becab0eba63d2e883a82c8dbad8e7bdefc6dc56183d6cfca2f57bd6561ce5c6d

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_887c178e004eb4f7afc77cabcfc0f446_elex_icedid_njrat_vidar.exe
Size 2.7MB
Sample260814-3fxa8atfld
SHA256 becab0eba63d2e883a82c8dbad8e7bdefc6dc56183d6cfca2f57bd6561ce5c6d
MD5 887c178e004eb4f7afc77cabcfc0f446
SHA1 bbc748c4b9768b82c692bb83c5c7786fb0cbf86d
SHA512 5ec3ab24131c56bd3b0544a3bf80ef1de3b8624f8148686595205f3fecfefa71de3468b907faaae3765528fdd7e84bbd50e35f372d93a7ed7d0b7e1dd1b4784f
SSDEEP 49152:U+E9B+ES+E9B+ES+E9B+ES+Ex+E9B+ES+E9AVy6i1zuajsauZnJkhOM:JVtUL
TLSH
T1B3D55C09F6D900E5E577827089ABC17AD531B9314721CAEFA254C37E6E33BD0AD39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4764	svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe
4332	svchost_CBBAACACAACABACBBACBABBACCBACBCCBCACCCBACACCAABBCBCABBC.exe
1416	svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBBCBCACBCCBCCAAAABCACBACABBCABCABBACAACBABCCCABACBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe"	2026-08-14_887c178e004eb4f7afc77cabcfc0f446_elex_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAACCCBCBAABBBACACBCCACABBAAABBCBAABABCBCBCABABCACBBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBAACACAACABACBBACBABBACCBACBCCBCACCCBACACCAABBCBCABBC.exe"	svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2632	sc.exe
2568	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5720	cmd.exe
4740	cmd.exe
1096	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBAACACAACABACBBACBABBACCBACBCCBCACCCBACACCAABBCBCABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_887c178e004eb4f7afc77cabcfc0f446_elex_icedid_njrat_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4224	2026-08-14_887c178e004eb4f7afc77cabcfc0f446_elex_icedid_njrat_vidar.exe
4224	2026-08-14_887c178e004eb4f7afc77cabcfc0f446_elex_icedid_njrat_vidar.exe
4224	2026-08-14_887c178e004eb4f7afc77cabcfc0f446_elex_icedid_njrat_vidar.exe
4224	2026-08-14_887c178e004eb4f7afc77cabcfc0f446_elex_icedid_njrat_vidar.exe
4764	svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe
4764	svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe
4764	svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe
4764	svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe
4332	svchost_CBBAACACAACABACBBACBABBACCBACBCCBCACCCBACACCAABBCBCABBC.exe
4332	svchost_CBBAACACAACABACBBACBABBACCBACBCCBCACCCBACACCAABBCBCABBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4224	2026-08-14_887c178e004eb4f7afc77cabcfc0f446_elex_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4764	svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe
Token: SeDebugPrivilege	4332	svchost_CBBAACACAACABACBBACBABBACCBACBCCBCACCCBACACCAABBCBCABBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 5720	4224	2026-08-14_887c178e004eb4f7afc77cabcfc0f446_elex_icedid_njrat_vidar.exe	92
PID 5720 wrote to memory of 4672	5720	cmd.exe	94
PID 4764 wrote to memory of 2288	4764	svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe	95
PID 4224 wrote to memory of 4740	4224	2026-08-14_887c178e004eb4f7afc77cabcfc0f446_elex_icedid_njrat_vidar.exe	98
PID 4740 wrote to memory of 2632	4740	cmd.exe	100
PID 4224 wrote to memory of 1096	4224	2026-08-14_887c178e004eb4f7afc77cabcfc0f446_elex_icedid_njrat_vidar.exe	101
PID 1096 wrote to memory of 2568	1096	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_887c178e004eb4f7afc77cabcfc0f446_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_887c178e004eb4f7afc77cabcfc0f446_elex_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCAABBBBBBAABBBBABACACCABAAAABCBCBCBABCBCABACCAACCABAACACBBCAAACBBCCBABBAAABCBACCCBABCCACBCCACAAACCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCAABBBBBBAABBBBABACACCABAAAABCBCBCBABCBCABACCAACCABAACACBBCAAACBBCCBABBAAABCBACCCBABCCACBCCACAAACCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBBBBCBACBBCBBCABBBABCACBCABCACCBCBABCABBCCACCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe" start= auto displayName= "UserDataSvc_CCBBBBBCBACBBCBBCABBBABCACBCABCACCBCBABCABBCCACCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBBBBCBACBBCBBCABBBABCACBCABCACCBCBABCABBCCACCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe" start= auto displayName= "UserDataSvc_CCBBBBBCBACBBCBBCABBBABCACBCABCACCBCBABCABBCCACCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBBBBCBACBBCBBCABBBABCACBCABCACCBCBABCABBCCACCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBBBBCBACBBCBBCABBBABCACBCABCACCBCBABCABBCCACCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2568

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAACACAACABACBBACBABBACCBACBCCBCACCCBACACCAABBCBCABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAACACAACABACBBACBABBACCBACBCCBCACCCBACACCAABBCBCABBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4332

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe
1⤵
- Executes dropped EXE
PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bb0279d9b2a88487677c1b890dc69a346b1cb372b102d136bcbed597442b7722
MD5 a7db9cfb7a104a86fb6186adf83a1ad4
SHA1 3c790af61ae74479c82ad217dbe9cdd8ed78e3ef
SHA512 46d15e07ee87b5f27877572977e97f4e65458a5adaf2e4044865399866cff596f559aee16730866713cc14b95546d434f88625e50aef5ef0ca180ed41cebe0c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6e676414718df5dc5557b2a97b01730c7bb61b591d98524cce0aa187b52c3aab
MD5 10492c2447efcc6474951bf3b65fc9b1
SHA1 161f8b86210b489a76d14822c20e41028dcb0f18
SHA512 c97b13bdd9b7451d86ec41595636c809139901e388b03bb0df2858ac34ef3f1013b6695ae0fc357c1a65279134bab5e8d631963f5d4b2344500d850a25756ebd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e41b966eaca5faa0c56c301e593de88578c65a79a114c3c82465cb72bd978eed
MD5 2ae8fb9dc4e2927d374f2e33f73e9f47
SHA1 6ab9ed343c77c9793abf9b0842b4ffc8246977b6
SHA512 1001969966e71c6f9bada08aa16e5f251ab1b3c6341bc4b671e5f78b8a3e1c67cebf6148069c6939db6edf605aa7c608e6b0125aacdb28bd40ccf9d0dd7e0edb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d5cbee7f9398ffdf70534374a8bc98649bcc60bfaf92288deeb4de10ca3700b8
MD5 f73df5a73d8102bd07fc7a9e76718c3f
SHA1 357fd9fa956c758eedf4bdb7e7c9ea852ff73eae
SHA512 61215fea34ad15d4374afd4831bae7f12f9f4edde751c7d5f2338985bd04cbb3578122ea927dbf38e5f91a41ac5d66dca6d148e5beb17fb3ad914dea76e5b956
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 493c91ee7bd35c7f4aca7c9c1b7949ff3f4eb550def0c2c4e5704a828b340c75
MD5 a625880496785310c5340028183c3442
SHA1 9daaabba093cc52c23bb2a69336b7753c35d0cff
SHA512 bef8e66b6eef7b8cf8945e543f4ef21ea7e3baeb2439c4224d4e32f1ceb0161f24b704c102fa5dd5ba5055a9fd8d9e3625a5cb490565ac08633e5e7368e36a05
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 761e84a2bf5b23da53b857f26ca9889a3007c295c1316bd106b5b2334d6dbb12
MD5 186b82182e259bd515359601ea977c8c
SHA1 f682cae205f7adc45f7d82a8b9dd190293487def
SHA512 32b9d86e351a37571600f3aa9ec85e485061e7ac2d131a6482cf956d537d5c451f8d720af629235b3a6d1552db0a320e7ea05878fc23e872262487a480a4bca5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b52494449972c6e493ec723ebfadeb36bbd356dd930bbbf8f98515a5426a3854
MD5 48234239b62c4dca21b05a96f95a1601
SHA1 93064544674412e4dfa0078623f61a0627a68478
SHA512 a069f68c8c6b495fa94c9a53dbc280169f3096f2d6bca254e356320adac9ab37713bdd8f7b10d86ecf486a4fc6c1154d8e7af6b623eb4264023e099dcee7e097
MD5 SHA1 SHA512

Submit Download

svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAAAABABBBBCBABBBBABCCCACCABBABABBBABCBAAACABCCBBCBA.exe
Size 2.7MB
SHA256 becab0eba63d2e883a82c8dbad8e7bdefc6dc56183d6cfca2f57bd6561ce5c6d
MD5 887c178e004eb4f7afc77cabcfc0f446
SHA1 bbc748c4b9768b82c692bb83c5c7786fb0cbf86d
SHA512 5ec3ab24131c56bd3b0544a3bf80ef1de3b8624f8148686595205f3fecfefa71de3468b907faaae3765528fdd7e84bbd50e35f372d93a7ed7d0b7e1dd1b4784f
SSDEEP 49152:U+E9B+ES+E9B+ES+E9B+ES+Ex+E9B+ES+E9AVy6i1zuajsauZnJkhOM:JVtUL
TLSH
T1B3D55C09F6D900E5E577827089ABC17AD531B9314721CAEFA254C37E6E33BD0AD39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7828d3e7a6dca5392c3ddaf6387462319908261aa4262609aff67c4279fb0799
MD5 7272015d7dce5fcb7ebd4e3bf4ea1467
SHA1 f7324523d9afef93d785c08ffef9cc9918355860
SHA512 7ffebf2a2edc838d17c5f9035cc7d1d64370caa7ccd8f0a21708f43750be9ecffe1e309f44c49e87fb46f74d0f0d8456b15445190bfee47a5a07e7648a972e05
TLSH
T1B5110A60E4F5EC57F83324CB6A299B8718F47B9FAC9CAE5412094318E795C328D154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4224-8-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/4224-0-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/4332-65-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/4764-34-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download