Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 20:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe
- Size 474KB
- Sample261102-zp14zsds41
- SHA256 145bc1ecbe458f3128fbcd6f6ce098b54619ed5c62ad80a46af4bb0dfecf30c6
- MD5 dc27d3e6b41ba9645a63dbaad3bfddd2
- SHA1 28b613e94c42031626d099636257ebe3df213a97
- SHA512 0a952339810e3b064d5e38185100e4c81747adedac7681644b45dfc90943c6accbf6e57d5d72b832ee766bfced8b48f1448ca2e1748cf845490bce079a6e97a5
- SSDEEP 6144:mOjlZ3taG9h3Hp02Bshx8xZJMIjGI0P2iig1e17nx02tzp4Phl7zLiZr8I:miZ9aG9h372QKYiiOCxpdK6YI
- TLSH T10BA46C5A635408F5D1679239CA53460BE37278045BA1D7CF12A8E3BE2F236D19E3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Modifies registry class 41 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib\ = "{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe\"" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\0 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ = "ILSPCONSvcCOMChannel" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib\Version = "1.0" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib\ = "{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB}\ = "IntelCpHDCPSvc" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\TypeLib\ = "{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib\Version = "1.0" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB} 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38} 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\FLAGS 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3} 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ = "ILSPCONSvcCOMChannel" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHDCPSvc.EXE 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB}\LaunchPermission = 010014806400000074000000140000003000000002001c000100000011001400040000000101000000000010001000000200340002000000000014000b000000010100000000000100000000000018000b000000010200000000000f02000000010000000102000000000005200000002002000001020000000000052000000020020000 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D} 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\ = "IntelCpLSPCONSvcLib" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ProxyStubClsid32 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\ = "CLSPCONSvcCOMChannel Class" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\Programmable 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\Version\ = "1.0" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ProxyStubClsid32 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB}\LocalService = "cplspcon" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\LocalServer32 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\Version 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3} 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\HELPDIR 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHDCPSvc.EXE\AppID = "{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB}" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\AppID = "{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB}" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\TypeLib 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\FLAGS\ = "0" 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\0\win64 2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar.exe