cee99bf5088a10b3100b2dda0508fd632be57fc85e4336e8b2ff5d1759a44b95

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_0d35f43aaed95d0e9ef326f8f6878a6a_icedid_njrat_vidar.exe
Size 1.5MB
Sample260730-zb32eswhrf
SHA256 cee99bf5088a10b3100b2dda0508fd632be57fc85e4336e8b2ff5d1759a44b95
MD5 0d35f43aaed95d0e9ef326f8f6878a6a
SHA1 cb575101e0c8f7651d759e50690677d3b7121111
SHA512 62a09af969201010202737315422a43e4e4ff9459204c6c271d233dca781d6ab869e4738ca8cb4eb81f2eda67259849558129a4099eb04309af94d7208f53030
SSDEEP 24576:P4F1MNyK+MzFEaY8ERgvkNW7BG5hiCbznhQp:61MNywFffERgvkNyI5hLzh
TLSH
T1B7657C4B739482F8E177D278C9434E8AE6B278055A35D75F03A447AE2F233618E7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-07-30_0d35f43aaed95d0e9ef326f8f6878a6a_icedid_njrat_vidar.exe

Executes dropped EXE 1 IoCs

pid	Process
2220	unst1785443621431-copied.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 2220	4772	2026-07-30_0d35f43aaed95d0e9ef326f8f6878a6a_icedid_njrat_vidar.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-30_0d35f43aaed95d0e9ef326f8f6878a6a_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_0d35f43aaed95d0e9ef326f8f6878a6a_icedid_njrat_vidar.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\unst1785443621431-copied.exe
  "C:\Users\Admin\AppData\Local\Temp\unst1785443621431-copied.exe" --source_path="C:\Users\Admin\AppData\Local\Temp\2026-07-30_0d35f43aaed95d0e9ef326f8f6878a6a_icedid_njrat_vidar.exe"
  2⤵
  - Executes dropped EXE
  PID:2220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Feishu-uninstaller-2026-07-30.log

Path C:\Users\Admin\AppData\Local\Temp\LarkShell\sdk_storage\log\Feishu-uninstaller-2026-07-30.log
Size 1KB
SHA256 f4570b23b96d4f7b1f792ca8a6f72947ac8d3d833c407e1253445e79f7afd1d6
MD5 3c2b88e1e3557934c8ee3f80513e8ac4
SHA1 b0dd99609d47d292247b4710759c062e906d1f2a
SHA512 ed957baf11aabd840ac257f7c6e4367a73dfaa306b90305d34e1f844cdfbbc698b9b1fd76e5da160f5b008f80ec367ad14f0a0d45e5cb1b365d8fa68e8bd9d61
TLSH
T1E621D6C30C5464B03A0EC52A7E463CDED9F5E67A5DC9AA00237B0E54CB87A1A626F138
MD5 SHA1 SHA512 TLSH

Submit Download

unst1785443621431-copied.exe

Path C:\Users\Admin\AppData\Local\Temp\unst1785443621431-copied.exe
Size 1.5MB
SHA256 cee99bf5088a10b3100b2dda0508fd632be57fc85e4336e8b2ff5d1759a44b95
MD5 0d35f43aaed95d0e9ef326f8f6878a6a
SHA1 cb575101e0c8f7651d759e50690677d3b7121111
SHA512 62a09af969201010202737315422a43e4e4ff9459204c6c271d233dca781d6ab869e4738ca8cb4eb81f2eda67259849558129a4099eb04309af94d7208f53030
SSDEEP 24576:P4F1MNyK+MzFEaY8ERgvkNW7BG5hiCbznhQp:61MNywFffERgvkNyI5hLzh
TLSH
T1B7657C4B739482F8E177D278C9434E8AE6B278055A35D75F03A447AE2F233618E7E321
MD5 SHA1 SHA512 SSDEEP TLSH