Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 03:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe
- Size 1.6MB
- Sample260730-d1lyjsbb35
- SHA256 0c6f67307c82af53e51375c49343527c6ee0da5d2fdc92c09ad3f09a75352e6c
- MD5 57206a273486e92a934f61644ea25c40
- SHA1 3a225fd109d0d5a63d5417ab3cc6dfc3b50b87ea
- SHA512 91af585843a42143812ada69a725537c5c5387c7883491770c6fe51121ddfce44a04bc4dfc8db6080081bc568c682a94eb39c5dd3711ab2c20fa30afae0aa298
- SSDEEP 24576:bFftX+xrV01dRWsqjnhMgeiCl7G0nehbGZpbD:FGV016Dmg27RnWGj
- TLSH T1EC85D05A735849F5D067817CCA53860AE77278141B61DBCB12A8E3BE2F335D09E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Modifies registry class 41 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHDCPSvc.EXE 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\LocalServer32 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\TypeLib\ = "{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\HELPDIR 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ProxyStubClsid32 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib\Version = "1.0" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\FLAGS 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib\ = "{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib\ = "{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\Programmable 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\FLAGS\ = "0" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB}\ = "IntelCpHDCPSvc" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHDCPSvc.EXE\AppID = "{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB}" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D} 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\ = "CLSPCONSvcCOMChannel Class" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib\Version = "1.0" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38} 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ = "ILSPCONSvcCOMChannel" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB} 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\AppID = "{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB}" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\Version 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB}\LocalService = "cplspcon" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB}\LaunchPermission = 010014806400000074000000140000003000000002001c000100000011001400040000000101000000000010001000000200340002000000000014000b000000010100000000000100000000000018000b000000010200000000000f02000000010000000102000000000005200000002002000001020000000000052000000020020000 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe\"" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\Version\ = "1.0" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\0 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ProxyStubClsid32 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3} 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\TypeLib 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\ = "IntelCpLSPCONSvcLib" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\0\win64 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ = "ILSPCONSvcCOMChannel" 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3} 2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar.exe