cee99bf5088a10b3100b2dda0508fd632be57fc85e4336e8b2ff5d1759a44b95

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_0d35f43aaed95d0e9ef326f8f6878a6a_icedid_njrat_vidar.exe
Size 1.5MB
Sample260730-zb32eswhrf
SHA256 cee99bf5088a10b3100b2dda0508fd632be57fc85e4336e8b2ff5d1759a44b95
MD5 0d35f43aaed95d0e9ef326f8f6878a6a
SHA1 cb575101e0c8f7651d759e50690677d3b7121111
SHA512 62a09af969201010202737315422a43e4e4ff9459204c6c271d233dca781d6ab869e4738ca8cb4eb81f2eda67259849558129a4099eb04309af94d7208f53030
SSDEEP 24576:P4F1MNyK+MzFEaY8ERgvkNW7BG5hiCbznhQp:61MNywFffERgvkNyI5hLzh
TLSH
T1B7657C4B739482F8E177D278C9434E8AE6B278055A35D75F03A447AE2F233618E7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1308	unst1785443622434-copied.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1308	1240	2026-07-30_0d35f43aaed95d0e9ef326f8f6878a6a_icedid_njrat_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_0d35f43aaed95d0e9ef326f8f6878a6a_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_0d35f43aaed95d0e9ef326f8f6878a6a_icedid_njrat_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\Temp\unst1785443622434-copied.exe
  "C:\Users\Admin\AppData\Local\Temp\unst1785443622434-copied.exe" --source_path="C:\Users\Admin\AppData\Local\Temp\2026-07-30_0d35f43aaed95d0e9ef326f8f6878a6a_icedid_njrat_vidar.exe"
  2⤵
  - Executes dropped EXE
  PID:1308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Feishu-uninstaller-2026-07-30.log

Path C:\Users\Admin\AppData\Local\Temp\LarkShell\sdk_storage\log\Feishu-uninstaller-2026-07-30.log
Size 1KB
SHA256 115102709c2d2af43324e9a7460327d3f47e59c5119f70545030485f2145fbdc
MD5 ce12c4666802be31bda21c4200eb1e55
SHA1 4f66b3275d34ffb8ff6f1167761f6794a1c171e7
SHA512 998f7088bdedbf8781dfa89864557d523488f4c00af8c2b6a35d841d8f8bd20072f0411923d24d899218aaec1e22e256ec5713b990e9bf12e054dc02e8600193
TLSH
T16A21E9C31C6464B0394EC1297E132C9DCDE5EA7A8DA8A60433BA0664D7CB91E661E639
MD5 SHA1 SHA512 TLSH

Submit Download

unst1785443622434-copied.exe

Path C:\Users\Admin\AppData\Local\Temp\unst1785443622434-copied.exe
Size 1.5MB
SHA256 cee99bf5088a10b3100b2dda0508fd632be57fc85e4336e8b2ff5d1759a44b95
MD5 0d35f43aaed95d0e9ef326f8f6878a6a
SHA1 cb575101e0c8f7651d759e50690677d3b7121111
SHA512 62a09af969201010202737315422a43e4e4ff9459204c6c271d233dca781d6ab869e4738ca8cb4eb81f2eda67259849558129a4099eb04309af94d7208f53030
SSDEEP 24576:P4F1MNyK+MzFEaY8ERgvkNW7BG5hiCbznhQp:61MNywFffERgvkNyI5hLzh
TLSH
T1B7657C4B739482F8E177D278C9434E8AE6B278055A35D75F03A447AE2F233618E7E321
MD5 SHA1 SHA512 SSDEEP TLSH