fqpcr0X9
TLSH
T1D6D3E142A7E44207F9FB0F30B6F586521A7CABD37D30C61F1985B49A1D637808A21B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svghost.exe

Path C:\Windows\svghost.exe
Size 81KB
SHA256 21fad7bdcb08823c874a8a9cf796c91691ecdf505282cdce79d8638fdf4fd2d1
MD5 ef3ba6bce00de0d4a3f0080c5cd32f72
SHA1 f9e806ef7b37d93a216c4d6f54f4186753c6deaa
SHA512 35cc4cb940161afd55d08b07b7364ae3ebf3b34562921f8626ad7591f7a1e7f5488ec6e7686d91e5f11a5b0c8e87829251bf7b3d1961ea8f55fd8846a95a8e6f
SSDEEP 1536:oA1V5CfA/L3WiukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IAx:TCiyiukvvVHC6++uq3eqW14k/EyK9faO
TLSH
T14E83026B2743700AD6A251347B5F27E5917D09B3EFBC934E4F82509D1B8A3296D22F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1932-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1932-9-0x0000000000427000-0x000000000043A000-memory.dmp

Download

memory/1932-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1932-1-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1932-2-0x0000000000427000-0x000000000043A000-memory.dmp

Download

memory/6424-23-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/6424-12-0x0000000000400000-0x000000000043C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads