e4eb847b2ad9d1937adb6a2bc1cf054e032ae41233b2a90a1fcc44424820f524

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_8f535d53a9e8781e842515a6c225b1a9_elex_icedid_njrat_vidar.exe
Size 1.5MB
Sample260907-qaa5kshb26
SHA256 e4eb847b2ad9d1937adb6a2bc1cf054e032ae41233b2a90a1fcc44424820f524
MD5 8f535d53a9e8781e842515a6c225b1a9
SHA1 6511188b2337ec51c6564b6eb5b190b52e6eaa94
SHA512 519ee99b2a03ade9ce081f12a3ae8d69c7b98d75524f8530994947d6d259411416334c2623da87fdb0170f92737c3203e3964009692b77a1a5031e1eaba9af82
SSDEEP 24576:m9+EM0q9+EK9+EM0v9+EMNExqathy6i1zuxw7ljsarakkqt4nUwaslZOZO:U+ES+EI+E7+EBqathy6i1zuajsauZnJb
TLSH
T16F657C0DB2E800E5D9778174CA968276D671B8321B21DADF6350C63E6F37AE0AD39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4856	svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe
3476	svchost_BCCCCBBABAACABBBBBBCCBACCCABAABAABBCCBCBCBCBBCACCCCCBAC.exe
3420	svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAABBCAABBACBCBBABCCBABCCABCBCCCABCCCCCCBAACACAABCABBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCCBBABAACABBBBBBCCBACCCABAABAABBCCBCBCBCBBCACCCCCBAC.exe"	svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBACCBBCBACBCBBBCCACABAAAACBBCBCCAABACBCCBBCABBBBCACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe"	2026-09-05_8f535d53a9e8781e842515a6c225b1a9_elex_icedid_njrat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3636	sc.exe
956	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5424	cmd.exe
2120	cmd.exe
5252	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_8f535d53a9e8781e842515a6c225b1a9_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCCBBABAACABBBBBBCCBACCCABAABAABBCCBCBCBCBBCACCCCCBAC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4972	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
476	2026-09-05_8f535d53a9e8781e842515a6c225b1a9_elex_icedid_njrat_vidar.exe
476	2026-09-05_8f535d53a9e8781e842515a6c225b1a9_elex_icedid_njrat_vidar.exe
476	2026-09-05_8f535d53a9e8781e842515a6c225b1a9_elex_icedid_njrat_vidar.exe
476	2026-09-05_8f535d53a9e8781e842515a6c225b1a9_elex_icedid_njrat_vidar.exe
4856	svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe
4856	svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe
4856	svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe
4856	svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe
3476	svchost_BCCCCBBABAACABBBBBBCCBACCCABAABAABBCCBCBCBCBBCACCCCCBAC.exe
3476	svchost_BCCCCBBABAACABBBBBBCCBACCCABAABAABBCCBCBCBCBBCACCCCCBAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	476	2026-09-05_8f535d53a9e8781e842515a6c225b1a9_elex_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4856	svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe
Token: SeDebugPrivilege	3476	svchost_BCCCCBBABAACABBBBBBCCBACCCABAABAABBCCBCBCBCBBCACCCCCBAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 5424	476	2026-09-05_8f535d53a9e8781e842515a6c225b1a9_elex_icedid_njrat_vidar.exe	93
PID 5424 wrote to memory of 4972	5424	cmd.exe	95
PID 4856 wrote to memory of 1748	4856	svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe	96
PID 476 wrote to memory of 2120	476	2026-09-05_8f535d53a9e8781e842515a6c225b1a9_elex_icedid_njrat_vidar.exe	99
PID 2120 wrote to memory of 3636	2120	cmd.exe	101
PID 476 wrote to memory of 5252	476	2026-09-05_8f535d53a9e8781e842515a6c225b1a9_elex_icedid_njrat_vidar.exe	102
PID 5252 wrote to memory of 956	5252	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-09-05_8f535d53a9e8781e842515a6c225b1a9_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_8f535d53a9e8781e842515a6c225b1a9_elex_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBBCCBABCACBBAABBBCAAACBBABCCBBCACACCCBABCBCBCABBAABCCABBBBBAACBACCBCABACABACCABAABABBAAAACCABBAABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBBCCBABCACBBAABBBCAAACBBABCCBBCACACCCBABCBCBCABBAABCCABBBBBAACBACCBCABACABACCABAABABBAAAACCABBAABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCACAACCBCAAAAACABCBAABACCCCABABBBABCCCCAABACAABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe" start= auto displayName= "UserDataSvc_CCCACAACCBCAAAAACABCBAABACCCCABABBBABCCCCAABACAABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCACAACCBCAAAAACABCBAABACCCCABABBBABCCCCAABACAABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe" start= auto displayName= "UserDataSvc_CCCACAACCBCAAAAACABCBAABACCCCABABBBABCCCCAABACAABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCACAACCBCAAAAACABCBAABACCCCABABBBABCCCCAABACAABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5252
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCACAACCBCAAAAACABCBAABACCCCABABBBABCCCCAABACAABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBBABAACABBBBBBCCBACCCABAABAABBCCBCBCBCBBCACCCCCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBBABAACABBBBBBCCBACCCABAABAABBCCBCBCBCBBCACCCCCBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3476

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe
1⤵
- Executes dropped EXE
PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 56809a77f5cfa6aab2b09541f4bdcf799314611417f6860229c8b4049eb3fd63
MD5 7f880a5bf7a43bc290ae9cb126fda574
SHA1 8fad86a32802fe2958827ff89799c6e9d8fdbd0b
SHA512 6a48464f611033233cd258466a2785738e6b6bd6a5de596235429b74d3582cb746774fd08d9b3b49b706e1b5253134841247a34aaa6bcde6140dcb950e504750
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 020530869c05ed3daba133347104bee20036f887c528fa0385d82db610daa135
MD5 7af7dae47d244fc266b575d3c09db6d2
SHA1 6ea15447e08dc0609c5adbe282510d13dd3a9184
SHA512 2a715445b079e9a3674fcd265b22a9e2d75ea2bb5053d9a066449c00cc47a70d5acb8a0bb6d63dc1bb500f411ed0ec1ae01bacfe1118bfe4498802a17ecfbb8a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 575db7908f2b514559ce54bd503b1f4056ea16980f01468b3b88c5935c329bd6
MD5 9db3497f85286a16da99dab0c72bbc10
SHA1 0a840826ac43838a0c1b58ce72f2360b2fc557db
SHA512 ad43ccf54309e21743291ac1607afc61c5305171ac930fcba385e5065ddfea2a5576d0fcb39c98031e3faa8c8eb2e067ca279c2a4972370eb3abee9c1e1bbf2e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e06f79787893c960d9f676f593ca7d26b2f52664c6bd4f830ce06a09aab1a7aa
MD5 d6526f9154cdffaa9e35af92bfc63c9d
SHA1 099dd5d2ea9b8a3bbc34bb48ddac72ddee0721fb
SHA512 686263c9713e52aad59c69b9586a903623e6a09d373afca27a82a5b95b6ec00800697a646d12842bf6921bc8a39950230a4c06a66f89e25c00b7b3026554d611
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cb884beff2d1aaa7f2abb4cc667d20a3423e9d381064ef9f87ac4aca256ca7fa
MD5 a292e730fc2f804fa16a02046bcac7fb
SHA1 e9b9bc1b55c64b5330a3682b3faa7dff7a2345c8
SHA512 179c64d78e4e5b68097127199faeaee0431b26170e927cca2b99292ddf9ce3ab6127414082200898c49f2eb879f2fa1162918a0c26564c686138be582731d2b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 74b36ffec7a2ac4544b81292bfd1a2b619907f1153da7c62d337ca8cc88507e9
MD5 6e9116abaee1d731f3348bfc58381968
SHA1 eec327bb606dc60b960285e766fa2d1ca2ae3f7f
SHA512 fa3a286547ef386deeee53d093a1bc216c49b9c067c42850f1c4a4f565fd85cca82c8d29274ccff57196893e8aa4fdb20c86fab51fc89ac722512802ac78f755
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f9a69da1eeabd46c2d2687c5f11835ae1bf18ff163d37449473cef352bc00a56
MD5 fb58bb48c6d86fcf319aaf1670a285e1
SHA1 d428185a41711d749e8bfe14c29511d48ab03138
SHA512 901fba9aee13b8e5e4a1c1c545b9c642ac5f86110a26165760cb506f43a02e09ddd94ecef6cedf52cc8e3024aaa74b03733e5dfa75f69ff284dc3f33f98e8c53
MD5 SHA1 SHA512

Submit Download

svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCBBCABCCACBBCBCACBBBBABCACACBACBACBCABACCCCBBAAAAC.exe
Size 1.5MB
SHA256 e4eb847b2ad9d1937adb6a2bc1cf054e032ae41233b2a90a1fcc44424820f524
MD5 8f535d53a9e8781e842515a6c225b1a9
SHA1 6511188b2337ec51c6564b6eb5b190b52e6eaa94
SHA512 519ee99b2a03ade9ce081f12a3ae8d69c7b98d75524f8530994947d6d259411416334c2623da87fdb0170f92737c3203e3964009692b77a1a5031e1eaba9af82
SSDEEP 24576:m9+EM0q9+EK9+EM0v9+EMNExqathy6i1zuxw7ljsarakkqt4nUwaslZOZO:U+ES+EI+E7+EBqathy6i1zuajsauZnJb
TLSH
T16F657C0DB2E800E5D9778174CA968276D671B8321B21DADF6350C63E6F37AE0AD39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2026b3ae4d28de322e842044452228c1a95c4b576e77e9e21818cb609d10011f
MD5 4011ac8c5b4ad1c4bd98e57be725699a
SHA1 75b255d9d1227f972ff7890263e9d4db6c7371a8
SHA512 875008723b43d01ac8e425c0611c5219151ce2255fc4748db621da4028e54912632239d73a133b941ee54bce20cd9a38d2e3f5433d4374775703119d915410d8
TLSH
T18A110A51B1B6D893E031B5DA9F39CAD708E87B4F695CAF19220C41286716C375D170E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/476-8-0x00000000005F0000-0x0000000000611000-memory.dmp

Download

memory/476-0-0x00000000005F0000-0x0000000000611000-memory.dmp

Download

memory/3476-65-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/4856-34-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download