1eb3c9e79532d3f1f929940b36113774bf31d388dec3fe6533203545a623aebe

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 02:06

Target
2026-08-14_eea725474c5a49629819b7a7402ab934_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 7.3MB
Sample260815-cjnv5sxane
SHA256 1eb3c9e79532d3f1f929940b36113774bf31d388dec3fe6533203545a623aebe
MD5 eea725474c5a49629819b7a7402ab934
SHA1 0f9a5a5d00f380c3a35ed464b7b361741a86ac65
SHA512 b5c95a79b0c96a2460a68f2b8d07a0e146b085a7776a05064bc28541538eb3f655c70c3c841ec2b28800c959e520ed9fa7ceb7008f7ca42136793f0353064ef9
SSDEEP 196608:FIcteBDRhEzWAcpWtpacuvMzIuvx8ku5yAu:LteBcyAsWtQvMJakugAu
TLSH
T16076234933A442ADFFA7E276CA23C507D7B1784642768A2F02A46B753F337715A2E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5064 set thread context of 5080	5064	2026-08-14_eea725474c5a49629819b7a7402ab934_agent-tesla_amadey_icedid_njrat_vidar.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 5080	5064	2026-08-14_eea725474c5a49629819b7a7402ab934_agent-tesla_amadey_icedid_njrat_vidar.exe	89
PID 5064 wrote to memory of 5080	5064	2026-08-14_eea725474c5a49629819b7a7402ab934_agent-tesla_amadey_icedid_njrat_vidar.exe	89
PID 5064 wrote to memory of 5080	5064	2026-08-14_eea725474c5a49629819b7a7402ab934_agent-tesla_amadey_icedid_njrat_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-14_eea725474c5a49629819b7a7402ab934_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_eea725474c5a49629819b7a7402ab934_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Local\Temp\2026-08-14_eea725474c5a49629819b7a7402ab934_agent-tesla_amadey_icedid_njrat_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_eea725474c5a49629819b7a7402ab934_agent-tesla_amadey_icedid_njrat_vidar.exe"
  2⤵
  PID:5080