Analysis
- max time kernel
141s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/09/2026, 19:38
General
- Target 2026-09-04_03fb3172cc90249fce2fffe5622239c5_icedid_njrat_vidar.exe
- Size 942KB
- Sample260905-ycws3a1eqd
- SHA256 36ea8a4113aa74ed55ca38baf1e803357fa101d50228f14fd8014eeaf63288da
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 26 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 27 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_03fb3172cc90249fce2fffe5622239c5_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_03fb3172cc90249fce2fffe5622239c5_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
AppVShNotify.exe
IntegratedOffice.exe
MavInject32.exe
OfficeC2RClient.exe
appvcleaner.exe
LICLUA.EXE
OSE.EXE
VSTOInstaller.exe
chrmstp.exe
setup.exe
chrome_pwa_launcher.exe
elevated_tracing_service.exe
elevation_service.exe
notification_helper.exe
os_update_handler.exe
chrome_proxy.exe
appletviewer.exe
extcheck.exe
idlj.exe
jabswitch.exe
jar.exe
jarsigner.exe
java-rmi.exe
java.exe
javac.exe
javadoc.exe
javafxpackager.exe
javah.exe
javap.exe
javapackager.exe
javaw.exe
javaws.exe
jcmd.exe
jconsole.exe
jdb.exe
jdeps.exe
dotnet.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
ReFsDedupSvc.exe
SearchIndexer.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
PerceptionSimulationService.exe
memory/976-288-0x00007FF6CC400000-0x00007FF6CC4AD000-memory.dmp
memory/976-289-0x00000251DD490000-0x00000251DD4F6000-memory.dmp
memory/976-290-0x00000251DD490000-0x00000251DD4F6000-memory.dmp
memory/976-363-0x00007FF6CC400000-0x00007FF6CC4AD000-memory.dmp
memory/1004-280-0x00007FF69F8F0000-0x00007FF6A0033000-memory.dmp
memory/1004-361-0x00007FF69F8F0000-0x00007FF6A0033000-memory.dmp
memory/1004-282-0x000002570AF90000-0x000002570AFF6000-memory.dmp
memory/1004-281-0x000002570AF90000-0x000002570AFF6000-memory.dmp
memory/1968-441-0x0000016F267F0000-0x0000016F26856000-memory.dmp
memory/1968-372-0x00007FF7B7BC0000-0x00007FF7B7FD6000-memory.dmp
memory/1968-297-0x00007FF7B7BC0000-0x00007FF7B7FD6000-memory.dmp
memory/1968-298-0x0000016F267F0000-0x0000016F26856000-memory.dmp
memory/1968-299-0x0000016F267F0000-0x0000016F26856000-memory.dmp
memory/1968-443-0x00007FF7B7BC0000-0x00007FF7B7FD6000-memory.dmp
memory/2104-232-0x000001B0FF160000-0x000001B0FF1C6000-memory.dmp
memory/2104-231-0x000001B0FF160000-0x000001B0FF1C6000-memory.dmp
memory/2104-230-0x00007FF7BE400000-0x00007FF7BE4C8000-memory.dmp
memory/2104-307-0x00007FF7BE400000-0x00007FF7BE4C8000-memory.dmp
memory/2252-33-0x00000200F0140000-0x00000200F01D5000-memory.dmp
memory/2252-34-0x00000200F0300000-0x00000200F0366000-memory.dmp
memory/2252-35-0x00000200F0300000-0x00000200F0366000-memory.dmp
memory/2556-308-0x00007FF728EC0000-0x00007FF728F73000-memory.dmp
memory/2556-309-0x00000265E4CA0000-0x00000265E4D06000-memory.dmp
memory/2556-310-0x00000265E4CA0000-0x00000265E4D06000-memory.dmp
memory/2556-373-0x00007FF728EC0000-0x00007FF728F73000-memory.dmp
memory/2560-378-0x00007FF64E9A0000-0x00007FF64EC43000-memory.dmp
memory/2560-319-0x000002656C490000-0x000002656C4F6000-memory.dmp
memory/2560-320-0x000002656C490000-0x000002656C4F6000-memory.dmp
memory/2560-317-0x00007FF64E9A0000-0x00007FF64EC43000-memory.dmp
memory/2668-42-0x0000028428500000-0x0000028428566000-memory.dmp
memory/2668-48-0x0000028428500000-0x0000028428566000-memory.dmp
memory/2668-50-0x00007FF721270000-0x00007FF7213D8000-memory.dmp
memory/2668-43-0x0000028428500000-0x0000028428566000-memory.dmp
memory/2668-41-0x00007FF721270000-0x00007FF7213D8000-memory.dmp
memory/3388-366-0x00007FF778610000-0x00007FF778B17000-memory.dmp
memory/3388-445-0x00007FF778610000-0x00007FF778B17000-memory.dmp
memory/3388-367-0x000001DAE8230000-0x000001DAE8296000-memory.dmp
memory/3388-368-0x000001DAE8230000-0x000001DAE8296000-memory.dmp
memory/3464-240-0x00007FF7BE400000-0x00007FF7BE4C8000-memory.dmp
memory/3464-242-0x000002117B9C0000-0x000002117BA26000-memory.dmp
memory/3464-241-0x000002117B9C0000-0x000002117BA26000-memory.dmp
memory/3464-316-0x00007FF7BE400000-0x00007FF7BE4C8000-memory.dmp
memory/3496-344-0x00007FF7AF7A0000-0x00007FF7AFAC1000-memory.dmp
memory/3496-336-0x00007FF7AF7A0000-0x00007FF7AFAC1000-memory.dmp
memory/3496-338-0x0000022AA0770000-0x0000022AA07D6000-memory.dmp
memory/3496-342-0x0000022AA0770000-0x0000022AA07D6000-memory.dmp
memory/3496-337-0x0000022AA0770000-0x0000022AA07D6000-memory.dmp
memory/3844-53-0x0000020736E60000-0x0000020736EF5000-memory.dmp
memory/3844-55-0x0000020737020000-0x0000020737086000-memory.dmp
memory/3844-54-0x0000020737020000-0x0000020737086000-memory.dmp
memory/4072-1-0x00000211E5DA0000-0x00000211E5E06000-memory.dmp
memory/4072-0-0x00000211E5C70000-0x00000211E5D93000-memory.dmp
memory/4072-19-0x00000211E5DA0000-0x00000211E5E06000-memory.dmp
memory/4072-3-0x00000211E5DA0000-0x00000211E5E06000-memory.dmp
memory/4072-2-0x00000211E5DA0000-0x00000211E5E06000-memory.dmp
memory/4244-348-0x00007FF662880000-0x00007FF662B0B000-memory.dmp
memory/4244-350-0x000001B351710000-0x000001B351776000-memory.dmp
memory/4244-349-0x000001B351710000-0x000001B351776000-memory.dmp
memory/4244-440-0x00007FF662880000-0x00007FF662B0B000-memory.dmp
memory/4636-444-0x00007FF6A2780000-0x00007FF6A2C51000-memory.dmp
memory/4636-357-0x000001E898DF0000-0x000001E898E56000-memory.dmp
memory/4636-362-0x00007FF6A2780000-0x00007FF6A2C51000-memory.dmp
memory/4636-356-0x000001E898DF0000-0x000001E898E56000-memory.dmp
memory/4656-274-0x00000000009A0000-0x0000000000A09000-memory.dmp
memory/4656-268-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/4656-269-0x00000000009A0000-0x0000000000A09000-memory.dmp
memory/4656-347-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/4788-388-0x00007FF6686F0000-0x00007FF668A2F000-memory.dmp
memory/4788-389-0x000002088DCB0000-0x000002088DD16000-memory.dmp
memory/4788-390-0x000002088DCB0000-0x000002088DD16000-memory.dmp
memory/5096-383-0x00007FF6FB330000-0x00007FF6FB45F000-memory.dmp
memory/5096-379-0x0000020D880A0000-0x0000020D88106000-memory.dmp
memory/5096-377-0x0000020D880A0000-0x0000020D88106000-memory.dmp
memory/5196-25-0x000002B70EFD0000-0x000002B70F036000-memory.dmp
memory/5196-26-0x000002B70EFD0000-0x000002B70F036000-memory.dmp
memory/5196-27-0x000002B70EFD0000-0x000002B70F036000-memory.dmp
memory/5196-24-0x000002B70EE10000-0x000002B70EEA5000-memory.dmp
memory/5336-335-0x00007FF6CEB60000-0x00007FF6CECA9000-memory.dmp
memory/5336-262-0x000001FF77980000-0x000001FF779E6000-memory.dmp
memory/5336-261-0x000001FF77980000-0x000001FF779E6000-memory.dmp
memory/5336-259-0x00007FF6CEB60000-0x00007FF6CECA9000-memory.dmp
memory/5416-63-0x00007FF7077C0000-0x00007FF7078E2000-memory.dmp
memory/5416-11-0x00007FF7077C0000-0x00007FF7078E2000-memory.dmp
memory/5416-12-0x00000177F4A10000-0x00000177F4A76000-memory.dmp
memory/5416-14-0x00000177F4A10000-0x00000177F4A76000-memory.dmp
memory/5416-13-0x00000177F4A10000-0x00000177F4A76000-memory.dmp
memory/5544-326-0x00007FF665FC0000-0x00007FF6660D9000-memory.dmp
memory/5544-249-0x00000188E42F0000-0x00000188E4356000-memory.dmp
memory/5544-247-0x00007FF665FC0000-0x00007FF6660D9000-memory.dmp
memory/5544-248-0x00000188E42F0000-0x00000188E4356000-memory.dmp
memory/5832-386-0x00007FF761AE0000-0x00007FF761C75000-memory.dmp
memory/5832-328-0x0000021441FC0000-0x0000021442026000-memory.dmp
memory/5832-327-0x00007FF761AE0000-0x00007FF761C75000-memory.dmp
memory/5832-329-0x0000021441FC0000-0x0000021442026000-memory.dmp