d1300ead1c0d7808f39da0418eb37be06eb1eb331a6a9fdf6bdb18fe0b1564ce

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_c780024bf13e83641be8a2bee5d6f4d7_elex_icedid_njrat_vidar.exe
Size 2.5MB
Sample260908-pgv8nazdla
SHA256 d1300ead1c0d7808f39da0418eb37be06eb1eb331a6a9fdf6bdb18fe0b1564ce
MD5 c780024bf13e83641be8a2bee5d6f4d7
SHA1 246c81981333f6e76c82c9e84b6d91e4d508f248
SHA512 58438ace7bf9ccf0bd2f8590eb8e7f54dd220e05495f3153c15d56189ccfe317d6bcd02952cb96d8b320e4b5e8f0121d2707778d62e8e290337692db0705eb0f
SSDEEP 49152:U+ES+ES+EjJ+ES+ES+E4C5o+ES+ES+EjJ+ES+ES+E4C5o+ES+ES+EjyX:kf54f54e
TLSH
T1B3C55D09F7D614B5E97745B08CABD2BA9E717D214721CBAFE604C60A2E23BD0E83D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3604	svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe
4876	svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe
3160	svchost_CBBABCBCBBCCACAAABCCCCABBCBBBCABBBAACBBCBABCABCACCCABCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBCCABBAACCBAABAACACACAACABCCCBCCAAACBBACABBBCCAACBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe"	2026-09-08_c780024bf13e83641be8a2bee5d6f4d7_elex_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAACAACBCCCBCCBBBACABACBACACBCBCBBBBBACAABBCCBAAABCBACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBABCBCBBCCACAAABCCCCABBCBBBCABBBAACBBCBABCABCACCCABCA.exe"	svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5896	sc.exe
5908	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6092	cmd.exe
1752	cmd.exe
632	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBABCBCBBCCACAAABCCCCABBCBBBCABBBAACBBCBABCABCACCCABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_c780024bf13e83641be8a2bee5d6f4d7_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1132	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4752	2026-09-08_c780024bf13e83641be8a2bee5d6f4d7_elex_icedid_njrat_vidar.exe
4752	2026-09-08_c780024bf13e83641be8a2bee5d6f4d7_elex_icedid_njrat_vidar.exe
4752	2026-09-08_c780024bf13e83641be8a2bee5d6f4d7_elex_icedid_njrat_vidar.exe
4752	2026-09-08_c780024bf13e83641be8a2bee5d6f4d7_elex_icedid_njrat_vidar.exe
3604	svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe
3604	svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe
3604	svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe
3604	svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe
3160	svchost_CBBABCBCBBCCACAAABCCCCABBCBBBCABBBAACBBCBABCABCACCCABCA.exe
3160	svchost_CBBABCBCBBCCACAAABCCCCABBCBBBCABBBAACBBCBABCABCACCCABCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4752	2026-09-08_c780024bf13e83641be8a2bee5d6f4d7_elex_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3604	svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe
Token: SeDebugPrivilege	3160	svchost_CBBABCBCBBCCACAAABCCCCABBCBBBCABBBAACBBCBABCABCACCCABCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 6092	4752	2026-09-08_c780024bf13e83641be8a2bee5d6f4d7_elex_icedid_njrat_vidar.exe	92
PID 6092 wrote to memory of 1132	6092	cmd.exe	94
PID 4752 wrote to memory of 1752	4752	2026-09-08_c780024bf13e83641be8a2bee5d6f4d7_elex_icedid_njrat_vidar.exe	95
PID 1752 wrote to memory of 5896	1752	cmd.exe	97
PID 4752 wrote to memory of 632	4752	2026-09-08_c780024bf13e83641be8a2bee5d6f4d7_elex_icedid_njrat_vidar.exe	98
PID 632 wrote to memory of 5908	632	cmd.exe	100
PID 3604 wrote to memory of 4276	3604	svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-08_c780024bf13e83641be8a2bee5d6f4d7_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_c780024bf13e83641be8a2bee5d6f4d7_elex_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBCBBCCAAAABAAACCCCACACCABBCBCBBBCCABBAAABBCBCABACCBCCBABBBCCACBCBCACBACCCCCBACAACCCAABAAABBCBCACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBCBBCCAAAABAAACCCCACACCABBCBCBBBCCABBAAABBCBCABACCBCCBABBBCCACBCBCACBACCCCCBACAACCCAABAAABBCBCACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACCABABBBBACACABACBBBACCCABACAACBACCCBCABCACBBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe" start= auto displayName= "UserDataSvc_CAACCABABBBBACACABACBBBACCCABACAACBACCCBCABCACBBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAACCABABBBBACACABACBBBACCCABACAACBACCCBCABCACBBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe" start= auto displayName= "UserDataSvc_CAACCABABBBBACACABACBBBACCCABACAACBACCCBCABCACBBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACCABABBBBACACABACBBBACCCABACAACBACCCBCABCACBBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAACCABABBBBACACABACBBBACCCABACAACBACCCBCABCACBBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe
1⤵
- Executes dropped EXE
PID:4876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCBCBBCCACAAABCCCCABBCBBBCABBBAACBBCBABCABCACCCABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCBCBBCCACAAABCCCCABBCBBBCABBBAACBBCBABCABCACCCABCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 95a56f3ac98dd22769314163b6ebf82bd50b3e02dd92cd660d8ca201bf3751c1
MD5 eb4efd8e6013c4d9a5e3bdad23f3bb4e
SHA1 b369964fdd9ea0fe945ac58ca3b59a12fb384461
SHA512 d04cc01f874faa9942e53167b14be3a23d01a13baebbc737b213edc0c1b48c0a27e04e73ddddf6b035bc0ec188b0171ae01dfb473c2b9a211f43988324606dbd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 91a436a7e0911bb770cbcbb25085eaae8f91cd4d9288c9d045e504369fae3936
MD5 32125cc995af73b877e6d6f4b65fbad9
SHA1 63ea0faff19233106b28530580b7b923f7f95534
SHA512 f49eb59239a91c986244f90e78f76113fc460edc66e8d7e6eb994dda62996bf15f3655be4419aab2182d3d774f8abc0ed1ad9a87dc7bf98386450c9f4967bdc7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0052aca1e900c95c24595e9d92a8e395d5de3ddd3d1aad2284f65caef745904c
MD5 f05005831577e05ca151445ed4e3d01a
SHA1 78a32a2606edeb9cce243e06508bd3b46217380c
SHA512 73cfba3f2b21c26b2e5bdc391c021ebe1e76d625208b51ff67264ae4a1c3335173c49b6de3361026012592a838c4650f6cefafd59f4e4aa3d7165ff7b08ef82d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f125f6649592a66dae9285df3d27acfbaf13e870154c8f69095efbef72304b9f
MD5 768669d2f5719287bd47f392b59e00b3
SHA1 407d04cb58d73bc6c38f58b67e165559f55491f8
SHA512 052223a278a26455bcef3119fc559191698afc2412aafb41eba0b42b54068c714e466f32b85d816db87e9694557d135224dc0c28370671e5a7bc61ac83990a75
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dec0cc3555c2cca85a7d9b1091f9b027b7db5cd4804f3df50463b3cc9d643d94
MD5 8b5c8ea85d5fbfb88d20b50387b3b144
SHA1 828b1e67f6be98084bd595da1a3ab6f0f1a21293
SHA512 07d63e5b219ec9ec60cfbb044a0b5edaca5e0e2396e820e9735275e981a86c963562ce37af03af4fcce5ba253bc49dcd2ad46577167134b4c265fcdd01832eb1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ecc4eba8133bce5c173498c665948e04d609f4f91f6f3b010e1970f1d833004d
MD5 81de944b51d55fc25b7c650bfebd679f
SHA1 e8cc263074bf3e607103e9cb2bbf1890c706c8b3
SHA512 3c2d80e260f637c6d306fefb7a47bb7472c22a82cbdddf52c78e425e4ff29428c9fbd2a8267960fe219ab9cfab0ec2f62fe7ff1b9d565f6bb9b7ac880541ddab
MD5 SHA1 SHA512

Submit Download

svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABABBABBCCAACBCCACACAACAAABCAABCAACACCBCBACCABCBAAB.exe
Size 2.5MB
SHA256 d1300ead1c0d7808f39da0418eb37be06eb1eb331a6a9fdf6bdb18fe0b1564ce
MD5 c780024bf13e83641be8a2bee5d6f4d7
SHA1 246c81981333f6e76c82c9e84b6d91e4d508f248
SHA512 58438ace7bf9ccf0bd2f8590eb8e7f54dd220e05495f3153c15d56189ccfe317d6bcd02952cb96d8b320e4b5e8f0121d2707778d62e8e290337692db0705eb0f
SSDEEP 49152:U+ES+ES+EjJ+ES+ES+E4C5o+ES+ES+EjJ+ES+ES+E4C5o+ES+ES+EjyX:kf54f54e
TLSH
T1B3C55D09F7D614B5E97745B08CABD2BA9E717D214721CBAFE604C60A2E23BD0E83D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5d61021497243ef9b37fb8db007fec30946e2739761695920dec3c8c16ad9e71
MD5 76bd0b47b564879a0b3dc72acf6fb2ed
SHA1 b26dd740db4d1cbd694feff44cd4946edbbd39f5
SHA512 974492198b26cc6c6f781a02fcbe63fd0d3d117e0eabe34e933fc754cb0a1a2e68774c03c52f67c43772499c32085291297c09216b48b361805949e6c33d3513
TLSH
T1C611E692B4B5CC63E53164861229CAC75CF43B8B9C5CAB84530D4219A755C7D9E190F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3160-72-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/3604-22-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/3604-35-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/4752-6-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/4876-66-0x0000000000510000-0x0000000000531000-memory.dmp

Download