Overview

overview

6

Static

static

5

2026-08-10...ar.exe

windows10-2004-x64

6

2026-08-10...ar.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 01:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_c26f8a79125520e433942770fed58f58_agent-tesla_amadey_icedid_njrat_vidar.exe
  • Size 10.5MB
  • Sample260810-cd2j2sygkh
  • SHA256 6f3a26f020611e7f8ad5e16043dd2dab3b0a2a695090e96b7761bae2207ca8ba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 20 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_c26f8a79125520e433942770fed58f58_agent-tesla_amadey_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_c26f8a79125520e433942770fed58f58_agent-tesla_amadey_icedid_njrat_vidar.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:4940
    • C:\EIxTemp\20260810_025833\DiskPart\diskpart.exe
      C:\EIxTemp\20260810_025833\DiskPart\diskpart.exe /s "C:\EIxTemp\20260810_025833\20260810_025833.script"
      2⤵
      • Executes dropped EXE
      PID:5660
    • C:\EIxTemp\20260810_025833\DiskPart\diskpart.exe
      C:\EIxTemp\20260810_025833\DiskPart\diskpart.exe /s "C:\EIxTemp\20260810_025833\20260810_025843.script"
      2⤵
      • Executes dropped EXE
      PID:684
    • C:\EIxTemp\20260810_025833\DiskPart\diskpart.exe
      C:\EIxTemp\20260810_025833\DiskPart\diskpart.exe /s "C:\EIxTemp\20260810_025833\20260810_025845.script"
      2⤵
      • Executes dropped EXE
      PID:5296
    • C:\EIxTemp\20260810_025833\DiskPart\diskpart.exe
      C:\EIxTemp\20260810_025833\DiskPart\diskpart.exe /s "C:\EIxTemp\20260810_025833\20260810_025846.script"
      2⤵
      • Executes dropped EXE
      PID:5888
    • C:\EIxTemp\20260810_025833\DiskPart\diskpart.exe
      C:\EIxTemp\20260810_025833\DiskPart\diskpart.exe /s "C:\EIxTemp\20260810_025833\20260810_025848.script"
      2⤵
      • Executes dropped EXE
      PID:1676
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:616
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4828
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:3404
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:4544
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:4780
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:6752
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:3256

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            20260810_025833.script
            • Path C:\EIxTemp\20260810_025833\20260810_025833.script
            • Size 9B
            • SHA256 dc552a90745d1474359ef009f6f07bf72da0ddf01071342bef951895bd95bbf7
            • MD5 SHA1 SHA512
            Submit Download

            20260810_025843.script
            • Path C:\EIxTemp\20260810_025833\20260810_025843.script
            • Size 28B
            • SHA256 da5475ef4340e7e028464fe673aadc352b186d6d9133e5d3c1f5f62bb663ccbf
            • MD5 SHA1 SHA512
            Submit Download

            20260810_025845.script
            • Path C:\EIxTemp\20260810_025833\20260810_025845.script
            • Size 31B
            • SHA256 c36940d275232887a20070f66efafc7943009fb7eb76cc8366c21d35def58e1c
            • MD5 SHA1 SHA512
            Submit Download

            20260810_025846.script
            • Path C:\EIxTemp\20260810_025833\20260810_025846.script
            • Size 167B
            • SHA256 6794796aab674cf8daed1eb017f662e1ab49c0f94da6acb19478b59914993a91
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            20260810_025848.script
            • Path C:\EIxTemp\20260810_025833\20260810_025848.script
            • Size 128B
            • SHA256 2cb4e3188eea458e5f529e40c0e5632edb3d0907d7c173bf14df8c970a3857e8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            diskpart.exe
            • Path C:\EIxTemp\20260810_025833\DiskPart\diskpart.exe
            • Size 172KB
            • SHA256 a9882c2c19922af201780dbce7b2f8d41b0d4341784e63bf40baf3a986ca0c7b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download