c2a637f7a0de72241cf643821a432e16fc3e0c1220a47a574e84f15dcd5fd67c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
Size 772KB
Sample260814-fe1wpavdrd
SHA256 c2a637f7a0de72241cf643821a432e16fc3e0c1220a47a574e84f15dcd5fd67c
MD5 346cd765a4d33154df1cd48c447c3f09
SHA1 a87d7118e8f8e8132f196030c2ba456ca23dcf86
SHA512 ebebb80a970fb6df56b689e382ede18fea2e913d41db9adf264a22b3509c7f7fb53f1f299dc41611fd63a43700a28cdc9586700dd41d40b4c8d6024dc1065b0e
SSDEEP 12288:mgUFgEsnojA8rCB1igsNBfcsc+ZOnZxZgUFgEsnojA8rCB1igsNBfcsc+ZOnZxEU:m9+EM0yslZOZn9+EM0yslZOZCAoGl
TLSH
T1BEF49E0AF6A008F5D6678534CA8BD136DBB2B9561B11CB9F6364C31B2F237A1AD3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2256	svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe
2028	svchost_CBCBACAAACBACCBCACAACABBAAABCACABCACACBABBCACABBBBCBAAA.exe
2524	svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBBCACBABACAAAAABACCCACBCCBACCAACBABCACCCCBCACCCCBBBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe"	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBAAABBBABACCACCABACABACBBCABCCCABBBBAACCAACCBCCAAAABBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBACAAACBACCBCACAACABBAAABCACABCACACBABBCACABBBBCBAAA.exe"	svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3040	sc.exe
3140	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1252	cmd.exe
4484	cmd.exe
1572	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBACAAACBACCBCACAACABBAAABCACABCACACBABBCACABBBBCBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2972	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
2972	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
2972	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
2972	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
2256	svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe
2256	svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe
2256	svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe
2256	svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe
2028	svchost_CBCBACAAACBACCBCACAACABBAAABCACABCACACBABBCACABBBBCBAAA.exe
2028	svchost_CBCBACAAACBACCBCACAACABBAAABCACABCACACBABBCACABBBBCBAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2256	svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe
Token: SeDebugPrivilege	2028	svchost_CBCBACAAACBACCBCACAACABBAAABCACABCACACBABBCACABBBBCBAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1692	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1252	2972	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe	106
PID 1252 wrote to memory of 3944	1252	cmd.exe	108
PID 2256 wrote to memory of 4648	2256	svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe	109
PID 4648 wrote to memory of 2488	4648	notepad.exe	110
PID 2972 wrote to memory of 4484	2972	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe	115
PID 4484 wrote to memory of 3140	4484	cmd.exe	117
PID 2972 wrote to memory of 1572	2972	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe	118
PID 1572 wrote to memory of 3040	1572	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBABABBCBABABCAABAACCBAABABBBBCCAACBCAACACBCCBCBCBBCCCBBBBACABBCCABBAABBCBABCCBCCCAAABBCBCBACBCAABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBABABBCBABABCAABAACCBAABABBBBCCAACBCAACACBCCBCBCBBCCCBBBBACABBCCABBAABBCBABCCBCCCAAABBCBCBACBCAABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABAABCCBABABAACBBBCCBCBBCBBBBAABCBBCABBABBABBABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe" start= auto displayName= "UserDataSvc_ACABAABCCBABABAACBBBCCBCBBCBBBBAABCBBCABBABBABBABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABAABCCBABABAACBBBCCBCBBCBBBBAABCBBCABBABBABBABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe" start= auto displayName= "UserDataSvc_ACABAABCCBABABAACBBBCCBCBBCBBBBAABCBBCABBABBABBABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABAABCCBABABAACBBBCCBCBBCBBBBAABCBBCABBABBABBABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABAABCCBABABAACBBBCCBCBBCBBBBAABCBBCABBABBABBABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2488

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBACAAACBACCBCACAACABBAAABCACABCACACBABBCACABBBBCBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBACAAACBACCBCACAACABBAAABCACABCACACBABBCACABBBBCBAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe
1⤵
- Executes dropped EXE
PID:2524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8395c5861947f07cc1cbeb5104c740cbde42a170bd44bb61f72288b7fc6650da
MD5 a69540e29cd6c34d4c4ed7ecc6215960
SHA1 16030c74d2b2f9de28a04bf41b7a8eb1a607dcf4
SHA512 21d0a1bcdae5a49490c469625e18eae46e5476264e859600d831954a7c8df24d4c1fd87c8909fa450b1a1bba80944929d080c49930686aef528b29344488c9fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a6d45e03a9017a6bc16903afe172c4b0131fea3bec50083819e53e7682299ecf
MD5 eb040f2e2f44f7338b159a9bfe242118
SHA1 5263fa888dd048b45b4618e537b285d64c1aa60e
SHA512 da2c2890227751b52e67bd6eb19defb537ba1180376c267afbe0894c148affdec9815096c1adea9b97ec2fb2e5d287c9f97f81319baa27ca295894b4ef12ccfb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 60d17b60c0858b67f00cbfec8368f90fbfa7b94351e8a43c4d3a3d49bed1fd87
MD5 5fa03f969a623f628bc63c5c19bba1d0
SHA1 a46f62818376b01013a0a09904e8f2bb56c561ff
SHA512 f6a69acae4979461ab23984f15fbb1ed00872ded2ae5f90ad072c620c2f387c335be8c8d5da97c55035213f8383a5229c2c0104e30be179c4381f77172f6406f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dd2f0caa4b4086baee55d48b01f87efcd23d14dd81e0fbcd8e97a663320ca999
MD5 2fa705ecc257f9a479759d7e9885e1d3
SHA1 2b84d3f15c39bd0ede2858e04cf5e7959039e188
SHA512 b5fb886415050ef5c927a6ec0a885f5bc747d76513014db5b518e9ed98328ca41a28475db6c578a1be9e8f4ef3a6e2f33595cbae887b985c9fc7c8b67188c5bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c48eedaa357d344857880b38e643106b9dc05c9994f1d28f7c5acf5407aaa696
MD5 40bb1c8786ec82aedbad4cd113c3844a
SHA1 20cae8aaf97238cf3107b1e04ca342521bb0e2c3
SHA512 7106676605a0b0892681284ba6483b09da1845db3cdf9ea9ff716087daf4a569b2ab3cb4118fa947438c1cfd3377feb42fed1fba0c02e436a531e56465c0f472
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d148a93143cbfa18bf2858e408f345eecc629dcf743138589a5ae19ce99263a2
MD5 785528e825182fb6ee021edff4db0182
SHA1 6a58dcb7a369eff05f5a43c609422ea7ae436962
SHA512 e0e7c0d72daa31c86a9df2e45f241c44b60942974bead9d01aadcf30cf1c7eb3169274545c17bc99569897ae2aa071991232949eff1526566c4279a481aa5680
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 53599b7ea391636293a0dedcdbf0117a3b6771c465d6fe1b0b49ea2f5bed947a
MD5 e081634a574d37af3ed4e215cff2f2e8
SHA1 9d5dd4c454b8e26eed35beea9399ce891a375e35
SHA512 58833889cfa93af6ac47e3f891730f1c1940b47879bded266353984ed25558662361eaa41dc87846702593b8bf5c0f3004e03f3dd74104f9ef0b72b706745149
MD5 SHA1 SHA512

Submit Download

svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABACAACAAACAAAACCCCABCCBAABABBACBBBBAABAACBAAAACAA.exe
Size 772KB
SHA256 c2a637f7a0de72241cf643821a432e16fc3e0c1220a47a574e84f15dcd5fd67c
MD5 346cd765a4d33154df1cd48c447c3f09
SHA1 a87d7118e8f8e8132f196030c2ba456ca23dcf86
SHA512 ebebb80a970fb6df56b689e382ede18fea2e913d41db9adf264a22b3509c7f7fb53f1f299dc41611fd63a43700a28cdc9586700dd41d40b4c8d6024dc1065b0e
SSDEEP 12288:mgUFgEsnojA8rCB1igsNBfcsc+ZOnZxZgUFgEsnojA8rCB1igsNBfcsc+ZOnZxEU:m9+EM0yslZOZn9+EM0yslZOZCAoGl
TLSH
T1BEF49E0AF6A008F5D6678534CA8BD136DBB2B9561B11CB9F6364C31B2F237A1AD3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 da344db42de01cdd0eb188dfd8b10666bb3616373cc7aff016dc217055ecdb70
MD5 6e3ca6d75eb38a03c25bc8a14ade3d12
SHA1 c1842cd829db71458069b0647dd12c77d7099208
SHA512 d7f0b021f34dbe628dca37bfdc89e1d0a0d9f0409dc2b6216c75e81e84562c8f07adfa32126433d701018b4b0f72a818ac9849cc6c8a1b6697f3e5ce7c4eaf54
TLSH
T11701496158E6DC73FA33A8CB95099FA20CF4F59BBC9C5A856308422C6F85D30CD558A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2028-72-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/2028-90-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/2256-36-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/2524-92-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/2972-0-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/2972-7-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/4648-59-0x0000000005920000-0x0000000005921000-memory.dmp

Download