e2360fa1d66d427d86a7286c9a72fb2e25074701f4eb60211a83ed8ec1dd93ee

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_510d97f4d0b7681ac5b52b1f5c2044ec_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 1.2MB
Sample260511-mt968saz9p
SHA256 e2360fa1d66d427d86a7286c9a72fb2e25074701f4eb60211a83ed8ec1dd93ee
MD5 510d97f4d0b7681ac5b52b1f5c2044ec
SHA1 9162c1fc0b0de8cabfa189714a56de708584065b
SHA512 3ae0165bca16e3b980429072b159febd0024c99542fbabcf78bc0ceb969ec11c1d096f26762dfcd57c0e0140a74b4646b8019d967d21f083da89c493fec0ee11
SSDEEP 12288:kdJLUgz5qoSzT78I/xem0kzfdlslx+DpNeVP5oBRlP5cjVh6u+m+hA+nkYooRgg6:4z5qZem0+dl6ZVP5olP5IVJXAjRq3
TLSH
T1D0458D07B69941E8D02EC1B48B464176EA72BC561F34AADF0690B3192F77EE42F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5788	2026-05-11_510d97f4d0b7681ac5b52b1f5c2044ec_cobalt-strike_elex_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_510d97f4d0b7681ac5b52b1f5c2044ec_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5640 wrote to memory of 5788	5640	2026-05-11_510d97f4d0b7681ac5b52b1f5c2044ec_cobalt-strike_elex_icedid_njrat_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-05-11_510d97f4d0b7681ac5b52b1f5c2044ec_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_510d97f4d0b7681ac5b52b1f5c2044ec_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5640
- C:\Users\Admin\AppData\Local\Temp\2026-05-11_510d97f4d0b7681ac5b52b1f5c2044ec_cobalt-strike_elex_icedid_njrat_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-11_510d97f4d0b7681ac5b52b1f5c2044ec_cobalt-strike_elex_icedid_njrat_vidar.exe"
  2⤵
  - Executes dropped EXE
  PID:5788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-05-11_510d97f4d0b7681ac5b52b1f5c2044ec_cobalt-strike_elex_icedid_njrat_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-11_510d97f4d0b7681ac5b52b1f5c2044ec_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 1.1MB
SHA256 25562a4a665623da36bf79efed8a149965c6a418dbb91a42f2aa3fce2f48549d
MD5 871450e45f44c1264d6c1bcbff9e4b4f
SHA1 d5d9cc6a20a909273b825fbaf1bc81b064f32189
SHA512 ca465a81d2b40a1c0755891bd456b38f95d1a61e41d1980bf46b6c73b5313d8965f614113e99afe4b1087062db9f10bbfcebf91a904b1e8c4ccc39ee9c1bc4c3
SSDEEP 12288:GLUgz5qoSzT78I/xem0kzfdlslx+DpNeVP5oBRlP5cjVh6u+m+hA+nkYooRggBu3:iz5qZem0+dl6ZVP5olP5IVJXAjRq3
TLSH
T1C6458D07B69941E8D06EC1B48B464176EA72BC560F34AADF0690B3592F77EE42F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download