af8b092afc378a2ae07e93764571a9f180296db362706166a684b5581e5edfd0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe
Size 1.6MB
Sample260816-eavnfacm9z
SHA256 af8b092afc378a2ae07e93764571a9f180296db362706166a684b5581e5edfd0
MD5 c3abeeb0c1627613e8506836f26b602f
SHA1 f0dcc1212a281e3ae7c744a872b53e1d695dd675
SHA512 4d0b865a9e4410455aed20d8c2993759e033f903b1fcc8155710178d57c6ce87136098876040307061f651a8141ba64169e08e2e97dc2b495f2b93e7c3c7c4ad
SSDEEP 24576:m9+EM01Tiw2TUslZOZe9+EM01Tiw2TUslZOZoenbtkJxdmvY:U+EPiw2XB+EPiw2XVenbYdmA
TLSH
T1E8853A05B7E849B5E5B3A23489B28265DAB3BC515B31C7CF3254B62E2F336D0AC74B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral1/files/0x00050000000234a1-21.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2492	svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe
2172	svchost_BACABBACBCCCABCABACAAABAAAACCCCCBCACBAABCBBABBBBBABBABA.exe
4108	svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CABABAACCBBABBAACBCAAACBBBACCBBABCACBACCBCBCACBBBBAACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe"	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACAABCBCABBCBBBACBACACBCCCACCCABAACBBCABAAAABABBABCCCBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACABBACBCCCABCABACAAABAAAACCCCCBCACBAABCBBABBBBBABBABA.exe"	svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4136	sc.exe
4256	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4916	cmd.exe
2392	cmd.exe
4216	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACABBACBCCCABCABACAAABAAAACCCCCBCACBAABCBBABBBBBABBABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2032	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe
2032	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe
2032	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe
2032	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe
2492	svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe
2492	svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe
2492	svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe
2492	svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe
2172	svchost_BACABBACBCCCABCABACAAABAAAACCCCCBCACBAABCBBABBBBBABBABA.exe
2172	svchost_BACABBACBCCCABCABACAAABAAAACCCCCBCACBAABCBBABBBBBABBABA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2492	svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe
Token: SeDebugPrivilege	2172	svchost_BACABBACBCCCABCABACAAABAAAACCCCCBCACBAABCBBABBBBBABBABA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1500	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 4916	2032	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe	105
PID 4916 wrote to memory of 1268	4916	cmd.exe	107
PID 2492 wrote to memory of 4024	2492	svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe	111
PID 4024 wrote to memory of 3376	4024	notepad.exe	112
PID 2032 wrote to memory of 2392	2032	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe	116
PID 2392 wrote to memory of 4136	2392	cmd.exe	118
PID 2032 wrote to memory of 4216	2032	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe	119
PID 4216 wrote to memory of 4256	4216	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBCABABBCCACBABAAABCCABBCBCCABCBAAABCBAAACCCACCACACAACCABACCBBBBABBACABBCCCCBBCCACAABBCCABCBAAACCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBCABABBCCACBABAAABCCABBCBCCABCBAAABCBAAACCCACCACACAACCABACCBBBBABBACABBCCCCBBCCACAABBCCABCBAAACCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCBCBACBACCCACCCAAAAACABCBAAABBBBBCACBBCBCBBACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe" start= auto displayName= "UserDataSvc_CBACCBCBACBACCCACCCAAAAACABCBAAABBBBBCACBBCBCBBACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACCBCBACBACCCACCCAAAAACABCBAAABBBBBCACBBCBCBBACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe" start= auto displayName= "UserDataSvc_CBACCBCBACBACCCACCCAAAAACABCBAAABBBBBCACBBCBCBBACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCBCBACBACCCACCCAAAAACABCBAAABBBBBCACBBCBCBBACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACCBCBACBACCCACCCAAAAACABCBAAABBBBBCACBBCBCBBACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4256

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3376

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABBACBCCCABCABACAAABAAAACCCCCBCACBAABCBBABBBBBABBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABBACBCCCABCABACAAABAAAACCCCCBCACBAABCBBABBBBBABBABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe
1⤵
- Executes dropped EXE
PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 482c1b14a4fc5c23fda61356eb83e52075013363c0e442a6427d63aa9a60c41a
MD5 d824d772adf008343e711f2ce398805e
SHA1 b548dcc5e80d2c750e5cf6a0c4b1fdd4cc3ee4b6
SHA512 fea4f6da47b16922d93b8881aa18697cea7f0cad4f99d746f6e7f702a5681a70c7236f062aed6fca7241bcd33cb2949218ee3f67db19ae231302a8e33722bf0c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 917b969d80404871764e2755783a3204ca8c9291c016d67e0d77339a1a1f9707
MD5 c0fb4bd9add07506833e43a18e9a2c60
SHA1 050efa4b6d8a605a573b15ec3e3299c082294501
SHA512 f76a1582f70305b143d411e196ffdc90df518a5c3d489f5f8303295decac54b2ce434fb545b917b4aa2bcea08c406f57899c981c83bb645d8ea97a4235a27b85
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2da2cb97e49bbce51481e89e027e71614954162902edd29827e2e33a634209de
MD5 86c0f8a837a0ef5dc8eff6dc19b6598d
SHA1 e0e0c104b2a55c4cd4ba5de3b16e97905217128a
SHA512 b2b1fd1a955b036fd6e672d0546325562fabf9515d151147c17f87d63806f68f1ef22a0b58f0430a9a14c22fba4e1b81f935b5519853bc942c5a5ec3813baf7a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fc2e6b34adcc63c9382a00cd10774ad03fbcb893c06aaf6ec7ff263d9c41e528
MD5 0d32f927adef76bd78ae19c6a707ef7b
SHA1 5625b4be9b65ea9f7188793353d640133d5f61b2
SHA512 e41e679cea74d728c3f5ceb42682caf24cabe880786f31b082034dd3d35502424f37cccffd0c91cdb15a03173f26b64e2e70b3a2743eef11d70b8c310d363d0d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0fbaa4d9548298f635bc167b67be1297c2ae5aecdceaf1974b06df9a9a4a3241
MD5 6165ff8f6733835aea3eadc346743ab6
SHA1 5a1f874ca5eeb2d82d268a692309dd9c892223ed
SHA512 e62ff901aa4cc2e0b3228648aaf7d95f6324307350395f0479eaaf329ecdf181c078e4471379a45686f56e7abab2819a7d2d1431df0bc9bce9d8546d55005e16
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 55ba7c3ab4fab4ba429c0092c1b16a398e5f8ceae741134801f62204270e2fda
MD5 abbcaa9576cc3e4e3d33af61030c98be
SHA1 d7a815b8dd6ce0c08e773fe8fcde746d7e9083f2
SHA512 1c0b39bac04cedd72dcf7723c66c8008131d63e4172438648e62c33ec422a38d09abc2c17fa2d357f16fd7f63aba5537d3bff34a859bbfa1e218f02c85ba9c7f
MD5 SHA1 SHA512

Submit Download

svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBAACBACBBBAACCBBAACCACBABBCCABBBBCCBBCCBBACBCABC.exe
Size 1.6MB
SHA256 af8b092afc378a2ae07e93764571a9f180296db362706166a684b5581e5edfd0
MD5 c3abeeb0c1627613e8506836f26b602f
SHA1 f0dcc1212a281e3ae7c744a872b53e1d695dd675
SHA512 4d0b865a9e4410455aed20d8c2993759e033f903b1fcc8155710178d57c6ce87136098876040307061f651a8141ba64169e08e2e97dc2b495f2b93e7c3c7c4ad
SSDEEP 24576:m9+EM01Tiw2TUslZOZe9+EM01Tiw2TUslZOZoenbtkJxdmvY:U+EPiw2XB+EPiw2XVenbYdmA
TLSH
T1E8853A05B7E849B5E5B3A23489B28265DAB3BC515B31C7CF3254B62E2F336D0AC74B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 b96ccdd2015b885c9e16de32a4d9b15ea006aa35a7061b2a69798c925fa7f4d8
MD5 367e006b31fc8e51296301f7f273a0da
SHA1 be4d687562e3bb83726bf50c41a29a98d7dda56d
SHA512 720a17ca0dc6fa51237b8a6eadd38ee2f2bfc973d644e68ee2eeeecfbb5cdf250f2216a6cbf11cb598c05179f15ac068fa9ef2c51ed090a1bb2e90914e0f6ddc
TLSH
T158119850F8B5D8D7ED3228DA9B2E8FC20CDD3B97685C6A2423058619E789C738D154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2032-0-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download

memory/2032-7-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download

memory/2172-78-0x0000000000530000-0x0000000000551000-memory.dmp

Download

memory/2492-36-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/2492-26-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/4024-59-0x0000000005A80000-0x0000000005A81000-memory.dmp

Download

memory/4108-80-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download