5f74e42f91e63cfc32989081034bd89043350c178bcd0be21b7b2ce62b88bee2

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_18f63f71fcac2d4752ee9e4c31daeb10_elex_icedid_njrat_vidar.exe
Size 1.9MB
Sample260830-zygrpshp4w
SHA256 5f74e42f91e63cfc32989081034bd89043350c178bcd0be21b7b2ce62b88bee2
MD5 18f63f71fcac2d4752ee9e4c31daeb10
SHA1 c109c9ba6530da7dda6110ce9b6efce32038e79c
SHA512 5afb719ff9bc3ea51062d648b746fddd4ba7d29774236ed84f70cbbf4bec879fb5030092c4fd2268db9100efcc03f26bf4d4479ad4b8535375e9eaf4c9eb0c24
SSDEEP 49152:U+ES+ES+EjV+ES+ES+EjV+ES+ES+EjSiw2v:ojj1
TLSH
T134954A09F6E548F1E9774170899BC2BAD671BD114B21CBDFA294832E6F337A1AC38711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1244	svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe
3408	svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe
5712	svchost_AACCCABAABCCABCBCAAABBBBABCACACBCAACAACACBCCCACBBBCCCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBBABACCBCCBACAACCBAAABBAAACACBABBBAABABCBCBBBBCCACCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe"	2026-08-30_18f63f71fcac2d4752ee9e4c31daeb10_elex_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBABCCCBBCBBACBACABBAACCBBBACBACACBCBCACCBAAABBCACCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCCABAABCCABCBCAAABBBBABCACACBCAACAACACBCCCACBBBCCCBA.exe"	svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1620	sc.exe
5552	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5724	cmd.exe
3184	cmd.exe
1720	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_18f63f71fcac2d4752ee9e4c31daeb10_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCCABAABCCABCBCAAABBBBABCACACBCAACAACACBCCCACBBBCCCBA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3556	2026-08-30_18f63f71fcac2d4752ee9e4c31daeb10_elex_icedid_njrat_vidar.exe
3556	2026-08-30_18f63f71fcac2d4752ee9e4c31daeb10_elex_icedid_njrat_vidar.exe
3556	2026-08-30_18f63f71fcac2d4752ee9e4c31daeb10_elex_icedid_njrat_vidar.exe
3556	2026-08-30_18f63f71fcac2d4752ee9e4c31daeb10_elex_icedid_njrat_vidar.exe
1244	svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe
1244	svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe
1244	svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe
1244	svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	2026-08-30_18f63f71fcac2d4752ee9e4c31daeb10_elex_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1244	svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 5724	3556	2026-08-30_18f63f71fcac2d4752ee9e4c31daeb10_elex_icedid_njrat_vidar.exe	92
PID 5724 wrote to memory of 6012	5724	cmd.exe	94
PID 1244 wrote to memory of 2184	1244	svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe	95
PID 3556 wrote to memory of 3184	3556	2026-08-30_18f63f71fcac2d4752ee9e4c31daeb10_elex_icedid_njrat_vidar.exe	96
PID 3184 wrote to memory of 1620	3184	cmd.exe	98
PID 3556 wrote to memory of 1720	3556	2026-08-30_18f63f71fcac2d4752ee9e4c31daeb10_elex_icedid_njrat_vidar.exe	99
PID 1720 wrote to memory of 5552	1720	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-30_18f63f71fcac2d4752ee9e4c31daeb10_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_18f63f71fcac2d4752ee9e4c31daeb10_elex_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACCABCBABACCBCCAABAAABAAABACBABCCCBBAACBBAAABAABAABABABBBCABABCCBCABBBABACACBCBBCBCCCCAACCBBCABBBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACCABCBABACCBCCAABAAABAAABACBABCCCBBAACBBAAABAABAABABABBBCABABCCBCABBBABACACBCBBCBCCCCAACCBBCABBBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAACABABACCAABBACCACBAACACCAAACBBCCBACCACBACCCBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe" start= auto displayName= "UserDataSvc_BBAACABABACCAABBACCACBAACACCAAACBBCCBACCACBACCCBACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAACABABACCAABBACCACBAACACCAAACBBCCBACCACBACCCBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe" start= auto displayName= "UserDataSvc_BBAACABABACCAABBACCACBAACACCAAACBBCCBACCACBACCCBACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAACABABACCAABBACCACBAACACCAAACBBCCBACCACBACCCBACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAACABABACCAABBACCACBAACACCAAACBBCCBACCACBACCCBACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2184

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe
1⤵
- Executes dropped EXE
PID:3408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABAABCCABCBCAAABBBBABCACACBCAACAACACBCCCACBBBCCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABAABCCABCBCAAABBBBABCACACBCAACAACACBCCCACBBBCCCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0fc5aaece90f288640430ed0c4d18e0e58ccea3f146bfc9783b6ea92db027c46
MD5 af913a7e92fa6f11dd466b8b4bc2576a
SHA1 f1293ccebee75a30533174207126ee164ee23cc0
SHA512 b0b35d75ae2c60125dab4726100be15f4b718f758a029a35f6e41bb2dd5838201af09b4d1dfecbd833b3225dc64ef6050b538c718074fa5642b1f50108c799b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d5b219307b01a651637569ac7f2e11cfddce89f45d535567aa010fa2c44caf50
MD5 de1c041ff665c38dba3cbfbba88e4b56
SHA1 f9ac777ab377ed3a31955239ef0a48cbd1c72f3f
SHA512 6cbdf2f0dc0e3c41043bf15f50c02f1056a96b81edec9a30c00bac55d95a2c8f9a655bb2d152c059be2178b09ebf9478ea916edddc5fcd6ff7c5f443afe1bc9c
MD5 SHA1 SHA512

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 6.4MB
SHA256 c1908af9c63cc4c2790f2f4b572d33f85e91b0a33821af130d4db41539aa81b6
MD5 a3d8f3aaa649812bb4a1dbc2e4a692e2
SHA1 7ad04952eee37e22fa19afc59a9a3797f37f5023
SHA512 cda288d69389ae11a4484e07b6c25a40cb6aea85934a2165f38e84b1a569689284fec9f461e1dfab8e19d0cc258ddf79ec97c22a334e101aa0b36e702304a449
SSDEEP 49152:U+ES+ES+EjV+ES+ES+EjV+ES+ES+EjSiw28+ES+ES+EjV+ES+ES+EjV+ES+ES+EE:ojjCjjCjjN2cyoT
TLSH
T197666B09F6E548F1E9774170899BC2BAD671BD114B21CBDFA294832E6F337A1AC38711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 12.2MB
SHA256 a221722ea0b01dc746663614cea76c47421746c7b95b486d0e61eba8b6dc408e
MD5 7a800deda27821ff47ef3b7220fced60
SHA1 f7512bc48cf4551cb81efe082de47fb2c67cf73c
SHA512 96f516b7fe73f3f44b684f32782da036b68295d9c221d0ca284588def6147ae40c99caeccc679aa7f39a4a7316436d3bbe5fa4c35d47b6f1962ea2bf721b46a4
SSDEEP 49152:U+ES+ES+EjV+ES+ES+EjV+ES+ES+EjSiw28+ES+ES+EjV+ES+ES+EjV+ES+ES+Ep:ojjCjjCjjCjjCjjCjjN2cyoN
TLSH
T1A0D65A09F6E548F1E9774170899BC2BAD671BD114B21CBDFA294832E6F337A1AC38711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 14.2MB
SHA256 9f024448cec05bde27df0908c293be4ca135061bfc09581b52d173a94adb5840
MD5 a3a3907bc5a606f3e23b72c16709096b
SHA1 afabca556a2637dbb67b8492f55d1f67d42cbd52
SHA512 18b9a216346817a1e28c8f499a739f8ca231bd76fb736df150a1c3a7bc33288f8c0e79c1e2ceaa77552dd2dbc9aa0e4c9e98380bf39e5510eb0a50927a50af62
SSDEEP 49152:U+ES+ES+EjV+ES+ES+EjV+ES+ES+EjSiw28+ES+ES+EjV+ES+ES+EjV+ES+ES+Eg:ojjCjjCjjCjjCjjCjjCjjN2cyoL
TLSH
T1CDE65A09F6E548F1E9774170899BC2BAD671BD114B21CBDFA294832E6F337A1AC38711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 16.1MB
SHA256 35ad5fbd4c09b71b99e69f1edfc0f85b5786637459ad6f8834053494905b17f5
MD5 8eb27180eb49714b690edd419ba3c465
SHA1 a796dca9627316c26ad3a0d63213fcaa419a9e61
SHA512 8d80855486dc014466fb09793fe5c5421ac15e9360845940860b397573c4a3171450bb17bc58e19f740b704e991586ef59e607ec350573f6a35a3d3af5c4e638
SSDEEP 49152:U+ES+ES+EjV+ES+ES+EjV+ES+ES+EjSiw28+ES+ES+EjV+ES+ES+EjV+ES+ES+EB:ojjCjjCjjCjjCjjCjjCjjCjjN2cyoF
TLSH
T19D075A09F6E548F1E9774170899BC2BAD671BD114B21CBDFA294832E6F337A1AC38711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 18.1MB
SHA256 989fa06eccbdc6d99f6df2f61af2fac8f94176989ca8057385909d4a7d6d43f2
MD5 2642e6899cce381d67d601068a5e75eb
SHA1 02c90cbdbf52aa8708ad97a5e8c16b2c81609980
SHA512 9eac82b623c71e573373d18fdfb2c80fe0ecc149c26ecbdf0efcf1bd6c1d666bb27c55cb3d09722e554c75efd959ea25f925fcb82420a87ebaf0c262108b37c9
SSDEEP 98304:ojjCjjCjjCjjCjjCjjCjjCjjCjjN2cyoR:ojjCjjCjjCjjCjjCjjCjjCjjCjjocym
TLSH
T126175A09F6E548F1E9774170899BC2BAD671BD114B21CBDFA294832E6F337A1AC38711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1acef391608580e13ef337cad9a50ff949e87181adb3c812a247b1413aaf6d4c
MD5 0e34643dfd22278f609075a9df8b482c
SHA1 f0748907b03a17be44b3c79324fd431462347d6d
SHA512 0db82b58f0c9bb0479f3c785f4e49c557d62e3ad545798f5713c2cb195ac3354a2abcb8934a73cc7234a3b8b95632ac133b70ab27889627704188f70d9309cbe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2c0ce9b9530663e53e7ce1687de87d1768bd1ec59171bb2c9df60f0e1983a656
MD5 043ff81ec1dedc0265fc4b8a9b2dd8d2
SHA1 8e9cc4f359d224c1c150bcb7e06793390e119b78
SHA512 172c5e6562bad1670fb703bb50cf62a8c2412c3fd5083ba35a65ec7910b418aeb9cf9a9e6265023f060458cc81a5cd5b46df56a64a2454288a8b37bb5cefdd10
MD5 SHA1 SHA512

Submit Download

svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCBACBBCBAAACBBBAACCABCBCAAACCCABAACCBBABCAABBC.exe
Size 1.9MB
SHA256 5f74e42f91e63cfc32989081034bd89043350c178bcd0be21b7b2ce62b88bee2
MD5 18f63f71fcac2d4752ee9e4c31daeb10
SHA1 c109c9ba6530da7dda6110ce9b6efce32038e79c
SHA512 5afb719ff9bc3ea51062d648b746fddd4ba7d29774236ed84f70cbbf4bec879fb5030092c4fd2268db9100efcc03f26bf4d4479ad4b8535375e9eaf4c9eb0c24
SSDEEP 49152:U+ES+ES+EjV+ES+ES+EjV+ES+ES+EjSiw2v:ojj1
TLSH
T134954A09F6E548F1E9774170899BC2BAD671BD114B21CBDFA294832E6F337A1AC38711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1244-52-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/1244-34-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/1244-73-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/3556-35-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/3556-61-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/3556-0-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/3556-22-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/3556-11-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download