b813d2252e8db1532a224620dcd22a6499d30a0f04e8e7cc3c9559c8bffd1649

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_1029d8f8057bd8168d40ec9c8375ecdf_elex_icedid_njrat_vidar.exe
Size 42.6MB
Sample260819-cmvg4avdph
SHA256 b813d2252e8db1532a224620dcd22a6499d30a0f04e8e7cc3c9559c8bffd1649
MD5 1029d8f8057bd8168d40ec9c8375ecdf
SHA1 01903aff11bb5eabc478b9cf424f3d9aa92ada34
SHA512 3d8d0c4dd62e57ce4ab74607c9518065567f66001c083a176c3e20101f540fac08ed7eeacba2121669e326031acbf41ac58605673060fed0f93cd0f8eb06b268
SSDEEP 49152:U+ES+EW5+ES+ES+ES+EW5+ES+ES+ES+EW0iw2g+ES+ES+EW5+ES+ES+ES+EW5+ED:Hooooooo64TZ
TLSH
T1A5A76C09F98744B1E97B51704DDBC2BE8A70BA1187228EEBF649C71F6933BE06834715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c415-20.dat	INDICATOR_EXE_Packed_Fody

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5352	svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe
2868	svchost_BAACCCCCABBBBCCAABCBBABCAABBBAACACCBACCCBACCACBBCCCBBBC.exe
2836	svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCABAACABAACCAABBBBCACABCCCABACBBCABBCABBCBBBCBBCBCBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACCCCCABBBBCCAABCBBABCAABBBAACACCBACCCBACCACBBCCCBBBC.exe"	svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAABBBABCCBABBBBBBABCCCCCBCAAAABBCBCABAAAACAACBACCCBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe"	2026-08-19_1029d8f8057bd8168d40ec9c8375ecdf_elex_icedid_njrat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3996	sc.exe
3336	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2828	cmd.exe
3524	cmd.exe
5988	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACCCCCABBBBCCAABCBBABCAABBBAACACCBACCCBACCACBBCCCBBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_1029d8f8057bd8168d40ec9c8375ecdf_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3212	2026-08-19_1029d8f8057bd8168d40ec9c8375ecdf_elex_icedid_njrat_vidar.exe
3212	2026-08-19_1029d8f8057bd8168d40ec9c8375ecdf_elex_icedid_njrat_vidar.exe
3212	2026-08-19_1029d8f8057bd8168d40ec9c8375ecdf_elex_icedid_njrat_vidar.exe
3212	2026-08-19_1029d8f8057bd8168d40ec9c8375ecdf_elex_icedid_njrat_vidar.exe
5352	svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe
5352	svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe
5352	svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe
5352	svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe
2868	svchost_BAACCCCCABBBBCCAABCBBABCAABBBAACACCBACCCBACCACBBCCCBBBC.exe
2868	svchost_BAACCCCCABBBBCCAABCBBABCAABBBAACACCBACCCBACCACBBCCCBBBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3212	2026-08-19_1029d8f8057bd8168d40ec9c8375ecdf_elex_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5352	svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe
Token: SeDebugPrivilege	2868	svchost_BAACCCCCABBBBCCAABCBBABCAABBBAACACCBACCCBACCACBBCCCBBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 2828	3212	2026-08-19_1029d8f8057bd8168d40ec9c8375ecdf_elex_icedid_njrat_vidar.exe	92
PID 2828 wrote to memory of 2808	2828	cmd.exe	94
PID 5352 wrote to memory of 6140	5352	svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe	95
PID 3212 wrote to memory of 3524	3212	2026-08-19_1029d8f8057bd8168d40ec9c8375ecdf_elex_icedid_njrat_vidar.exe	98
PID 3524 wrote to memory of 3996	3524	cmd.exe	100
PID 3212 wrote to memory of 5988	3212	2026-08-19_1029d8f8057bd8168d40ec9c8375ecdf_elex_icedid_njrat_vidar.exe	101
PID 5988 wrote to memory of 3336	5988	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-19_1029d8f8057bd8168d40ec9c8375ecdf_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_1029d8f8057bd8168d40ec9c8375ecdf_elex_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCBCBBAABACABBCBBBBACACBBAABBAACABBAAAAAAAAABBCBAAAABACACBBBABAACACAACCCCBABBAABBAABCCCBCCCAABBBBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCBCBBAABACABBCBBBBACACBBAABBAACABBAAAAAAAAABBCBAAAABACACBBBABAACACAACCCCBABBAABBAABCCCBCCCAABBBBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBAABABCCCCBAACCCCBACACABBAAAABACCAACAACCCBACAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe" start= auto displayName= "UserDataSvc_CACBAABABCCCCBAACCCCBACACABBAAAABACCAACAACCCBACAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBAABABCCCCBAACCCCBACACABBAAAABACCAACAACCCBACAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe" start= auto displayName= "UserDataSvc_CACBAABABCCCCBAACCCCBACACABBAAAABACCAACAACCCBACAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBAABABCCCCBAACCCCBACACABBAAAABACCAACAACCCBACAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBAABABCCCCBAACCCCBACACABBAAAABACCAACAACCCBACAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3336

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5352
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6140

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCCABBBBCCAABCBBABCAABBBAACACCBACCCBACCACBBCCCBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCCABBBBCCAABCBBABCAABBBAACACCBACCCBACCACBBCCCBBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe
1⤵
- Executes dropped EXE
PID:2836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8959c9345b790d21717f23971f8c471a686dd11692498e796a2f8f81f2a29097
MD5 fa51c54be4858f388b5ab5ad651b24e7
SHA1 768d47705746a821819358f20c4184fafe5f9c55
SHA512 bfc650e88030b024c8f836252cb6316cf6c67731148ce7df6be27bb78fb0007210df63eb43c4e74379ee4a11e677ef97b62429591d98750124061cd9c3693b31
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a7dba76c82d4691de29dfd57d821254dd1707d56add2f6ff86eacc6030f37118
MD5 5f92a2d18555f5f72496a67e6a064de3
SHA1 f419969b13a92934f26ff6c82f7f383cb12275a7
SHA512 af6967eb8c413946125945bd951a24059df584e2cead1d3b446314a3ef5c28b8838596b85907aa3fee079949c773a5b64ff0f179bbe22c5eb9f23ccdc2eaa49c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d388e0612414f9b04490747f35935ce453673d3ebaf48bbb8d1d13dfd9d01fa6
MD5 88c73a66049b266507d8ade8735d359e
SHA1 df90d8af18e46f05cd4653d0fa74845263cb8b71
SHA512 9e1d219187c13f210a36f873f857c94d74f313ba41b8efdc880abfa794171d1a86fcc3eb432c3f352813eb231ba52da77da2c563f753cb7b0256ae5944410a0c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 091c3b358879b0faafcb308b9e7428d2b4170c5e4cb2efc75742d44f6e3907ac
MD5 0f4249d473e70af29b7bb3b0124b9348
SHA1 2c07395d1dfc27b25902c57f82cf62823961d3df
SHA512 01ebfc3a2ad5ad9b2de94477d8a9835b43532d00a225bddc269cf9680ca49ca6f8adc41265b2954c66785346425b86092bc1f9a6fa41c33b22d9c70741c4d5c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b20d06d7d27d38278bb26e4e70ecbb65aca43285a0620a4760ec7616c87cdddf
MD5 bfcdbd0992f674e0c8ad5bd65a62ac69
SHA1 939e77c4fc321bf8c2907b50857d9d840bc35b8b
SHA512 8397bc466b8d49ed19053e9b09132b445fc8a96cd2c9d97a988d156f0852ca800c4dc5a8eeac949eb8781ca0026c362612fc6bd39ba7bf50711af4e144f9ab5f
MD5 SHA1 SHA512

Submit Download

svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBCACCACACCBBCBCABBCCCCAACACCBCABCAACCAAACBBBCBCA.exe
Size 42.6MB
SHA256 b813d2252e8db1532a224620dcd22a6499d30a0f04e8e7cc3c9559c8bffd1649
MD5 1029d8f8057bd8168d40ec9c8375ecdf
SHA1 01903aff11bb5eabc478b9cf424f3d9aa92ada34
SHA512 3d8d0c4dd62e57ce4ab74607c9518065567f66001c083a176c3e20101f540fac08ed7eeacba2121669e326031acbf41ac58605673060fed0f93cd0f8eb06b268
SSDEEP 49152:U+ES+EW5+ES+ES+ES+EW5+ES+ES+ES+EW0iw2g+ES+ES+EW5+ES+ES+ES+EW5+ED:Hooooooo64TZ
TLSH
T1A5A76C09F98744B1E97B51704DDBC2BE8A70BA1187228EEBF649C71F6933BE06834715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 8fd8c606c1997519ada3b8849d5ebeb14bdc63da9308455f25e4f8d8c0c59164
MD5 ac9903cdc5f3c0e807412df4fa208323
SHA1 9d246b0cd615bb7d702502df9b3e8327b06f62e2
SHA512 99e66db11f4b675c07a9a1175fa8f0bde6fc9ea1c92a9be2b72e31d80801e394d8c76a0e5c4a447c55ad6e16f8228a01d9b917d13680f6029c8e23e00a25cb16
TLSH
T19A1106A0F4E7D467E83278CF3A2EDE466CF4378F9CA46A151318A2186765C324E158E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3212-0-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/3212-8-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/5352-24-0x00000000006E0000-0x0000000000701000-memory.dmp

Download

memory/5352-34-0x00000000006E0000-0x0000000000701000-memory.dmp

Download