Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 18:40
General
- Target 2026-08-08_fbead0dcbff96b20e256c20e5acf3132_icedid_njrat_vidar.exe
- Size 2.9MB
- Sample260808-xbg3vasfrf
- SHA256 08292a8a5a591f1c60a9738797b7fd5e2defbb0afaeb65bbeb3d93d3e1e54b31
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_fbead0dcbff96b20e256c20e5acf3132_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_fbead0dcbff96b20e256c20e5acf3132_icedid_njrat_vidar.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
AutoHotkey.MemoryModule.temp.manifest
memory/3832-0-0x00000001400E9000-0x00000001400EA000-memory.dmp
memory/3832-1-0x0000000180000000-0x0000000180263000-memory.dmp
memory/3832-15-0x0000000001230000-0x00000000012F7000-memory.dmp
memory/3832-25-0x0000000180000000-0x000000018016D000-memory.dmp
memory/3832-31-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-33-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-32-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-34-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-35-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-39-0x0000000005BC0000-0x0000000005D2D000-memory.dmp
memory/3832-45-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-46-0x00000001400E9000-0x00000001400EA000-memory.dmp
memory/3832-47-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-48-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-49-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-50-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-51-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-53-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-52-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-54-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-58-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-59-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-60-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-61-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-62-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-63-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-64-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-66-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-68-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-67-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-69-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-65-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-70-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-72-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-71-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-73-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-74-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-75-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-76-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-77-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-78-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-79-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-80-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-81-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-82-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-84-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-83-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-85-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-86-0x0000000140000000-0x00000001402FA000-memory.dmp
memory/3832-87-0x0000000140000000-0x00000001402FA000-memory.dmp