f88a7f33ad536227edf8255ec363bba0d827a5f1eab5311707381016f8b5a8f6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/05/2026, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_eb21339a9fbbacd9f69f13702786b646_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 1.7MB
Sample260507-m9vfqacx21
SHA256 f88a7f33ad536227edf8255ec363bba0d827a5f1eab5311707381016f8b5a8f6
MD5 eb21339a9fbbacd9f69f13702786b646
SHA1 dcf03504d8bb9102c97ebb66907a209ebd4f608e
SHA512 b50508eb9f53e968c0d0d5aeeff18fa32ddf45f89dabf7cac7d8de9f866dce1e2651e2ecdca4187a28202d2b851b63e4df4865867b29767f59e2df5af23abc62
SSDEEP 24576:iqASaa2tcUGm1zKdwI5N/OyNEDb5kD+WauvtuP3GmrceY988PKb7AAoKl:/WWu1zKeI5Nj2bchBluP3GiyBKDh
TLSH
T123857C03F6D941E8D06EC27887469132EA72BC4A0B35B6DF0690B2592F77AE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4852	2026-05-07_eb21339a9fbbacd9f69f13702786b646_cobalt-strike_elex_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_eb21339a9fbbacd9f69f13702786b646_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4852	4700	2026-05-07_eb21339a9fbbacd9f69f13702786b646_cobalt-strike_elex_icedid_njrat_vidar.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-07_eb21339a9fbbacd9f69f13702786b646_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_eb21339a9fbbacd9f69f13702786b646_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Users\Admin\AppData\Local\Temp\2026-05-07_eb21339a9fbbacd9f69f13702786b646_cobalt-strike_elex_icedid_njrat_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-07_eb21339a9fbbacd9f69f13702786b646_cobalt-strike_elex_icedid_njrat_vidar.exe"
  2⤵
  - Executes dropped EXE
  PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-05-07_eb21339a9fbbacd9f69f13702786b646_cobalt-strike_elex_icedid_njrat_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_eb21339a9fbbacd9f69f13702786b646_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 1.7MB
SHA256 787bb729eb3339a21a28043c0566ce020ffe72e5d79d2b57f5e00fc4a40bc1dd
MD5 8cd61763c0355807dcad3c0211a54aba
SHA1 fd692089bc31dafbe40b4826cb691489155e9cea
SHA512 cfb1855c89e03c977dc14fd58a2d7205522b970a69de2f33a3f30abafb9777a3b749af38551ba15b3b0017265b1cbc37c67fd5d743c21870ce2adf02c83c12a2
SSDEEP 24576:7qASaa2tcUGm1zKdwI5N/OyNEDb5kD+WauvtuP3GmrceY988PKb7AAoKl:MWWu1zKeI5Nj2bchBluP3GiyBKDh
TLSH
T1BB857C03F6D901E8D06EC27887469132EA72BC4A0B35B6DF0690B6592F77AE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4700-11-0x0000000000890000-0x000000000090A000-memory.dmp

Download

memory/4852-10-0x0000021017A70000-0x0000021017B1C000-memory.dmp