af8b092afc378a2ae07e93764571a9f180296db362706166a684b5581e5edfd0

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe
Size 1.6MB
Sample260816-eavnfacm9z
SHA256 af8b092afc378a2ae07e93764571a9f180296db362706166a684b5581e5edfd0
MD5 c3abeeb0c1627613e8506836f26b602f
SHA1 f0dcc1212a281e3ae7c744a872b53e1d695dd675
SHA512 4d0b865a9e4410455aed20d8c2993759e033f903b1fcc8155710178d57c6ce87136098876040307061f651a8141ba64169e08e2e97dc2b495f2b93e7c3c7c4ad
SSDEEP 24576:m9+EM01Tiw2TUslZOZe9+EM01Tiw2TUslZOZoenbtkJxdmvY:U+EPiw2XB+EPiw2XVenbYdmA
TLSH
T1E8853A05B7E849B5E5B3A23489B28265DAB3BC515B31C7CF3254B62E2F336D0AC74B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c437-20.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3100	svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe
1420	svchost_BACCACBCACAACCACCBBCABACBAABCCACCBBCCCACBCABBCCABABACAA.exe
3368	svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACCBCBCABBCBAABABABCACACCCBBCAABCACCBCCCCAAACBABBACBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCACBCACAACCACCBBCABACBAABCCACCBBCCCACBCABBCCABABACAA.exe"	svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBABAAAABACBACACACCCACBACACCCCCBBCABBBBBAABCCCABABCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe"	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2340	sc.exe
3484	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4996	cmd.exe
3292	cmd.exe
6004	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCACBCACAACCACCBBCABACBAABCCACCBBCCCACBCABBCCABABACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4528	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe
4528	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe
4528	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe
4528	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe
3100	svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe
3100	svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe
3100	svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe
3100	svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe
1420	svchost_BACCACBCACAACCACCBBCABACBAABCCACCBBCCCACBCABBCCABABACAA.exe
1420	svchost_BACCACBCACAACCACCBBCABACBAABCCACCBBCCCACBCABBCCABABACAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4528	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3100	svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe
Token: SeDebugPrivilege	1420	svchost_BACCACBCACAACCACCBBCABACBAABCCACCBBCCCACBCABBCCABABACAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 4996	4528	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe	92
PID 4996 wrote to memory of 6112	4996	cmd.exe	94
PID 3100 wrote to memory of 1396	3100	svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe	95
PID 4528 wrote to memory of 3292	4528	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe	98
PID 3292 wrote to memory of 3484	3292	cmd.exe	100
PID 4528 wrote to memory of 6004	4528	2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe	101
PID 6004 wrote to memory of 2340	6004	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_c3abeeb0c1627613e8506836f26b602f_elex_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAACBCCACBCCBABACBCBCCCBAABAABCABBBBCAACCBCCCACCBCBAABCBBACABBAACBCBABCCBACACBBCBACAABCCCBACABACCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAACBCCACBCCBABACBCBCCCBAABAABCABBBBCAACCBCCCACCBCBAABCBBACABBAACBCBABCCBACACBBCBACAABCCCBACABACCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACBBCCBBAAABAABCBABACACCCBCCAAACACBBACABAACACCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe" start= auto displayName= "UserDataSvc_CCACBBCCBBAAABAABCBABACACCCBCCAAACACBBACABAACACCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACBBCCBBAAABAABCBABACACCCBCCAAACACBBACABAACACCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe" start= auto displayName= "UserDataSvc_CCACBBCCBBAAABAABCBABACACCCBCCAAACACBBACABAACACCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACBBCCBBAAABAABCBABACACCCBCCAAACACBBACABAACACCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACBBCCBBAAABAABCBABACACCCBCCAAACACBBACABAACACCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2340

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCACBCACAACCACCBBCABACBAABCCACCBBCCCACBCABBCCABABACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCACBCACAACCACCBBCABACBAABCCACCBBCCCACBCABBCCABABACAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe
1⤵
- Executes dropped EXE
PID:3368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 16e19241a103c6afb0a240ffd22c70993ecfddab12508f3179db5f58497ed729
MD5 9077ae4c1f93276e6f2d2638408d36a0
SHA1 ce7446275532d2f4078438bbc3f0a0a54036f9a8
SHA512 4aef3218105f68507f4f20235b8207dcb3809c5978af7780c1572f7305802e9a71a1ea7b23306b51fef5a412288287d82701e29f0ff086221ea3a69c1de19ccf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4380e658af803c34caeeaa91af366e342a16357754c0f65a7c4728b34bdb7778
MD5 62c03534cce1ace63e64b6aa3944a5ff
SHA1 93a8026a070669539e05b0066dfd2b8d97ad7014
SHA512 822c61a5a1edd0e8f01e6a95dc60a1c559682d7f1ae77af7489360bd43292742e39add647ca70ddedf964e1d74093fcddc0f2eddab46179245d7bebcfb1bf21e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 374070899bdc7bcc92243a896a5068a83ed3c761437385b5144c49c16e88a43b
MD5 a1d4fab95005ab890052020f2824f926
SHA1 5996fecf2f7756169d83643997f4398977b5e548
SHA512 675e0b60c8100b78c6caec3462a04f239899a66b26849914baf330c2950803435d3e86da0b1dec9221746f14d2bb1ac0954ad82ee1b97038aa4493ec7bfad35b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 075b47fc5e83887746a1e756380cd36a13f12d21f50444de8d10b7386e040d3a
MD5 cfb15f19829388b68e2203135b5a4aab
SHA1 25a42a69697a4722c714062b5184edaeaa0a244d
SHA512 078ca30dc0ae5b04e54cfea08a5c1a9e50c7c82b7539ae5ffc60feda26037150548ff01d216d85e881bde7349c5518a98930aba2fe2b8cc833e3042da06dce7f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c6515aa3b1fd496caef56fbd99a36e075df87ab82d4665508af3d1ed21376316
MD5 0a057ab7c7037a5bebfdb4cdd061e440
SHA1 777c646cee97e1e3f93c9f9b6a10106eff5aacd5
SHA512 1369e5b0441a5aaffe51b7f7fbbe303fc44aba9c3d0f99d8d4a2ef2cb80d02d14fd1eba39467c16ff2c3f09dc875904ab5ae40937054dda216b15fb518b3d26c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ef342f8f85609e8e969e0a07ccf12f20d6cfef3d23c66f5dead2e6d9a0b9a638
MD5 74cb1e9deffa1a0c56faaa0b03bb1daa
SHA1 585732933166d601dbc9ed1ecf5028af75e76fc0
SHA512 0ef64d772949381a514b39879cde2cf4fe79f8b32bca14072c6d24404aa995429402bbf9961ffb225dd5a32950cafe59ace8d63bb61c39a328ed27579311fa65
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d73877987fd8e2e4cf889827ae2420298cd4a9c5c4ac82d2ae309e79176e7aee
MD5 e4c1d00645e830dddb366c3d87b6fa1f
SHA1 302f7b75f879aa39025b1a77a82af828219fd279
SHA512 90b8ce92685c9d59d209ba13d833f4738cec4dc00936c363d4f6319e9d87a76a69d1e8b6e550ade6ae1c36321832a6a4c11dbf83b8cbd4ba734cbfbfc02d8f0e
MD5 SHA1 SHA512

Submit Download

svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBCCCACCBCCCBCCCCBCCCCACBBAACCBCCBBBBACBAAAABBCBA.exe
Size 1.6MB
SHA256 af8b092afc378a2ae07e93764571a9f180296db362706166a684b5581e5edfd0
MD5 c3abeeb0c1627613e8506836f26b602f
SHA1 f0dcc1212a281e3ae7c744a872b53e1d695dd675
SHA512 4d0b865a9e4410455aed20d8c2993759e033f903b1fcc8155710178d57c6ce87136098876040307061f651a8141ba64169e08e2e97dc2b495f2b93e7c3c7c4ad
SSDEEP 24576:m9+EM01Tiw2TUslZOZe9+EM01Tiw2TUslZOZoenbtkJxdmvY:U+EPiw2XB+EPiw2XVenbYdmA
TLSH
T1E8853A05B7E849B5E5B3A23489B28265DAB3BC515B31C7CF3254B62E2F336D0AC74B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 40f86ed640e930a8fbb0fc9c7ff3546bab049093b01aa9db9cd2bf8c51f1b27e
MD5 df54e7e52af2a23a1dd51338291676e4
SHA1 fbb114ca80bc43981b150b518a5295d0b467119e
SHA512 5e8dc7adfc579425c0a243f211683500d019f960fbb44026c0d4d35bf8e0bc81e37b580ef3a5b6b60fac5099d514bb37b65100a1349703d906cda77f1d95ec9a
TLSH
T14B117B44F5F5D863E92268DF652F8E920CE13BFB6C986A242308D218FB45C738E154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1420-74-0x0000000000620000-0x0000000000641000-memory.dmp

Download

memory/3100-34-0x0000000000860000-0x0000000000881000-memory.dmp

Download

memory/4528-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4528-8-0x0000000000400000-0x0000000000421000-memory.dmp

Download