5da4932b00c256ea2876b51d11924f6f622642d52704aa456740288887c8159f

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_cb700d26bc8a87994c27606e8c5f1a46_elex_icedid_njrat_vidar.exe
Size 478KB
Sample260815-22d64aab39
SHA256 5da4932b00c256ea2876b51d11924f6f622642d52704aa456740288887c8159f
MD5 cb700d26bc8a87994c27606e8c5f1a46
SHA1 80a0ff76739e6d8ba6e0b5ba302fb1a7a6bd8abb
SHA512 846e4bff33345a8f83c8d4a2c7839edcafc07e71e1ef2ceca479bf899df14d3ef7fb54ebd5d573724416722c9f2e39492f09b317db31326fd7d0a95610b4ab0a
SSDEEP 12288:mgUFgEsnojA9gBLUeDuUlICrCB1igsNBfcsc+ZOnZxP:m9+EM0qWU/slZOZZ
TLSH
T154A47C09B6A114F5D9B78530895BD236DB71BD210B20DBAF9394D23B9F33B90AC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2672	svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe
4784	svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe
2068	svchost_BBACAAACBACCCBACBBBABCBACABBCBBBCCACCACABCAABABBACBCAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBCCBBABABACCACBABCAACCBCCBBBBABACBABAABCABBBBBAABCAABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe"	2026-08-15_cb700d26bc8a87994c27606e8c5f1a46_elex_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABCBCCCABACABBCCBACAAACABACBAACABCACCBABBBBACBBACACAACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACAAACBACCCBACBBBABCBACABBCBBBCCACCACABCAABABBACBCAAC.exe"	svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4088	sc.exe
2776	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3680	cmd.exe
872	cmd.exe
5020	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACAAACBACCCBACBBBABCBACABBCBBBCCACCACABCAABABBACBCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_cb700d26bc8a87994c27606e8c5f1a46_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2684	2026-08-15_cb700d26bc8a87994c27606e8c5f1a46_elex_icedid_njrat_vidar.exe
2684	2026-08-15_cb700d26bc8a87994c27606e8c5f1a46_elex_icedid_njrat_vidar.exe
2684	2026-08-15_cb700d26bc8a87994c27606e8c5f1a46_elex_icedid_njrat_vidar.exe
2684	2026-08-15_cb700d26bc8a87994c27606e8c5f1a46_elex_icedid_njrat_vidar.exe
2672	svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe
2672	svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe
2672	svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe
2672	svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe
2068	svchost_BBACAAACBACCCBACBBBABCBACABBCBBBCCACCACABCAABABBACBCAAC.exe
2068	svchost_BBACAAACBACCCBACBBBABCBACABBCBBBCCACCACABCAABABBACBCAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	2026-08-15_cb700d26bc8a87994c27606e8c5f1a46_elex_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2672	svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe
Token: SeDebugPrivilege	2068	svchost_BBACAAACBACCCBACBBBABCBACABBCBBBCCACCACABCAABABBACBCAAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1580	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 5020	2684	2026-08-15_cb700d26bc8a87994c27606e8c5f1a46_elex_icedid_njrat_vidar.exe	100
PID 5020 wrote to memory of 5012	5020	cmd.exe	102
PID 2672 wrote to memory of 2696	2672	svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe	103
PID 2696 wrote to memory of 3440	2696	notepad.exe	104
PID 2684 wrote to memory of 3680	2684	2026-08-15_cb700d26bc8a87994c27606e8c5f1a46_elex_icedid_njrat_vidar.exe	106
PID 3680 wrote to memory of 4088	3680	cmd.exe	108
PID 2684 wrote to memory of 872	2684	2026-08-15_cb700d26bc8a87994c27606e8c5f1a46_elex_icedid_njrat_vidar.exe	109
PID 872 wrote to memory of 2776	872	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-15_cb700d26bc8a87994c27606e8c5f1a46_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_cb700d26bc8a87994c27606e8c5f1a46_elex_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBAAAAAACBCBABBAACABBACCCCACBCCBABBCBBACBACBBABBCCCBCBCCCCCCCCABCABAACCAAABAABCACCBAACCCBCBBCBACBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBAAAAAACBCBABBAACABBACCCCACBCCBABBCBBACBACBBABBCCCBCBCCCCCCCCABCABAACCAAABAABCACCBAACCCBCBBCBACBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAABBACCCBACBBBBCBABACCABBCACCBAABBCCACCCACBBCBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe" start= auto displayName= "UserDataSvc_AAAABBACCCBACBBBBCBABACCABBCACCBAABBCCACCCACBBCBAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAABBACCCBACBBBBCBABACCABBCACCBAABBCCACCCACBBCBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe" start= auto displayName= "UserDataSvc_AAAABBACCCBACBBBBCBABACCABBCACCBAABBCCACCCACBBCBAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAABBACCCBACBBBBCBABACCABBCACCBAABBCCACCCACBBCBAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAABBACCCBACBBBBCBABACCABBCACCBAABBCCACCCACBBCBAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3440

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe
1⤵
- Executes dropped EXE
PID:4784

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAAACBACCCBACBBBABCBACABBCBBBCCACCACABCAABABBACBCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAAACBACCCBACBBBABCBACABBCBBBCCACCACABCAABABBACBCAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f8c5709f94fd06246290a8a70cba61ec1dbe37ed6a488be1de3ff8174b37de43
MD5 0dbffd31bdc57ddbab7ac133d04021e5
SHA1 27352bf07e484d3c84cba83837f2fb844d6a6e65
SHA512 79867a0dc2b3865cec4d47ff0d8716167149df53173681756eec1386870d479df1022f6aed2977e74b4c957743ae8efead7de201a7150b32d09503a0f6d5946f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b888784a8bb83d75e48e3d794f93cc2cbe94ae59dc253acab93c1dd61c9b9427
MD5 f96b4bf6bd4a06e4fb8e0b4f4172f21b
SHA1 0a8ea0386629b41805dbcd99c82a628321311ca9
SHA512 c06cd14ce9e848242de5ffeaa8df221a6d45a6526c10093c74a54500036782473af5693ff55928e31e2377c8b95cdef3e1c443e4cdc4a661c89097eb652b0513
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a48621d275b498c7ac008865f1c42499d0f60c6589f1211cc0329446eb0fc451
MD5 04052002330ad37e68efa1e5338ee36f
SHA1 7689fb5de65c8463810724eeb8c40f44fd7cec2a
SHA512 63d1bd4f78dec352029adf443bbdaa5a324a6be3e32a71a06e488cc699b98a16c1470e3bcb05b288783d9f16b5b6be88ad9472f1545953731a96c0181dd284a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5327b1b6c6e1ef004728ba23274c9b87d4bd2e8bc3ec6281e321b51aff53f9c1
MD5 258cc5f024d5a2ae05238489f8c288e0
SHA1 3ef4bc90b1fdb0e2e2e0f4a50eddf902dd0aab38
SHA512 5ec236853a96e91adc50190bfca4dbe4ba8a94bd44dfba6283b9dd747ddde429ff1fbf5e06dde9c93b01609b901e9b38fa85f66ce6b3d9f579ce6b27a40ec795
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 92e0ce9ba2e1077b57750f82bb551bd84d08203c79b4c7bc47ccdf50267d97f8
MD5 31408ff28d509bd32bcfb6f77b0c3515
SHA1 c3f95d203db03bd0fca71395b68ff05487fb468b
SHA512 48c8c1945e0a79c2270b791fc63235e32a39faeff2175a712e4ae4191bedf47c5b6fb3622448ed34c491af1a6a4951bb6e0e40590da66461277fa5439a70c472
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e369f6849643faa41c1d0ecdf17ffd2ba015c1bacb1e3b96deaa5b8c9396a619
MD5 0a0f09f9cd5e964a98e3267e5191b391
SHA1 7c1492531ca7afa467d9a03f60f44ad6d8d5ae4d
SHA512 7e1b70f3078e99f8fb8480e2bcf9b86a48f0c18601f973fa6b2c6feab8076ceec7df792032d22cc4a3fa7e9133330ae9b2effc55a7bce8d2b571ecf1a051e820
MD5 SHA1 SHA512

Submit Download

svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBAABCBBACCABCACACACCCBACCBCBCBCCCCABCBCAABBBCCBABC.exe
Size 478KB
SHA256 5da4932b00c256ea2876b51d11924f6f622642d52704aa456740288887c8159f
MD5 cb700d26bc8a87994c27606e8c5f1a46
SHA1 80a0ff76739e6d8ba6e0b5ba302fb1a7a6bd8abb
SHA512 846e4bff33345a8f83c8d4a2c7839edcafc07e71e1ef2ceca479bf899df14d3ef7fb54ebd5d573724416722c9f2e39492f09b317db31326fd7d0a95610b4ab0a
SSDEEP 12288:mgUFgEsnojA9gBLUeDuUlICrCB1igsNBfcsc+ZOnZxP:m9+EM0qWU/slZOZZ
TLSH
T154A47C09B6A114F5D9B78530895BD236DB71BD210B20DBAF9394D23B9F33B90AC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 8a060c466dec645137642eb89b9a05d25c9f940a99f390d1ccb5be7abdd85bde
MD5 b1cb9aef5b5b4130c8b697622679dc68
SHA1 b80493abb49478b40f8a8b2f59b35ce287979b68
SHA512 abdd8b87966b5036df640347ccd942e7534f6ddcfe1f4dd4d52202bc5586af93e6f3218fafb4317eb8f19929146b725c855527e17e89f0c0d13f08c017f02aed
TLSH
T11A110460E9F5D863F832649F661D9FC309E5778FAC586A04330D8208EBD5C36CE094D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2068-89-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/2672-39-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2672-26-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2684-0-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/2684-7-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/2696-60-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Download

memory/4784-84-0x0000000000400000-0x0000000000421000-memory.dmp

Download