Analysis
- max time kernel
140s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
06/08/2026, 01:56
General
- Target 2026-08-06_0d1d467c72c985d0273e54745c21d58b_cobalt-strike_icedid_njrat_vidar.exe
- Size 840KB
- Sample260806-ccry8a1eqd
- SHA256 a53f5655022c64f3d5ebf3bf30505e654f31b847d337b86d233998a52d82b445
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 25 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 17 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_0d1d467c72c985d0273e54745c21d58b_cobalt-strike_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_0d1d467c72c985d0273e54745c21d58b_cobalt-strike_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 9042⤵
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
AppVShNotify.exe
IntegratedOffice.exe
MavInject32.exe
OfficeC2RClient.exe
appvcleaner.exe
LICLUA.EXE
OSE.EXE
VSTOInstaller.exe
chrmstp.exe
setup.exe
chrome_pwa_launcher.exe
elevated_tracing_service.exe
elevation_service.exe
notification_helper.exe
os_update_handler.exe
chrome_proxy.exe
appletviewer.exe
extcheck.exe
idlj.exe
jabswitch.exe
jar.exe
jarsigner.exe
java-rmi.exe
java.exe
javac.exe
javadoc.exe
javafxpackager.exe
javah.exe
javap.exe
javapackager.exe
javaw.exe
javaws.exe
jcmd.exe
jconsole.exe
jdb.exe
jdeps.exe
dotnet.exe
perfhost.exe
AgentService.exe
DiagnosticsHub.StandardCollector.Service.exe
FXSSVC.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
SearchIndexer.exe
SensorDataService.exe
Spectrum.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/544-265-0x000002C78DE30000-0x000002C78DE96000-memory.dmp
memory/544-260-0x00007FF7704F0000-0x00007FF7705DA000-memory.dmp
memory/544-349-0x00007FF7704F0000-0x00007FF7705DA000-memory.dmp
memory/544-264-0x000002C78DE30000-0x000002C78DE96000-memory.dmp
memory/644-318-0x0000023775110000-0x0000023775176000-memory.dmp
memory/644-319-0x0000023775110000-0x0000023775176000-memory.dmp
memory/644-317-0x00007FF6AC5C0000-0x00007FF6AC7AF000-memory.dmp
memory/644-426-0x00007FF6AC5C0000-0x00007FF6AC7AF000-memory.dmp
memory/776-362-0x00007FF666200000-0x00007FF66672B000-memory.dmp
memory/776-470-0x00007FF666200000-0x00007FF66672B000-memory.dmp
memory/776-359-0x00000195D1850000-0x00000195D18B6000-memory.dmp
memory/776-360-0x00000195D1850000-0x00000195D18B6000-memory.dmp
memory/916-54-0x000002AC5FFD0000-0x000002AC600F7000-memory.dmp
memory/916-56-0x000002AC5FF50000-0x000002AC5FFB6000-memory.dmp
memory/916-55-0x000002AC5FF50000-0x000002AC5FFB6000-memory.dmp
memory/1088-21-0x00007FF714FE0000-0x00007FF71513F000-memory.dmp
memory/1088-1-0x000001E8FED40000-0x000001E8FEDA6000-memory.dmp
memory/1088-18-0x000001E8FED40000-0x000001E8FEDA6000-memory.dmp
memory/1088-0-0x000001E8FED40000-0x000001E8FEDA6000-memory.dmp
memory/1088-2-0x00007FF714FE0000-0x00007FF71513F000-memory.dmp
memory/1464-325-0x00007FF6D8EB0000-0x00007FF6D8F94000-memory.dmp
memory/1464-232-0x0000022E6AC30000-0x0000022E6AC96000-memory.dmp
memory/1464-233-0x0000022E6AC30000-0x0000022E6AC96000-memory.dmp
memory/1464-231-0x00007FF6D8EB0000-0x00007FF6D8F94000-memory.dmp
memory/1808-25-0x000001ECEB4D0000-0x000001ECEB536000-memory.dmp
memory/1808-24-0x000001ECEB280000-0x000001ECEB3A7000-memory.dmp
memory/1808-27-0x000001ECEB4D0000-0x000001ECEB536000-memory.dmp
memory/1856-352-0x00007FF730190000-0x00007FF73066D000-memory.dmp
memory/1856-351-0x000001FDFB4C0000-0x000001FDFB526000-memory.dmp
memory/1856-467-0x00007FF730190000-0x00007FF73066D000-memory.dmp
memory/1856-350-0x000001FDFB4C0000-0x000001FDFB526000-memory.dmp
memory/2136-361-0x00007FF624BC0000-0x00007FF624C68000-memory.dmp
memory/2136-284-0x0000014AD46A0000-0x0000014AD4706000-memory.dmp
memory/2136-285-0x0000014AD46A0000-0x0000014AD4706000-memory.dmp
memory/2136-283-0x00007FF624BC0000-0x00007FF624C68000-memory.dmp
memory/2488-301-0x0000013CB7550000-0x0000013CB75B6000-memory.dmp
memory/2488-376-0x00007FF656540000-0x00007FF6565EB000-memory.dmp
memory/2488-300-0x00007FF656540000-0x00007FF6565EB000-memory.dmp
memory/2488-302-0x0000013CB7550000-0x0000013CB75B6000-memory.dmp
memory/2492-33-0x00000145D7600000-0x00000145D7727000-memory.dmp
memory/2492-34-0x00000145D7800000-0x00000145D7866000-memory.dmp
memory/2492-36-0x00000145D7800000-0x00000145D7866000-memory.dmp
memory/2492-35-0x00000145D7800000-0x00000145D7866000-memory.dmp
memory/2716-291-0x0000020EE81B0000-0x0000020EE8216000-memory.dmp
memory/2716-447-0x0000020EE81B0000-0x0000020EE8216000-memory.dmp
memory/2716-449-0x00007FF690EB0000-0x00007FF69131D000-memory.dmp
memory/2716-292-0x00007FF690EB0000-0x00007FF69131D000-memory.dmp
memory/2716-369-0x00007FF690EB0000-0x00007FF69131D000-memory.dmp
memory/2716-293-0x0000020EE81B0000-0x0000020EE8216000-memory.dmp
memory/3300-11-0x0000024F8EB40000-0x0000024F8EBA6000-memory.dmp
memory/3300-13-0x0000024F8EB40000-0x0000024F8EBA6000-memory.dmp
memory/3300-60-0x00007FF78C500000-0x00007FF78C5E7000-memory.dmp
memory/3300-10-0x00007FF78C500000-0x00007FF78C5E7000-memory.dmp
memory/3416-51-0x00007FF71A8F0000-0x00007FF71AA58000-memory.dmp
memory/3416-49-0x00000191A0DB0000-0x00000191A0E16000-memory.dmp
memory/3416-43-0x00000191A0DB0000-0x00000191A0E16000-memory.dmp
memory/3416-44-0x00000191A0DB0000-0x00000191A0E16000-memory.dmp
memory/3416-42-0x00007FF71A8F0000-0x00007FF71AA58000-memory.dmp
memory/3828-435-0x00007FF6E52C0000-0x00007FF6E544F000-memory.dmp
memory/3828-331-0x00007FF6E52C0000-0x00007FF6E544F000-memory.dmp
memory/3828-327-0x0000020352BF0000-0x0000020352C56000-memory.dmp
memory/3828-326-0x0000020352BF0000-0x0000020352C56000-memory.dmp
memory/4168-356-0x0000000000400000-0x000000000054A000-memory.dmp
memory/4168-277-0x00000000006D0000-0x0000000000739000-memory.dmp
memory/4168-272-0x00000000006D0000-0x0000000000739000-memory.dmp
memory/4168-271-0x0000000000400000-0x000000000054A000-memory.dmp
memory/4372-468-0x00000156D2100000-0x00000156D2108000-memory.dmp
memory/4372-419-0x00000156D0A90000-0x00000156D0A98000-memory.dmp
memory/4372-382-0x00007FF7E9420000-0x00007FF7E9774000-memory.dmp
memory/4372-387-0x00000156C84A0000-0x00000156C84B0000-memory.dmp
memory/4372-403-0x00000156C86D0000-0x00000156C86E0000-memory.dmp
memory/4372-380-0x00000156C7360000-0x00000156C73C6000-memory.dmp
memory/4372-379-0x00000156C7360000-0x00000156C73C6000-memory.dmp
memory/4460-246-0x0000028DAC980000-0x0000028DAC9E6000-memory.dmp
memory/4460-240-0x0000028DAC980000-0x0000028DAC9E6000-memory.dmp
memory/4460-248-0x00007FF65BDD0000-0x00007FF65C058000-memory.dmp
memory/4460-239-0x00007FF65BDD0000-0x00007FF65C058000-memory.dmp
memory/4460-241-0x0000028DAC980000-0x0000028DAC9E6000-memory.dmp
memory/4476-310-0x000001B652390000-0x000001B6523F6000-memory.dmp
memory/4476-309-0x00007FF7D3FF0000-0x00007FF7D4314000-memory.dmp
memory/4476-308-0x000001B652390000-0x000001B6523F6000-memory.dmp
memory/4476-381-0x00007FF7D3FF0000-0x00007FF7D4314000-memory.dmp
memory/4580-466-0x00007FF6A0540000-0x00007FF6A07FE000-memory.dmp
memory/4580-346-0x00007FF6A0540000-0x00007FF6A07FE000-memory.dmp
memory/4648-471-0x00007FF6682C0000-0x00007FF6683FB000-memory.dmp
memory/4648-371-0x00007FF6682C0000-0x00007FF6683FB000-memory.dmp
memory/4648-370-0x000001D8FF880000-0x000001D8FF8E6000-memory.dmp
memory/4648-368-0x000001D8FF880000-0x000001D8FF8E6000-memory.dmp
memory/4864-252-0x000001B60C930000-0x000001B60C996000-memory.dmp
memory/4864-253-0x000001B60C930000-0x000001B60C996000-memory.dmp
memory/4864-251-0x00007FF7DBB80000-0x00007FF7DBC94000-memory.dmp
memory/4864-345-0x00007FF7DBB80000-0x00007FF7DBC94000-memory.dmp
memory/4920-335-0x00007FF7DEBD0000-0x00007FF7DEFF9000-memory.dmp
memory/4920-334-0x0000025F971D0000-0x0000025F97236000-memory.dmp
memory/4920-336-0x0000025F971D0000-0x0000025F97236000-memory.dmp
memory/4920-342-0x00007FF7DEBD0000-0x00007FF7DEFF9000-memory.dmp
memory/4920-340-0x0000025F971D0000-0x0000025F97236000-memory.dmp