3f4a57f7733cb3d7013cca09a3b34238f9f7d0e52e57bca8d29a473fe9dbae86

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_ec765a3357860fbd0189c6768d61f509_icedid_njrat_vidar.exe
Size 653KB
Sample260813-jprmjshe74
SHA256 3f4a57f7733cb3d7013cca09a3b34238f9f7d0e52e57bca8d29a473fe9dbae86
MD5 ec765a3357860fbd0189c6768d61f509
SHA1 a7d6ed59aaeed40c5391fbd4d1d4b2e1caceded4
SHA512 f62a23f4ba6f17631eb22df7448a57eef7a6f368eb713bb1319432f145037647e82663694ba1d6f33d15c1aa08732b16433d8546f35c31d5dc0f0b689360c24e
SSDEEP 12288:4eYnAlSAgUu3c3PA+mPVi3pPuhrPGKuyYol:6CSAE3c3PA+mPVi3pPuhrPcJ4
TLSH
T122E46B59279895C3C13BC23DC9964BB9D9613C218721DACB01D976AE3F336E81E3B724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion execution persistence ransomware

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	2026-08-13_ec765a3357860fbd0189c6768d61f509_icedid_njrat_vidar.exe

Disables Task Manager via registry modification
defense_evasion

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-08-13_ec765a3357860fbd0189c6768d61f509_icedid_njrat_vidar.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4532	cmd.exe
5776	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3540	notepad.exe

Runs regedit.exe 1 IoCs

pid	Process
688	regedit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2900	2026-08-13_ec765a3357860fbd0189c6768d61f509_icedid_njrat_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5816	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5816	AUDIODG.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 4532	2900	2026-08-13_ec765a3357860fbd0189c6768d61f509_icedid_njrat_vidar.exe	90
PID 4532 wrote to memory of 688	4532	cmd.exe	92
PID 2900 wrote to memory of 5776	2900	2026-08-13_ec765a3357860fbd0189c6768d61f509_icedid_njrat_vidar.exe	93
PID 5776 wrote to memory of 3540	5776	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-13_ec765a3357860fbd0189c6768d61f509_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_ec765a3357860fbd0189c6768d61f509_icedid_njrat_vidar.exe"
1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start regedit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\regedit.exe
    regedit
    3⤵
    - Runs regedit.exe
    PID:688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo don't cry baby, hihihihi > %temp%myfile.txt && notepad %temp%myfile.txt
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\system32\notepad.exe
    notepad C:\Users\Admin\AppData\Local\Tempmyfile.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:3540

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004F4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Tempmyfile.txt

Path C:\Users\Admin\AppData\Local\Tempmyfile.txt
Size 28B
SHA256 0f4f69670fbc3b7933d1911641c6df205acf755f086a248a64c25e4c1c62f6dc
MD5 a0ae6e75b2edd99ed80edab72c6c0134
SHA1 77fe1982adb2f961240a9dbebcfb06036503d018
SHA512 7993e50d901e9921e2fb8cef8a25209fc9f3658a1bcbce483f730f3c72653461e3ecaf05d7a47e77d9532dcf192a069a63b296d56f7424ee8c7fa12be315ea04
MD5 SHA1 SHA512

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads