Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/08/2026, 04:34
General
- Target 2026-08-16_54f32cb85a4f82dd1c94383d3c6b57f8_cobalt-strike_icedid_njrat_vidar.exe
- Size 840KB
- Sample260816-e7ecqadj7v
- SHA256 56756163ed901f56f4c77a481a5dca3fb43a81c3c2e0166b5e2d37af010a042d
Malware Config
Signatures
- Executes dropped EXE 21 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 26 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_54f32cb85a4f82dd1c94383d3c6b57f8_cobalt-strike_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_54f32cb85a4f82dd1c94383d3c6b57f8_cobalt-strike_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/1152-241-0x00007FF6BB610000-0x00007FF6BB6D8000-memory.dmp
memory/1152-319-0x00007FF6BB610000-0x00007FF6BB6D8000-memory.dmp
memory/1152-250-0x000002C88A0E0000-0x000002C88A146000-memory.dmp
memory/1152-251-0x000002C88A0E0000-0x000002C88A146000-memory.dmp
memory/1604-57-0x000001B21D600000-0x000001B21D666000-memory.dmp
memory/1604-56-0x000001B21D600000-0x000001B21D666000-memory.dmp
memory/1604-55-0x000001B21D410000-0x000001B21D4C3000-memory.dmp
memory/2504-320-0x00007FF7E76B0000-0x00007FF7E7953000-memory.dmp
memory/2504-322-0x000001C78F3E0000-0x000001C78F446000-memory.dmp
memory/2504-321-0x000001C78F3E0000-0x000001C78F446000-memory.dmp
memory/2620-358-0x00007FF79C0E0000-0x00007FF79C5B0000-memory.dmp
memory/2620-360-0x00000256CA340000-0x00000256CA3A6000-memory.dmp
memory/2620-359-0x00000256CA340000-0x00000256CA3A6000-memory.dmp
memory/2964-0-0x00007FF6CFAE0000-0x00007FF6CFC3F000-memory.dmp
memory/2964-22-0x00007FF6CFAE0000-0x00007FF6CFC3F000-memory.dmp
memory/2964-1-0x0000021EEA680000-0x0000021EEA6E6000-memory.dmp
memory/2964-3-0x0000021EEA680000-0x0000021EEA6E6000-memory.dmp
memory/2964-20-0x0000021EEA680000-0x0000021EEA6E6000-memory.dmp
memory/3284-246-0x00000270D7EB0000-0x00000270D7F16000-memory.dmp
memory/3284-245-0x00000270D7EB0000-0x00000270D7F16000-memory.dmp
memory/3284-328-0x00007FF6C3F30000-0x00007FF6C4049000-memory.dmp
memory/3284-244-0x00007FF6C3F30000-0x00007FF6C4049000-memory.dmp
memory/3712-232-0x00007FF6BB610000-0x00007FF6BB6D8000-memory.dmp
memory/3712-234-0x0000022DF3610000-0x0000022DF3676000-memory.dmp
memory/3712-233-0x0000022DF3610000-0x0000022DF3676000-memory.dmp
memory/3712-309-0x00007FF6BB610000-0x00007FF6BB6D8000-memory.dmp
memory/3844-52-0x00007FF697290000-0x00007FF6973F8000-memory.dmp
memory/3844-50-0x00000238FEB40000-0x00000238FEBA6000-memory.dmp
memory/3844-45-0x00000238FEB40000-0x00000238FEBA6000-memory.dmp
memory/3844-44-0x00000238FEB40000-0x00000238FEBA6000-memory.dmp
memory/3844-43-0x00007FF697290000-0x00007FF6973F8000-memory.dmp
memory/3968-329-0x00000265CF340000-0x00000265CF3A6000-memory.dmp
memory/3968-331-0x00000265CF340000-0x00000265CF3A6000-memory.dmp
memory/3968-330-0x00007FF6DAE50000-0x00007FF6DAFE4000-memory.dmp
memory/4356-292-0x00000203A4CD0000-0x00000203A4D36000-memory.dmp
memory/4356-291-0x00000203A4CD0000-0x00000203A4D36000-memory.dmp
memory/4356-290-0x00007FF6672D0000-0x00007FF66737D000-memory.dmp
memory/4356-373-0x00007FF6672D0000-0x00007FF66737D000-memory.dmp
memory/4584-37-0x0000021998200000-0x0000021998266000-memory.dmp
memory/4584-35-0x0000021998200000-0x0000021998266000-memory.dmp
memory/4584-36-0x0000021998200000-0x0000021998266000-memory.dmp
memory/4584-34-0x0000021998020000-0x00000219980D3000-memory.dmp
memory/4648-26-0x0000026449F00000-0x0000026449F66000-memory.dmp
memory/4648-29-0x0000026449F00000-0x0000026449F66000-memory.dmp
memory/4648-25-0x0000026449D10000-0x0000026449DC3000-memory.dmp
memory/4648-27-0x0000026449F00000-0x0000026449F66000-memory.dmp
memory/4700-283-0x000001B06D330000-0x000001B06D396000-memory.dmp
memory/4700-367-0x00007FF6B6FE0000-0x00007FF6B7723000-memory.dmp
memory/4700-284-0x00007FF6B6FE0000-0x00007FF6B7723000-memory.dmp
memory/4700-282-0x000001B06D330000-0x000001B06D396000-memory.dmp
memory/4704-350-0x000002201D4A0000-0x000002201D506000-memory.dmp
memory/4704-355-0x00007FF736AC0000-0x00007FF736D4A000-memory.dmp
memory/4704-351-0x000002201D4A0000-0x000002201D506000-memory.dmp
memory/4724-13-0x0000021D575D0000-0x0000021D57636000-memory.dmp
memory/4724-61-0x00007FF72D780000-0x00007FF72D8A2000-memory.dmp
memory/4724-11-0x00007FF72D780000-0x00007FF72D8A2000-memory.dmp
memory/4724-14-0x0000021D575D0000-0x0000021D57636000-memory.dmp
memory/4724-12-0x0000021D575D0000-0x0000021D57636000-memory.dmp
memory/4784-264-0x00000199FAAB0000-0x00000199FAB16000-memory.dmp
memory/4784-337-0x00007FF73BEE0000-0x00007FF73C029000-memory.dmp
memory/4784-263-0x00000199FAAB0000-0x00000199FAB16000-memory.dmp
memory/4784-261-0x00007FF73BEE0000-0x00007FF73C029000-memory.dmp
memory/4996-366-0x0000025E53320000-0x0000025E53386000-memory.dmp
memory/4996-369-0x00007FF754260000-0x00007FF754766000-memory.dmp
memory/4996-368-0x0000025E53320000-0x0000025E53386000-memory.dmp
memory/5012-271-0x00000000008C0000-0x0000000000929000-memory.dmp
memory/5012-270-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/5012-349-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/5012-276-0x00000000008C0000-0x0000000000929000-memory.dmp
memory/5124-379-0x0000023064A20000-0x0000023064A86000-memory.dmp
memory/5124-377-0x00007FF7F25F0000-0x00007FF7F271E000-memory.dmp
memory/5124-378-0x0000023064A20000-0x0000023064A86000-memory.dmp
memory/5520-310-0x00007FF6C9B80000-0x00007FF6C9C33000-memory.dmp
memory/5520-312-0x00000223525C0000-0x0000022352626000-memory.dmp
memory/5520-311-0x00000223525C0000-0x0000022352626000-memory.dmp
memory/5832-300-0x0000022CC7070000-0x0000022CC70D6000-memory.dmp
memory/5832-299-0x00007FF746500000-0x00007FF746916000-memory.dmp
memory/5832-301-0x0000022CC7070000-0x0000022CC70D6000-memory.dmp
memory/5920-338-0x00007FF75C420000-0x00007FF75C740000-memory.dmp
memory/5920-340-0x0000014EA6570000-0x0000014EA65D6000-memory.dmp
memory/5920-339-0x0000014EA6570000-0x0000014EA65D6000-memory.dmp
memory/5920-344-0x0000014EA6570000-0x0000014EA65D6000-memory.dmp
memory/5920-346-0x00007FF75C420000-0x00007FF75C740000-memory.dmp