Analysis
- max time kernel
148s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/08/2026, 01:58
General
- Target 2026-08-18_a7275178dd447b9e321d9facc3f2d1b9_icedid_njrat_vidar.exe
- Size 2.6MB
- Sample260818-cd89wseg89
- SHA256 1644f2b9e4393a3d0b4ad8cda82fd1bb4d3e72fca677aa157b0326655dc7a5a8
Malware Config
Signatures
- UPX dump on OEP (original entry point) 9 IoCs
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-18_a7275178dd447b9e321d9facc3f2d1b9_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-18_a7275178dd447b9e321d9facc3f2d1b9_icedid_njrat_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-18_a7275178dd447b9e321d9facc3f2d1b9_icedid_njrat_vidar.exeC:\Users\Admin\AppData\Local\Temp\2026-08-18_a7275178dd447b9e321d9facc3f2d1b9_icedid_njrat_vidar.exe 410238025E02570271026702700271025E02430266026F026B026C025E0243027202720246026302760263025E0250026D0263026F026B026C0265025E026602700264026C0260026602700276026C026F026F025E02360252023A0270026902320278023B0251024E025D02530247027B023102310265025E0233024D02350235024602690275023602--a\k\`2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\drfnbdrtnmm\4P8rk0z9SL_QEy33g\1O77Dkw4.exe"C:\Users\Admin\AppData\Roaming\drfnbdrtnmm\4P8rk0z9SL_QEy33g\1O77Dkw4.exe"3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1O77Dkw4.exe
1O77Dkw4.txt
vjsc.dll
memory/5220-15-0x0000000000B60000-0x0000000000B61000-memory.dmp
memory/5220-22-0x0000000010000000-0x0000000010068000-memory.dmp
memory/5220-13-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/5220-16-0x0000000010000000-0x0000000010068000-memory.dmp
memory/5220-17-0x0000000010000000-0x0000000010068000-memory.dmp
memory/5220-18-0x0000000002990000-0x0000000002A77000-memory.dmp
memory/5220-19-0x0000000002990000-0x0000000002A77000-memory.dmp
memory/5220-12-0x0000000010000000-0x0000000010068000-memory.dmp
memory/5220-21-0x0000000002990000-0x0000000002A77000-memory.dmp
memory/5220-14-0x00000000006F0000-0x00000000006F1000-memory.dmp
memory/5220-23-0x0000000004400000-0x0000000004614000-memory.dmp
memory/5220-27-0x0000000004E50000-0x0000000004FC5000-memory.dmp
memory/5220-29-0x0000000004B40000-0x0000000004C2B000-memory.dmp
memory/5220-32-0x0000000002990000-0x0000000002A77000-memory.dmp
memory/5220-31-0x0000000004650000-0x0000000004651000-memory.dmp
memory/5220-33-0x0000000004400000-0x0000000004614000-memory.dmp
memory/5220-34-0x0000000004AC0000-0x0000000004B12000-memory.dmp
memory/5220-35-0x0000000004400000-0x0000000004614000-memory.dmp