da5df06bf9f7ac4dc6b0c5072ef4bb7950ce938d401f9c86770cf45a9bafa0a0

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 19:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe
Size 894KB
Sample260710-xnsecafs2n
SHA256 da5df06bf9f7ac4dc6b0c5072ef4bb7950ce938d401f9c86770cf45a9bafa0a0
MD5 fed1028b7f0c36b16763a33c0269a93b
SHA1 6f77f2ddc45c812fd07a4ae378301d7ba6f1c7f7
SHA512 2fd791e3fa19c60d23606c6da1f8cdaac47ccb96ae65498a087b4a13da3b5fdd3e87919108114937cdea8754cbfc5f13aa94014f3e0efde2d39103305153e410
SSDEEP 12288:IFKsEq/U6STiszZ9leBDEcpjxvh04IwzSipcuyQw5iCoMyYNv5u6qDNT:IFKI/U6STisz3le/NJSClCKp6UT
TLSH
T17F15AE087255C8F7FC5D2832455975A38B2379B6CED2400F22A46E3D1D39AD73AB87B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1288	2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7zFM.exe.ico	2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\7-Zip\7z.exe.exe	2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\7-Zip\7z.exe.ico	2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\7-Zip\RCX9178.tmp	2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe.exe	2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\7-Zip\RCX9254.tmp	2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\7-Zip\7zG.exe.exe	2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
940	5044	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5044	2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe
5044	2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 1288	5044	2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 1856
  2⤵
  - Program crash
  PID:940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5044 -ip 5044
1⤵
PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX9178.tmp

Path C:\Program Files\7-Zip\RCX9178.tmp
Size 796KB
SHA256 021a30d8623e9422c3f5178da7e5624394a76b4d87d38480b4ae5475538329e0
MD5 e1f18293d596e63db209179f374c7142
SHA1 e988a3dfcddabdbdfc651efa28424ac841d15651
SHA512 13856d17313f52783572b310a0afc34569ec216bf78a10a7f541a0c5b2cd9e9cd8035c8da9ce142af31956d126b055063dcd8465f8c2bb751ce49a8f13494928
SSDEEP 12288:IFKsEq/U6STiszZ9leBDEcpjxvh04IwzSipcuyQw5iCoMyYN:IFKI/U6STisz3le/NJSClCK
TLSH
T17305AE087659CCB7FC5D2837155D75E38A133DB6CEC2400B22A57E3D6878A9736A83B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-10_fed1028b7f0c36b16763a33c0269a93b_cobalt-strike_elex_icedid_vidar.exe.exe
Size 104KB
SHA256 d112805b6dfd6ae3a4b1b97f8594ccfe795d89b0fad7c0f9d54f3d5b275eb973
MD5 04f87c7fc108996a0955f9474345fe4e
SHA1 8869501ebdf10943f3ea18dc612ad31b95afd0ea
SHA512 0520cbb386a9337802c926bf84ba1284dd4965193f98266e854fff97c227c5a801dfe8ea0e86c2ab959edabcfb4b5b910a070c2469674f672f8eb460c99a97dd
SSDEEP 1536:Rt90alFHfRr4vkK/sTZSGJcXaDNUjVa51UysWqEdU9dldSGyBkc:D9R7fREvkgsTv6qDNUgzU7usKGuk
TLSH
T1EDA35C86B3A050D9F2734675C9A09A05EB36F8710761CFEF026482AA1F677D19E3DF21
MD5 SHA1 SHA512 SSDEEP TLSH