Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 20:02
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe
- Size 717KB
- Sample260809-yr75msvelc
- SHA256 3be4fac3209e11e55b0a243a4e74c196baedac8a0c1f66993385272b0e87284e
- MD5 1f224b8dd1a9fbb440e7c5da56415e51
- SHA1 8e507e3061969a7751534ad43dfff40c8bd026a6
- SHA512 8e1019355762ac59383d0e3a745980bc5f23d0ffaee4ab81827ddcc812d1c411b7c76d0a9aa9401d5a9f945bbd52213dd8dd73e9cd3b9fbde13daac005d5e0c7
- SSDEEP 12288:CwFF2V+FF23mw5HEjsChNVBFgl0W80OVLLpc6WWLkrcYc54:CwFF2V+FF2WwukOWJOVLLpc7ckPcu
- TLSH T123F439B1459F3DD5D6E681F4814272FA9E6177333DB0FEDAE1D1924D3B2AAA44808332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 1 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/5584-351-0x0000000000400000-0x000000000040B000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/5584-0-0x0000000000400000-0x000000000040B000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x0009000000019caa-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000400000001b1b2-6.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/5584-351-0x0000000000400000-0x000000000040B000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (1972) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.TypeExtensions.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\quz-PE\tipresx.dll.mui.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Overlapped.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Primitives.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\UIAutomationClient.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\UIAutomationProvider.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\hi-IN\tipresx.dll.mui.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\PresentationCore.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Xaml.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Intrinsics.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\PresentationUI.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Xaml.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\icudtl.dat.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\.version.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.NETCore.App.deps.json.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.IO.Packaging.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\LogoCanary.png.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\Lang\lv.txt.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\qps-ploc\tipresx.dll.mui.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fr.pak.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\DisableRequest.ADTS.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\WindowsBase.resources.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_1f224b8dd1a9fbb440e7c5da56415e51_elex_icedid_njrat_vidar.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5584
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2301830172-776172150-2531349243-1000\desktop.ini.tmp
- Size 717KB
- SHA256 4065d9e441acbfd73a4e17687dc10e317ce7c857bd0586684a0a843494771e60
- MD5 92ecd349f838901a3a4bbffc84150cba
- SHA1 e7cc353ba63ece7ff68855ef9d792071b7c470f7
- SHA512 c0554231de215918c06d83f22285ed22ed49703c299e798c6fe759820aadd0bc479e2cf523708dd879bddfc90b6ed39a7a398b10b86cf0f84d1597066fa399e2
- SSDEEP 12288:CwFF2V+FF23mw5HEjsChNVBFgl0W80OVLLpc6WWLkrcYc5K:CwFF2V+FF2WwukOWJOVLLpc7ckPc0
- TLSH T12EF439B1459F3DD5D6E681F4814272FA9E6177333DB0FEDAE1D1924D3B2AAA44808332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 816KB
- SHA256 a8b376d0a5c4e4bfafeaf6f24bc252752d28a9e5ae7a8bae3bcabf5135a8674d
- MD5 c4a2e8526ac4fee07b8964df8353f59f
- SHA1 f86cebfdf0e402882d13c30c242585ee5b015f5b
- SHA512 09fce866cb13ee2c7345bb83b5af3fa5fe943f64d716e5e6df84c104605dc6e096bb4f6d86219ef0b64b7da382b2cecfd5ec4b2fd8d6123a4baf35e076348370
- SSDEEP 24576:CwFF2V+FF2WwukOWJOVLLpc7ckPclMfSgWD:CwFg+Fbw7OVd4UMa
- TLSH T14B0539B0599F7DD5C6E281F8840376F68A5177333DB4FEDAE1D1928D3B29AA40809372
- MD5 SHA1 SHA512 SSDEEP TLSH