4fb3a464c4efc7973dc1f348cecf11d00e0571841cf259d57031e85b7ea16252

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_17974746003aa94da78f692788cc9910_elex_icedid_njrat_vidar.exe
Size 1.6MB
Sample260809-ysybtsvemb
SHA256 4fb3a464c4efc7973dc1f348cecf11d00e0571841cf259d57031e85b7ea16252
MD5 17974746003aa94da78f692788cc9910
SHA1 6e50d2a7e83eaba9160643c7d6f2e98ff576eba7
SHA512 31bb860ed08033f67de52b681429a8f3ae265c3c0e5cc2a7034297ec77ed041b91e4f852138245cf7c0cee84a5a37a2dd6d3132ba6ed9ddfa79b588fb69a8c75
SSDEEP 24576:m9+EM0h8zA9biKyRq9W59+EM0q9+EM0h8zA9biKyRq9W9Ih7CoslZOZ+:U+Ez8obnyMWT+ES+Ez8obnyMWGhOfR
TLSH
T19B755B0F22F800B6D97FC175D2958166D671B43127216AEFA2A0C73D9F2B9D1A93DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4856	svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe
3412	svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe
1384	svchost_CBAACABAACCCBBABABAAACCABCCBBCCABBAACAAABAACBCCABBCCBCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABCABABBBBACCCAAACCBCBCAAAAACBCACBAAAACCACACCBBCCCCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe"	2026-08-09_17974746003aa94da78f692788cc9910_elex_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAABBBAACCCCAAABCABACACCCABCCBBBAACCBCCBAABCBCBCBABAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAACABAACCCBBABABAAACCABCCBBCCABBAACAAABAACBCCABBCCBCC.exe"	svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5296	sc.exe
5060	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2320	cmd.exe
4984	cmd.exe
5228	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAACABAACCCBBABABAAACCABCCBBCCABBAACAAABAACBCCABBCCBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_17974746003aa94da78f692788cc9910_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4136	2026-08-09_17974746003aa94da78f692788cc9910_elex_icedid_njrat_vidar.exe
4136	2026-08-09_17974746003aa94da78f692788cc9910_elex_icedid_njrat_vidar.exe
4136	2026-08-09_17974746003aa94da78f692788cc9910_elex_icedid_njrat_vidar.exe
4136	2026-08-09_17974746003aa94da78f692788cc9910_elex_icedid_njrat_vidar.exe
4856	svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe
4856	svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe
4856	svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe
4856	svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe
1384	svchost_CBAACABAACCCBBABABAAACCABCCBBCCABBAACAAABAACBCCABBCCBCC.exe
1384	svchost_CBAACABAACCCBBABABAAACCABCCBBCCABBAACAAABAACBCCABBCCBCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	2026-08-09_17974746003aa94da78f692788cc9910_elex_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4856	svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe
Token: SeDebugPrivilege	1384	svchost_CBAACABAACCCBBABABAAACCABCCBBCCABBAACAAABAACBCCABBCCBCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 2320	4136	2026-08-09_17974746003aa94da78f692788cc9910_elex_icedid_njrat_vidar.exe	92
PID 2320 wrote to memory of 4836	2320	cmd.exe	94
PID 4856 wrote to memory of 5968	4856	svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe	95
PID 4136 wrote to memory of 4984	4136	2026-08-09_17974746003aa94da78f692788cc9910_elex_icedid_njrat_vidar.exe	96
PID 4984 wrote to memory of 5296	4984	cmd.exe	98
PID 4136 wrote to memory of 5228	4136	2026-08-09_17974746003aa94da78f692788cc9910_elex_icedid_njrat_vidar.exe	99
PID 5228 wrote to memory of 5060	5228	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-09_17974746003aa94da78f692788cc9910_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_17974746003aa94da78f692788cc9910_elex_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBCBABCAAABBBACCACAACACBACCBCBBCCCABABBCBCCACCBACAAABBAACACCCBACCBCBACABCABCBCBBBCACCCCBAAACCBBCBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBCBABCAAABBBACCACAACACBACCBCBBCCCABABBCBCCACCBACAAABBAACACCCBACCBCBACABCABCBCBBBCACCCCBAAACCBBCBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACCBCCCABAAAAAABABBBBBACCBCCAACACABACCBCBAACBCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe" start= auto displayName= "UserDataSvc_ACACCBCCCABAAAAAABABBBBBACCBCCAACACABACCBCBAACBCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACACCBCCCABAAAAAABABBBBBACCBCCAACACABACCBCBAACBCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe" start= auto displayName= "UserDataSvc_ACACCBCCCABAAAAAABABBBBBACCBCCAACACABACCBCBAACBCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACACCBCCCABAAAAAABABBBBBACCBCCAACACABACCBCBAACBCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5228
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACACCBCCCABAAAAAABABBBBBACCBCCAACACABACCBCBAACBCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5968

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe
1⤵
- Executes dropped EXE
PID:3412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACABAACCCBBABABAAACCABCCBBCCABBAACAAABAACBCCABBCCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACABAACCCBBABABAAACCABCCBBCCABBAACAAABAACBCCABBCCBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a2588e57ea33aa7d8daf13f0f72c01dc81ad98bc67bef590f993105df9d84476
MD5 2c2942f4e70c90b32dc3ee2aa923b280
SHA1 198ff3dbd9e83845902d1728564a4770cfe30e9a
SHA512 f5314f37102a046c4376cb8e345a7e869c5a15fab30ebaff7ea476c4a0d950ba2373e15e8d4024eb7588fa50de518adefaff9012e4d91832f4d86cc1aea2318c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 47ce2126c4315e0ea1c932219d3f659106c0b69cfe58909d1153953fe9504c05
MD5 cb30c51f823a2f15a66aa87d6320a65a
SHA1 64cb12f6bb48e10ffc7aeb989eb54f1a4d6e0809
SHA512 8409d380e3aa0310986102727b5c6e2cd606ac41688d25dd09e25392c9feed8c91455c9358ec6a33252de58e7606ce8f265edfa72c30567a08a97f91cbd014b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b9623cb6afa6750ae4d54cf30d8a0fbafbe65bb83ccd8de177e9b596af81b97d
MD5 56be022727091db69976cea29872ae14
SHA1 a0f32735b709081752cb876478786ac584a490c3
SHA512 3ff10673192944694b950a61e556b214c93c4e8c2c9a576d6d182f77762a9d619d559d0556a6a8cd4b69eaeb753976b80b6efafe03237ae93aa20d91ba8a26a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4eb77a3173a6399e20577357d0794e5fa8f07b468d053608c0393af61c64acf2
MD5 071adce3ac9d0297a6d68248f0ce4b71
SHA1 b19dd2087af0cfed2a835874fd138804d13bb7eb
SHA512 7064e14b82cc75a779dd442bfe78dc92594b648a625ef0c6fad2bc7f8fdb5e71486c5fd6302b61a40b4a78b3fdfcbbbd95d3d4f750477fe5effbb1647bcc5852
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f78c748565aca491edd3afbde23a8151188dbbf4d0516d437ed6b9d759b2c011
MD5 fcd1963bec4a5b6e83bb3ff71b1b52d4
SHA1 8848358f0545084439d5e5b34ba7e1e102068d0d
SHA512 8d798976137d124c4c57e45693480710fb9691e3e1d9ebb27a980592c4a2de04383fe652cdd03c2017ac0d38447a6cdd42188fd79c0cd382e9bc6455d892438b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 62092fb4dab74c42e92d5688bf3f53330ce8c4571fbacf52e47aca3ef39c76d2
MD5 4bbff5fdf95cbf071a4069aee6042e3d
SHA1 0cb73b9a58889141c13bdf56e151c65eebfb77b3
SHA512 1fd8e48334cee13fea1a01c24a499dfd7d409c12f3d5f4a50440151c305be3ef9fdd961cffa6bc0e3d617915ea786c02a78c53b6387f52dcbd5422b0d69f6472
MD5 SHA1 SHA512

Submit Download

svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCACACAABCACBCACCBAACABABBAABCCBCAAACABBBBBBABCBBBA.exe
Size 1.6MB
SHA256 4fb3a464c4efc7973dc1f348cecf11d00e0571841cf259d57031e85b7ea16252
MD5 17974746003aa94da78f692788cc9910
SHA1 6e50d2a7e83eaba9160643c7d6f2e98ff576eba7
SHA512 31bb860ed08033f67de52b681429a8f3ae265c3c0e5cc2a7034297ec77ed041b91e4f852138245cf7c0cee84a5a37a2dd6d3132ba6ed9ddfa79b588fb69a8c75
SSDEEP 24576:m9+EM0h8zA9biKyRq9W59+EM0q9+EM0h8zA9biKyRq9W9Ih7CoslZOZ+:U+Ez8obnyMWT+ES+Ez8obnyMWGhOfR
TLSH
T19B755B0F22F800B6D97FC175D2958166D671B43127216AEFA2A0C73D9F2B9D1A93DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 6ab18858572bc307aa9a4135cf968817a310a0218a7f83a7271285b205a0bdad
MD5 3fbeea3aa128b23afe4e6f853e748732
SHA1 ffee5006885820f1bee4b20a5df913d94665a4e7
SHA512 4d693f428bfe059d37a5b089d65446bd78c46324ba88b6bdbf08a60631b34c28b83f4555729f43e8e07b4188c210fd5abc012279bf52244299e866ce53f3a08b
TLSH
T1E2110430C4F9C823F433788BEA3DCA47CCA8338B58986A50A30542196BE9C32CD158F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1384-81-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/3412-66-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4136-6-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/4856-35-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4856-22-0x0000000000780000-0x00000000007A1000-memory.dmp

Download