Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/08/2026, 11:41

General

  • Target
    2026-08-23_549e0fded9b1a346830f3199abf0ef60_icedid_njrat_vidar.exe
  • Size 1.1MB
  • Sample260824-ntldjsfq4s
  • SHA256 a00693a1c5823b8c1f3dda2e236cce83428c0ecba108c7d6088cf01039c7a4e2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_549e0fded9b1a346830f3199abf0ef60_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_549e0fded9b1a346830f3199abf0ef60_icedid_njrat_vidar.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5712
  • C:\Windows\system32\ctfmon.exe
    /QuitInfo:0000000000000268;000000000000026C;
    1⤵
      PID:5440
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
        PID:3556
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
          PID:2600
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:3208
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
              PID:2244
            • C:\Windows\system32\sihost.exe
              sihost.exe
              1⤵
                PID:4864
              • C:\Windows\system32\sihost.exe
                sihost.exe
                1⤵
                  PID:6120
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k CameraMonitor
                  1⤵
                    PID:5372

                  Network

                        MITRE ATT&CK Matrix

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        memory/5712-4-0x00000191C9490000-0x00000191C94AC000-memory.dmp

                        memory/5712-3-0x00000191C94D0000-0x00000191C94E9000-memory.dmp

                        memory/5712-2-0x00000191CBF00000-0x00000191CBFFF000-memory.dmp

                        memory/5712-1-0x00000191CBD00000-0x00000191CBDFF000-memory.dmp

                        memory/5712-5-0x00000191CBF00000-0x00000191CBFFF000-memory.dmp

                        memory/5712-6-0x00000191C94D0000-0x00000191C94E9000-memory.dmp

                        memory/5712-7-0x00000191CBF00000-0x00000191CBFFF000-memory.dmp

                        memory/5712-19-0x00000191CBA80000-0x00000191CBBA4000-memory.dmp

                        memory/5712-20-0x00000191CBA80000-0x00000191CBBA4000-memory.dmp

                        memory/5712-40-0x00000191CBA80000-0x00000191CBBA4000-memory.dmp

                        memory/5712-10-0x00000191CBA80000-0x00000191CBBA4000-memory.dmp

                        memory/5712-8-0x00000191CB5F0000-0x00000191CB715000-memory.dmp

                        memory/5712-44-0x00000191CBA80000-0x00000191CBBA4000-memory.dmp

                        memory/5712-50-0x00000191CBA80000-0x00000191CBBA4000-memory.dmp

                        memory/5712-80-0x00000191CBF00000-0x00000191CBFFF000-memory.dmp