Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
04/08/2026, 12:42
General
- Target 2026-08-03_285f01576a441bc231db2958b9b55ce5_icedid_vidar.exe
- Size 689KB
- Sample260804-pxnthsbb37
- SHA256 dfe15f90757f3982141ff98bb525761fa5b90f3576cecc2b49ceaff6c3de9ca1
Malware Config
Signatures
- Executes dropped EXE 6 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 6 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 1 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_285f01576a441bc231db2958b9b55ce5_icedid_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_285f01576a441bc231db2958b9b55ce5_icedid_vidar.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
GameInputSvc.exe
alg.exe
msdtc.exe
PerceptionSimulationService.exe
memory/1244-57-0x000001A652A20000-0x000001A652A86000-memory.dmp
memory/1244-55-0x000001A6527C0000-0x000001A6528F3000-memory.dmp
memory/1244-56-0x000001A652A20000-0x000001A652A86000-memory.dmp
memory/1768-61-0x00007FF6568A0000-0x00007FF6569C3000-memory.dmp
memory/1768-13-0x00000215EDB30000-0x00000215EDB96000-memory.dmp
memory/1768-14-0x00000215EDB30000-0x00000215EDB96000-memory.dmp
memory/1768-12-0x00000215EDB30000-0x00000215EDB96000-memory.dmp
memory/1768-11-0x00007FF6568A0000-0x00007FF6569C3000-memory.dmp
memory/2404-34-0x000001749B160000-0x000001749B293000-memory.dmp
memory/2404-35-0x000001749B3C0000-0x000001749B426000-memory.dmp
memory/2404-36-0x000001749B3C0000-0x000001749B426000-memory.dmp
memory/2404-37-0x000001749B3C0000-0x000001749B426000-memory.dmp
memory/3224-44-0x00007FF715CB0000-0x00007FF715E18000-memory.dmp
memory/3224-45-0x0000020AF7970000-0x0000020AF79D6000-memory.dmp
memory/3224-43-0x0000020AF7970000-0x0000020AF79D6000-memory.dmp
memory/3224-50-0x0000020AF7970000-0x0000020AF79D6000-memory.dmp
memory/3224-52-0x00007FF715CB0000-0x00007FF715E18000-memory.dmp
memory/3532-263-0x000001E99BEA0000-0x000001E99BF06000-memory.dmp
memory/3532-261-0x00007FF688220000-0x00007FF68836A000-memory.dmp
memory/3536-3-0x000001FF28F30000-0x000001FF28F96000-memory.dmp
memory/3536-2-0x000001FF28F30000-0x000001FF28F96000-memory.dmp
memory/3536-22-0x00007FF669810000-0x00007FF6698FA000-memory.dmp
memory/3536-19-0x000001FF28F30000-0x000001FF28F96000-memory.dmp
memory/3536-0-0x00007FF669810000-0x00007FF6698FA000-memory.dmp
memory/3536-1-0x000001FF28F30000-0x000001FF28F96000-memory.dmp
memory/4808-249-0x00007FF792CE0000-0x00007FF792DFA000-memory.dmp
memory/4808-250-0x000002A312840000-0x000002A3128A6000-memory.dmp
memory/4808-251-0x000002A312840000-0x000002A3128A6000-memory.dmp
memory/5344-241-0x00007FF643380000-0x00007FF643449000-memory.dmp
memory/5344-243-0x000002614AE20000-0x000002614AE86000-memory.dmp
memory/5344-242-0x000002614AE20000-0x000002614AE86000-memory.dmp
memory/5388-27-0x000002801E610000-0x000002801E676000-memory.dmp
memory/5388-26-0x000002801E610000-0x000002801E676000-memory.dmp
memory/5388-28-0x000002801E610000-0x000002801E676000-memory.dmp
memory/5388-25-0x000002801E3E0000-0x000002801E513000-memory.dmp
memory/5416-234-0x000001F5AA5B0000-0x000001F5AA616000-memory.dmp
memory/5416-232-0x00007FF643380000-0x00007FF643449000-memory.dmp
memory/5416-233-0x000001F5AA5B0000-0x000001F5AA616000-memory.dmp