Analysis
- max time kernel
145s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 15:56
General
- Target 2026-07-30_0a985de9d0ffbf6003bb8ae0c50d2615_icedid_njrat_vidar.exe
- Size 938KB
- Sample260730-tdtymsvxhv
- SHA256 c58cda15b1146d34794615d839a153047f2c106e90ebdc9eb8518d221361ce13
Malware Config
Signatures
- Executes dropped EXE 19 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 24 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 21 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_0a985de9d0ffbf6003bb8ae0c50d2615_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_0a985de9d0ffbf6003bb8ae0c50d2615_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/1516-329-0x000001BB6A7A0000-0x000001BB6A806000-memory.dmp
memory/1516-328-0x000001BB6A7A0000-0x000001BB6A806000-memory.dmp
memory/1516-327-0x00007FF667750000-0x00007FF6678E4000-memory.dmp
memory/1928-26-0x00000290046C0000-0x0000029004726000-memory.dmp
memory/1928-24-0x00000290043F0000-0x0000029004544000-memory.dmp
memory/1928-27-0x00000290046C0000-0x0000029004726000-memory.dmp
memory/1928-25-0x00000290046C0000-0x0000029004726000-memory.dmp
memory/1968-344-0x00007FF652830000-0x00007FF652B50000-memory.dmp
memory/1968-342-0x00000240ADA80000-0x00000240ADAE6000-memory.dmp
memory/1968-338-0x00000240ADA80000-0x00000240ADAE6000-memory.dmp
memory/1968-337-0x00000240ADA80000-0x00000240ADAE6000-memory.dmp
memory/1976-371-0x00007FF7A0F60000-0x00007FF7A1376000-memory.dmp
memory/1976-298-0x000001D5B1BE0000-0x000001D5B1C46000-memory.dmp
memory/1976-297-0x00007FF7A0F60000-0x00007FF7A1376000-memory.dmp
memory/1976-299-0x000001D5B1BE0000-0x000001D5B1C46000-memory.dmp
memory/2116-319-0x0000021C5C3F0000-0x0000021C5C456000-memory.dmp
memory/2116-318-0x00007FF7D2AD0000-0x00007FF7D2D72000-memory.dmp
memory/2116-376-0x00007FF7D2AD0000-0x00007FF7D2D72000-memory.dmp
memory/2116-320-0x0000021C5C3F0000-0x0000021C5C456000-memory.dmp
memory/2200-310-0x000002081D4E0000-0x000002081D546000-memory.dmp
memory/2200-309-0x000002081D4E0000-0x000002081D546000-memory.dmp
memory/2200-308-0x00007FF618150000-0x00007FF618203000-memory.dmp
memory/2200-372-0x00007FF618150000-0x00007FF618203000-memory.dmp
memory/2308-48-0x00000235A8550000-0x00000235A85B6000-memory.dmp
memory/2308-42-0x00000235A8550000-0x00000235A85B6000-memory.dmp
memory/2308-43-0x00000235A8550000-0x00000235A85B6000-memory.dmp
memory/2308-41-0x00007FF6095B0000-0x00007FF609717000-memory.dmp
memory/2308-50-0x00007FF6095B0000-0x00007FF609717000-memory.dmp
memory/3204-282-0x00007FF6ED4A0000-0x00007FF6EDBE3000-memory.dmp
memory/3204-360-0x00007FF6ED4A0000-0x00007FF6EDBE3000-memory.dmp
memory/3204-281-0x000001C9C0380000-0x000001C9C03E6000-memory.dmp
memory/3204-280-0x000001C9C0380000-0x000001C9C03E6000-memory.dmp
memory/3320-326-0x00007FF633380000-0x00007FF633499000-memory.dmp
memory/3320-247-0x00007FF633380000-0x00007FF633499000-memory.dmp
memory/3320-248-0x00000178C78A0000-0x00000178C7906000-memory.dmp
memory/3320-249-0x00000178C78A0000-0x00000178C7906000-memory.dmp
memory/3444-288-0x00007FF67CB00000-0x00007FF67CBAD000-memory.dmp
memory/3444-290-0x000002404C5F0000-0x000002404C656000-memory.dmp
memory/3444-362-0x00007FF67CB00000-0x00007FF67CBAD000-memory.dmp
memory/3444-289-0x000002404C5F0000-0x000002404C656000-memory.dmp
memory/3476-240-0x000001DAEE870000-0x000001DAEE8D6000-memory.dmp
memory/3476-316-0x00007FF6BD8D0000-0x00007FF6BD998000-memory.dmp
memory/3476-241-0x000001DAEE870000-0x000001DAEE8D6000-memory.dmp
memory/3476-239-0x00007FF6BD8D0000-0x00007FF6BD998000-memory.dmp
memory/3824-33-0x00000274EE1E0000-0x00000274EE334000-memory.dmp
memory/3824-34-0x00000274EE460000-0x00000274EE4C6000-memory.dmp
memory/3824-35-0x00000274EE460000-0x00000274EE4C6000-memory.dmp
memory/4732-378-0x000001F6D7310000-0x000001F6D7376000-memory.dmp
memory/4732-377-0x00007FF732310000-0x00007FF73243E000-memory.dmp
memory/4732-379-0x000001F6D7310000-0x000001F6D7376000-memory.dmp
memory/4772-347-0x00007FF7330B0000-0x00007FF73333A000-memory.dmp
memory/4772-348-0x0000019FA1B60000-0x0000019FA1BC6000-memory.dmp
memory/4772-349-0x0000019FA1B60000-0x0000019FA1BC6000-memory.dmp
memory/4908-355-0x000001F6A9670000-0x000001F6A96D6000-memory.dmp
memory/4908-361-0x00007FF621A50000-0x00007FF621F20000-memory.dmp
memory/4908-356-0x000001F6A9670000-0x000001F6A96D6000-memory.dmp
memory/4980-11-0x00007FF658A90000-0x00007FF658BB2000-memory.dmp
memory/4980-14-0x0000016D26510000-0x0000016D26576000-memory.dmp
memory/4980-12-0x0000016D26510000-0x0000016D26576000-memory.dmp
memory/4980-59-0x00007FF658A90000-0x00007FF658BB2000-memory.dmp
memory/4980-13-0x0000016D26510000-0x0000016D26576000-memory.dmp
memory/5624-274-0x0000000000900000-0x0000000000969000-memory.dmp
memory/5624-269-0x0000000000900000-0x0000000000969000-memory.dmp
memory/5624-336-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/5624-268-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/5716-19-0x0000024FE1E40000-0x0000024FE1EA6000-memory.dmp
memory/5716-3-0x0000024FE1E40000-0x0000024FE1EA6000-memory.dmp
memory/5716-259-0x00007FF6D44D0000-0x00007FF6D4619000-memory.dmp
memory/5716-0-0x0000024FE1D40000-0x0000024FE1E38000-memory.dmp
memory/5716-261-0x00000204F7B20000-0x00000204F7B86000-memory.dmp
memory/5716-262-0x00000204F7B20000-0x00000204F7B86000-memory.dmp
memory/5716-1-0x0000024FE1E40000-0x0000024FE1EA6000-memory.dmp
memory/5716-333-0x00007FF6D44D0000-0x00007FF6D4619000-memory.dmp
memory/5784-231-0x00000237E9150000-0x00000237E91B6000-memory.dmp
memory/5784-307-0x00007FF6BD8D0000-0x00007FF6BD998000-memory.dmp
memory/5784-232-0x00000237E9150000-0x00000237E91B6000-memory.dmp
memory/5784-230-0x00007FF6BD8D0000-0x00007FF6BD998000-memory.dmp
memory/5996-366-0x00000176D16A0000-0x00000176D1706000-memory.dmp
memory/5996-367-0x00000176D16A0000-0x00000176D1706000-memory.dmp
memory/5996-365-0x00007FF72B330000-0x00007FF72B836000-memory.dmp
memory/6052-55-0x000001B4000D0000-0x000001B400136000-memory.dmp
memory/6052-54-0x000001B4000D0000-0x000001B400136000-memory.dmp
memory/6052-53-0x000001B47FDD0000-0x000001B47FF24000-memory.dmp