d0b6c9d7525d5e48d42ff2307624445684c9f5f4cb9eef64e2dc65b91ce8c791

Analysis

max time kernel
149s
max time network
135s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 05:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-09_1f5ec85a572ee0cdfcfc1300a65e5ddc_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 1.7MB
Sample260509-f4gjcaaz91
SHA256 d0b6c9d7525d5e48d42ff2307624445684c9f5f4cb9eef64e2dc65b91ce8c791
MD5 1f5ec85a572ee0cdfcfc1300a65e5ddc
SHA1 0468c4d148b99b8929fd915a89b8c0c5aa8cfdf7
SHA512 8a4299128e70640f7198a04fed2c11b798b7e424a0351c308a03a8b4f13003f511d5210407555f57f672af21e1578e7a72d4685e1af125f0490aad6f40033e26
SSDEEP 24576:p3toMtBkKn1OB95/lYAOffizD34ZKXrWLkkkkkkknX3eAz:xtV51OB95/KfizDIYXnXz
TLSH
T10C858C03F68681E5D05DC2788E764725EA72BC255F30A6DF0290BA252EB7AD01F3DBD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3732	2026-05-09_1f5ec85a572ee0cdfcfc1300a65e5ddc_cobalt-strike_elex_icedid_njrat_vidar.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX26D0.tmp	2026-05-09_1f5ec85a572ee0cdfcfc1300a65e5ddc_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-05-09_1f5ec85a572ee0cdfcfc1300a65e5ddc_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX269F.tmp	2026-05-09_1f5ec85a572ee0cdfcfc1300a65e5ddc_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	2026-05-09_1f5ec85a572ee0cdfcfc1300a65e5ddc_cobalt-strike_elex_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-09_1f5ec85a572ee0cdfcfc1300a65e5ddc_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 3732	5052	2026-05-09_1f5ec85a572ee0cdfcfc1300a65e5ddc_cobalt-strike_elex_icedid_njrat_vidar.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-09_1f5ec85a572ee0cdfcfc1300a65e5ddc_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-09_1f5ec85a572ee0cdfcfc1300a65e5ddc_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\2026-05-09_1f5ec85a572ee0cdfcfc1300a65e5ddc_cobalt-strike_elex_icedid_njrat_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-09_1f5ec85a572ee0cdfcfc1300a65e5ddc_cobalt-strike_elex_icedid_njrat_vidar.exe"
  2⤵
  - Executes dropped EXE
  PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 626KB
SHA256 6c829ee76a3d645d71eed71cbc95f518fb47537a3456345e7e93620978191117
MD5 faf2f8ad6f3d513eb849c4f42313c35c
SHA1 2a423c5a16461b182a216118848d3741179f1984
SHA512 08b6653d18351bb79769507c70f6a2b39bdd3f9d8408dd418aed3b7620886a680d5b5c90d4e172bd0e6a076cb65c86a57f470f42b79d55949467209042b2658e
SSDEEP 6144:sgfe5v0WURy2QLO76tlVr1Il5HlrJHU7kfLeeHVlK8SQBJ9LBKJwgdAmKa5rL:tNWURoS86nHrUA9HVlK8SQBJ9t4f15rL
TLSH
T1E4D4AF41B7D847E9E06AC534CE428682DAB57C961B61F6DF03A0527A3F336E54F3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-09_1f5ec85a572ee0cdfcfc1300a65e5ddc_cobalt-strike_elex_icedid_njrat_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-09_1f5ec85a572ee0cdfcfc1300a65e5ddc_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 1.6MB
SHA256 ce5642aad0ec024d7bac19c1993ee90a5667c1a8dc6dc582cdd36e88a087037e
MD5 e9031fdacc5f7002af051f66c92defc2
SHA1 7da4975ea4920bca44736b498cb2e03c12a578dd
SHA512 031b72e8c756e2fa60a1b1e6cd2b8a702d910f7d2485dc8603e6862720481ebcead78f624e3a3114b2622922f957fbdcede71f4844ab31ac6056571494c6efc6
SSDEEP 24576:koMtBkKn1OB95/lYAOffizD34ZKXrWLkkkkkkknX3eAz:kV51OB95/KfizDIYXnXz
TLSH
T1C1758C03F68641E5D05EC2788E764725EA72BC255F30A6DF0290BA252EB7AD01F3DBD1
MD5 SHA1 SHA512 SSDEEP TLSH