Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 20:02
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe
- Size 717KB
- Sample260809-yr75msvelc
- SHA256 3be4fac3209e11e55b0a243a4e74c196baedac8a0c1f66993385272b0e87284e
- MD5 1f224b8dd1a9fbb440e7c5da56415e51
- SHA1 8e507e3061969a7751534ad43dfff40c8bd026a6
- SHA512 8e1019355762ac59383d0e3a745980bc5f23d0ffaee4ab81827ddcc812d1c411b7c76d0a9aa9401d5a9f945bbd52213dd8dd73e9cd3b9fbde13daac005d5e0c7
- SSDEEP 12288:CwFF2V+FF23mw5HEjsChNVBFgl0W80OVLLpc6WWLkrcYc54:CwFF2V+FF2WwukOWJOVLLpc7ckPcu
- TLSH T123F439B1459F3DD5D6E681F4814272FA9E6177333DB0FEDAE1D1924D3B2AAA44808332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 1 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/2076-409-0x0000000000400000-0x000000000040B000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral1/memory/2076-0-0x0000000000400000-0x000000000040B000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral1/files/0x000a0000000004e9-2.dat INDICATOR_EXE_Packed_eXPressor behavioral1/files/0x0005000000021850-6.dat INDICATOR_EXE_Packed_eXPressor behavioral1/memory/2076-409-0x0000000000400000-0x000000000040B000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (2559) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Input.Manipulations.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_100_percent.pak.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\nl.pak.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Windows.Forms.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\WindowsFormsIntegration.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\UIAutomationClient.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2076
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-204488895-2999877624-296153668-1000\desktop.ini.tmp
- Size 717KB
- SHA256 860c43883d2287f31cecde1f7864a910e2a03a81d3f760dc3731f6ed9fd1daf2
- MD5 5d125a7e41e607d6e34b46704ad260e2
- SHA1 b1a6db247a08fcaaab72182b0e6057ce2d3c9402
- SHA512 680a095f9d1b39d8d5483650cb99c92bd262e0ca8dd8d66228a6ae1acff2e576cf166a4929368fe65e57aa96885d66391de7f9d633cb69f73ae0391ecdd15a5c
- SSDEEP 12288:CwFF2V+FF23mw5HEjsChNVBFgl0W80OVLLpc6WWLkrcYc5H:CwFF2V+FF2WwukOWJOVLLpc7ckPcl
- TLSH T1ADF439B1459F3DD5D6E681F4814272FA9E6177333DB0FEDAE1D1924D3B2AAA44808332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 816KB
- SHA256 872c2e2f4ff79c93c79640afcf59a88ba6da8dc07c8a7a9dc6a6b4f7e115285f
- MD5 2f74e943f00b53e2a8c4aef8d4e66c7f
- SHA1 d95d84f25dcc445868282164b851d1d3e5bb866c
- SHA512 e4800c1944ebaaf72bceebb58f5d7ce39cdd7cd9db6404409abc55bcb043b368266fc8fc8ba075498bba47181b007784a666dcb63d9ac02f6f4beebebed85e64
- SSDEEP 24576:CwFF2V+FF2WwukOWJOVLLpc7ckPcoMfSgWD:CwFg+Fbw7OVd4dMa
- TLSH T1BE0539B0599F7DD5C6E281F8840376F68A5177333DB4FEDAE1D1928D3B29AA40809372
- MD5 SHA1 SHA512 SSDEEP TLSH