c8e96d889840c06cb91aab9534350bbaf87bda1e66098e0f1c185d98d5d4b27b

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 2.2MB
Sample260712-ry4mgadx81
SHA256 c8e96d889840c06cb91aab9534350bbaf87bda1e66098e0f1c185d98d5d4b27b
MD5 04c8036c294ccd2ad286bee516618401
SHA1 533bc35579c29c72809d67911d81f0a5973246de
SHA512 2b63c60db54dd154ea046b8455fb22dc1a8c67ae5f7a4c273dc13499b8ae08829d5698f8343646a6be4671a7e5e161f4e7d804c68f90b84354ea5ec89fba9c3b
SSDEEP 49152:cm3rwoe+YJDH92yv4VrRHYlArPlrl/ohdTUzw:nwX+KF4VFFo
TLSH
T1B0B5AE0BF1C945E9C06EC1346B9ED636D921B8459F24B6DF03A0A22D1E76AE17F3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
948	2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\RCX65F5.tmp	2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zG.exe.exe	2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7z.exe.exe	2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7z.exe.ico	2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\RCX6557.tmp	2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe.exe	2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe.ico	2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2440	1384	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1384	2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
1384	2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 948	1384	2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Local\Temp\2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 1860
  2⤵
  - Program crash
  PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 1384 -ip 1384
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX6557.tmp

Path C:\Program Files\7-Zip\RCX6557.tmp
Size 764KB
SHA256 b52c20ef825ed384548939384617a7f7ce586e79d3c48a509cbdf35d3a3b92b8
MD5 4c343de43def53a6487e927543284eb5
SHA1 a0a1174b479f5a10b9e2500e2cf174e932dc32fd
SHA512 02ea473afca2a379d4a11c61ecb794e03cd6279a21f72991db70404c1d37323baf21e86f1fd7946447e1a909aa26cb717a2ab18c822a8be0df3d85c22f6eadc3
SSDEEP 6144:SI5Enw0U4K6dNK1bWygByrvfsR8yuTsurwydh90ALkzi7tFn3sA9vqCz1lcwCw5z:ZcPmP/TjrwuhegeKPjbww5itoC/EL
TLSH
T12AF4AD2FB28EDC3BC06E153439EDC6FE8919D855ED46A60392B5783C28749677C7A230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-12_04c8036c294ccd2ad286bee516618401_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 1.5MB
SHA256 745718dedfac13be7c6036a48ee67bb1bc001149497c4b3b4dd304b5b293175a
MD5 bc7d85a82e8bbbb26b1490675508266b
SHA1 be6d09d60145a783c5c73e95f4dbcd4250524108
SHA512 5c7ff3467b81be29fa3eada9edb6927f46ffafc23aa2cd79f52d16c39ee82f7fbf3b88ce249fc7580253b38c42fc00b1863ae6e8c961ce68664a667ced66b97d
SSDEEP 24576:XJtrFXHlSIL6/yv4Y6r+jurjYlfnIrPTpxVl/ohNXrTUzOozUnxC:XJDH92yv4VrRHYlArPlrl/ohdTUz
TLSH
T15D758D07F5D542D8D06AC1748746A533E932B85A1F34BAEF03A1926A2E77EE09F3D710
MD5 SHA1 SHA512 SSDEEP TLSH