Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 21:36
Behavioral task
behavioral1
Sample
2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe
- Size 732KB
- Sample260716-1fx7eaew7r
- SHA256 2f06ab13f4ab1d3bcf433f07206ab5349ce6044a5d0d2e39d2f3c27f08984ad0
- MD5 175ef6e70fe63aea72c98f82c8f27fa5
- SHA1 af1606b0f5d37a91472065c49214859ac896f83c
- SHA512 7b00143a2a09a14ef501dc9dd5620e652e800bca21511b6abc1b982f6694193c657e0c556381da5e27612a789b73f88cf2ed01f049ca4502602b205237b8db2e
- SSDEEP 12288:yUfBQGH6SfKQher5+nZoygL0fmer5+nIwaJS:Lfa86Sf/19Hu
- TLSH T1B7F46C0BF75298E2C9594A355E644291673AE453AEC74353B98C030DCF6738ABF26F38
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c34c-6.dat family_cosmu behavioral2/files/0x000d00000001c358-81.dat family_cosmu behavioral2/files/0x00050000000188c7-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened (read-only) \??\G: 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened (read-only) \??\H: 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened (read-only) \??\K: 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened (read-only) \??\L: 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened (read-only) \??\M: 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened (read-only) \??\O: 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened (read-only) \??\D: 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened (read-only) \??\I: 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened (read-only) \??\J: 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7z.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\7-Zip\RCX4906.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4AEE.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX4BD8.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX4F59.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\7-Zip\RCX4928.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4979.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX4F05.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\7-Zip\RCX4939.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX4E32.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\dotnet\RCX49CC.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4B1F.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\dotnet\RCX49CD.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4ADC.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4B41.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX4C5A.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\readme.1xt 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4B30.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4989.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4B31.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4ED2.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4EE4.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX4F15.tmp 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\7-Zip\7z.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_175ef6e70fe63aea72c98f82c8f27fa5_cobalt-strike_elex_icedid_njrat_rhadamanthys.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2944
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 732KB
- SHA256 5f7497b7c4a5fe71ddb4a5026c8cb4232343e3565e5019d337d8056348a32630
- MD5 67b7a68ec404dab1bb95e836fd529d97
- SHA1 c75d6e3a161044c2f2afdaea2cf93eba69fd7eef
- SHA512 76c72f3ebdc2fbaefc6bd393c5a3592a2af109b1e2a0753589a557d63b2c0321e5ccbe2e7a4fbe58515d3acf2277aa8a8205189b5f4019030837e27a88460796
- SSDEEP 12288:KUfBQGH6SfFQher5+nZoygL0fmer5+nIwaJa:jfa86SfG19Hm
- TLSH T1B7F46C0BF75298E2C9594A355E544281673AE453AEC74363B98C030DCF6738ABF66F38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX4ADE.tmp
- Size 732KB
- SHA256 03d71c7df25b0f3b383d285be3719292b3cfcd0874380bd5d309974c3e5b4be5
- MD5 551695f8084fc94a6f917aa4c42c8677
- SHA1 4c61b86af1000cd613710727e96acf9ee0a80d46
- SHA512 4c1f4a80049a5a0d10ccb9a54936ef432168de4fc975541fffabb28b19c85de7b5ce4dd9d7f8e053cf77fa065fef072f65e649b4db166da01b850f5c0adcbf46
- SSDEEP 12288:eUfBQGH6SfwQher5+nZoygL0fmer5+nIwaJ:Hfa86Sf919H
- TLSH T167F46C4BF75298E2C9594A355E544281673AE453AEC74353B98C030ECF6738ABF26F38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX4E72.tmp
- Size 732KB
- SHA256 ac1d109381cfb60380c94c09c8cb683cfd854f8a96e72811bbcc17a62708583d
- MD5 1a891ab73ac7758765d4121a0f82a5f6
- SHA1 12db0e2193e1658f81d8e5241bcc4da24e9b34cc
- SHA512 a47a2709d244d4544527fcada9e88486b295b967b47b4de9b5900965990274643b5aec3387d9fbe57289700d505083310f934d7e2a2be8dc2517d8aedabf99b2
- SSDEEP 12288:uUfBQGH6SffQher5+nZoygL0fmer5+nIwaJ:Xfa86Sfo19H
- TLSH T106F46C0BF75298E2C9594A355E644291673AE453AEC74353B98C030DCF6738ABF26F38
- MD5 SHA1 SHA512 SSDEEP TLSH