Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/08/2026, 13:04
General
- Target 2026-08-05_a534ba03022d8315afc39709c0a5dc9b_icedid_vidar.exe
- Size 1.3MB
- Sample260805-qa5desswdy
- SHA256 17cd8d35f21adfa6e3282e658cd840d5401c2c171c1601f7fabdc6fb827b573a
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_a534ba03022d8315afc39709c0a5dc9b_icedid_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_a534ba03022d8315afc39709c0a5dc9b_icedid_vidar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 2 & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-08-05_a534ba03022d8315afc39709c0a5dc9b_icedid_vidar.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1728-81-0x00000261F3FC0000-0x00000261F3FC1000-memory.dmp
memory/5540-1-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-23-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-18-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-21-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-22-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-30-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-38-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-43-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-41-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-39-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-37-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-40-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-33-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-32-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-31-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-29-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-28-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-27-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-36-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-35-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-20-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-17-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-16-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-15-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-14-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-26-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-12-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-9-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-2-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-25-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-4-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-11-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-10-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-8-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-7-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-6-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-5-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-0-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-13-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-3-0x000000014000A000-0x0000000140011000-memory.dmp
memory/5540-45-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-44-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-46-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-48-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-47-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-50-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-53-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-51-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-54-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-55-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-57-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-58-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-59-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-60-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-64-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-66-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-67-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-68-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-65-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-63-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-62-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-61-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-56-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-52-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-49-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-69-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-71-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-72-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-73-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-75-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-77-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-78-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-76-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-80-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-79-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-82-0x0000000140103000-0x000000014010A000-memory.dmp
memory/5540-74-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-70-0x0000000140000000-0x000000014014F000-memory.dmp
memory/5540-83-0x0000000140000000-0x000000014014F000-memory.dmp