c2a637f7a0de72241cf643821a432e16fc3e0c1220a47a574e84f15dcd5fd67c

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
Size 772KB
Sample260814-fe1wpavdrd
SHA256 c2a637f7a0de72241cf643821a432e16fc3e0c1220a47a574e84f15dcd5fd67c
MD5 346cd765a4d33154df1cd48c447c3f09
SHA1 a87d7118e8f8e8132f196030c2ba456ca23dcf86
SHA512 ebebb80a970fb6df56b689e382ede18fea2e913d41db9adf264a22b3509c7f7fb53f1f299dc41611fd63a43700a28cdc9586700dd41d40b4c8d6024dc1065b0e
SSDEEP 12288:mgUFgEsnojA8rCB1igsNBfcsc+ZOnZxZgUFgEsnojA8rCB1igsNBfcsc+ZOnZxEU:m9+EM0yslZOZn9+EM0yslZOZCAoGl
TLSH
T1BEF49E0AF6A008F5D6678534CA8BD136DBB2B9561B11CB9F6364C31B2F237A1AD3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2904	svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe
2616	svchost_ACBBCBBCAABABCCAAABABBBBACABBBBBABABCCAABAABBABBBABAAAA.exe
5436	svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBABBCBCBACABBAACABBACBACAACACBBCBABAAACBCCAACCCBCCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe"	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAACAAAABBACABBCCCABABAACABBCCCCACBBAAABACAABCACCBACAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBCBBCAABABCCAAABABBBBACABBBBBABABCCAABAABBABBBABAAAA.exe"	svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5168	sc.exe
4704	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2972	cmd.exe
1620	cmd.exe
4076	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBCBBCAABABCCAAABABBBBACABBBBBABABCCAABAABBABBBABAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1136	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
1136	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
1136	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
1136	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
2904	svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe
2904	svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe
2904	svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe
2904	svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe
2616	svchost_ACBBCBBCAABABCCAAABABBBBACABBBBBABABCCAABAABBABBBABAAAA.exe
2616	svchost_ACBBCBBCAABABCCAAABABBBBACABBBBBABABCCAABAABBABBBABAAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1136	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2904	svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe
Token: SeDebugPrivilege	2616	svchost_ACBBCBBCAABABCCAAABABBBBACABBBBBABABCCAABAABBABBBABAAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 2972	1136	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe	92
PID 2972 wrote to memory of 5584	2972	cmd.exe	94
PID 2904 wrote to memory of 2984	2904	svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe	95
PID 1136 wrote to memory of 1620	1136	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe	98
PID 1620 wrote to memory of 5168	1620	cmd.exe	100
PID 1136 wrote to memory of 4076	1136	2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe	101
PID 4076 wrote to memory of 4704	4076	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_346cd765a4d33154df1cd48c447c3f09_elex_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACACCABCABCBBABACAACCBACCCCBABCCABCBABBCCCCACCAACBBABCBBCBCBCBBCCCBBABCAABCBBBABBBCBBABBCACABCCABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACACCABCABCBBABACAACCBACCCCBABCCABCBABBCCCCACCAACBBABCBBCBCBCBBCCCBBABCAABCBBBABBBCBBABBCACABCCABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBABBABBBCAAABAABCCBCCCCACBBCBABBACACBABAACCBCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe" start= auto displayName= "UserDataSvc_BBBBABBABBBCAAABAABCCBCCCCACBBCBABBACACBABAACCBCBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBBABBABBBCAAABAABCCBCCCCACBBCBABBACACBABAACCBCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe" start= auto displayName= "UserDataSvc_BBBBABBABBBCAAABAABCCBCCCCACBBCBABBACACBABAACCBCBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBABBABBBCAAABAABCCBCCCCACBBCBABBACACBABAACCBCBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBBABBABBBCAAABAABCCBCCCCACBBCBABBACACBABAACCBCBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2984

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBCAABABCCAAABABBBBACABBBBBABABCCAABAABBABBBABAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBCAABABCCAAABABBBBACABBBBBABABCCAABAABBABBBABAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe
1⤵
- Executes dropped EXE
PID:5436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed2c96a7c27032eb06ee7405284878a9094a6cf6b556a4616b52bff5629243e6
MD5 6aa6d0c20b84c75231338a6e5693d6ae
SHA1 2662bb67069a63e24036ab976ec03c46d4e90ca4
SHA512 e5079452187928a2eb9509437d045cb6cef04c45e7e729b0357a56098adff8d14a68208c4b4cb1c2b8654e1518f1376737608009f811312aca6d6785c4dc688f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a6d45e03a9017a6bc16903afe172c4b0131fea3bec50083819e53e7682299ecf
MD5 eb040f2e2f44f7338b159a9bfe242118
SHA1 5263fa888dd048b45b4618e537b285d64c1aa60e
SHA512 da2c2890227751b52e67bd6eb19defb537ba1180376c267afbe0894c148affdec9815096c1adea9b97ec2fb2e5d287c9f97f81319baa27ca295894b4ef12ccfb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 858ac0a2679382df62b10f2cd2a024fe1fd4e057ad71b6ec571822ddb4240120
MD5 93789e46f60005925751d3dcb4502ffb
SHA1 2145ebc2258180e7b9b46ba85def32624d38651f
SHA512 2324fee9729bce08563b66a4db1a6e8a18dfb4df375479186c74296de7870f28b2f19d30ce73fbf4e1385f7f23957a98c858bbc6b68c870d1394ac9b6b393099
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d148a93143cbfa18bf2858e408f345eecc629dcf743138589a5ae19ce99263a2
MD5 785528e825182fb6ee021edff4db0182
SHA1 6a58dcb7a369eff05f5a43c609422ea7ae436962
SHA512 e0e7c0d72daa31c86a9df2e45f241c44b60942974bead9d01aadcf30cf1c7eb3169274545c17bc99569897ae2aa071991232949eff1526566c4279a481aa5680
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d2fd2208c3f5faea4913654f4254155e1c86d5eecf97d0595f01a0099f5b9518
MD5 fa522e470324dc73b4a4960baf1b4f03
SHA1 60a1eea8b7a7b5e5eb179273ed4bca04187b31db
SHA512 69e81723f7cab6f7b4b5119962e527209b2a0a5f388961ae5d66dcb026c39548af0b2b4d292bd49e8e5c5552db5f0f53176106d2499198b4e9c58e21ba6ae3af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a406b1abf2551b1ecce5392efc745cadc52dd52fbad7c90d59e19094bbbcca04
MD5 d23fea2de5809846f98775945cf2d213
SHA1 4b6cc503bba12678904cfc8411773502ffa8a37a
SHA512 a08c7bca43df442a06ebb1bb66e8d8b8efedce1fda0d2ca2c9b81951e789267fc366124f6130727c3c1709ad3e406262e4d6f259b1992877f08082e59bdcc0a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c48eedaa357d344857880b38e643106b9dc05c9994f1d28f7c5acf5407aaa696
MD5 40bb1c8786ec82aedbad4cd113c3844a
SHA1 20cae8aaf97238cf3107b1e04ca342521bb0e2c3
SHA512 7106676605a0b0892681284ba6483b09da1845db3cdf9ea9ff716087daf4a569b2ab3cb4118fa947438c1cfd3377feb42fed1fba0c02e436a531e56465c0f472
MD5 SHA1 SHA512

Submit Download

svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCAABBCACCABACBACCAAAABABBABBBACABBBACCBABCCABC.exe
Size 772KB
SHA256 c2a637f7a0de72241cf643821a432e16fc3e0c1220a47a574e84f15dcd5fd67c
MD5 346cd765a4d33154df1cd48c447c3f09
SHA1 a87d7118e8f8e8132f196030c2ba456ca23dcf86
SHA512 ebebb80a970fb6df56b689e382ede18fea2e913d41db9adf264a22b3509c7f7fb53f1f299dc41611fd63a43700a28cdc9586700dd41d40b4c8d6024dc1065b0e
SSDEEP 12288:mgUFgEsnojA8rCB1igsNBfcsc+ZOnZxZgUFgEsnojA8rCB1igsNBfcsc+ZOnZxEU:m9+EM0yslZOZn9+EM0yslZOZCAoGl
TLSH
T1BEF49E0AF6A008F5D6678534CA8BD136DBB2B9561B11CB9F6364C31B2F237A1AD3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 9826b157c7433d271bdf54cc5ed2a741736b8ea4a38fe75ac929c5641128c2b2
MD5 1f3b1ba81bd6b56099e15b6ad473b654
SHA1 70c8e958117b5d8f4b68f77e1df6e0f34dae6e76
SHA512 4aff4468c93b295395ca77f7e3e4187ab8058df0fa8657ab3fd506b539992b3fb567738e1d54e0cc42e4767a261f84ad6eab6c7747fab3a3e332a6be51177740
TLSH
T15511EB71D8E6D8E7E831A40AD31EDFD20CACE66B685C6A545307812CBDCDD30CD5D896
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1136-0-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/1136-7-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/2616-64-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/2616-82-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/2904-33-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/5436-84-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download