Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 07:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe
- Size 547KB
- Sample260717-jvdymsat91
- SHA256 366a642d95aeeb1155b66f10b6518ab518fc0e02ddbfe5ef078be8fe662b29bb
- MD5 68d32e215a4f37d2927014c98bb8555c
- SHA1 a57ddd838356ab20d3013c75bf6ecf680e47b4fa
- SHA512 b9f0cbfd18105968c752b9d3010a594db04bc54de30c7279f937cceda9022128cbf38bc9884f699c6c3083df998f03fa1c54727d4676e3050d733de01b9d2ff6
- SSDEEP 12288:kKfu7uoJJT9Sxo7dLlr4StqyKS6fu+hi8:Bm7uoJJwqVHT6fuGi8
- TLSH T19CC49E01B7E846E9E06AC534CA438646EAB278560F64F6DF03D092792F37BD54F3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXBCC8.tmp 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXBD96.tmp 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXB3F7.tmp 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXC161.tmp 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXB486.tmp 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXB2AE.tmp 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXC0E2.tmp 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCXB2AD.tmp 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCXB4D5.tmp 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXBC68.tmp 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXBC88.tmp 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXB418.tmp 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXBCB8.tmp 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXBD37.tmp 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXC122.tmp 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5012
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 554KB
- SHA256 6eea1216e205be12bc820650ed6527fa0d3942a8ad89e492f7a5484d2f80ccc2
- MD5 b468e48dab2a08bb5d305ac4554b042b
- SHA1 c0454dca610722df5d14ed13afa9d2e56037e786
- SHA512 22606b49ca8ecc1bd9f2797a57b66669b818552ca3ae0e6561337430a56b553d1252ce9c23c735954625179fe8d63fadc08bc19af046b77369ffdb3fd9528b38
- SSDEEP 6144:k0QLO76tlVr1Il5HlrJHU7kfLeeHVlK8SQBJ9LBKJwgdAmKa5rL:kTS86nHrUA9HVlK8SQBJ9t4f15rL
- TLSH T16BC49E41F7D847E9E06AC534CA428546EAB278960F61F6DF03A0427A2F376E54F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
- Size 1.9MB
- SHA256 bd630336998c212b4a8601a23b2014958da598ab3e3c3727daaa48f2c852b316
- MD5 82dca2e0422fe46053b0ac5f98ee2ce1
- SHA1 a7c13af3dd0f2100ac48c788ad0cd493ae2e0c18
- SHA512 ed62b46f226dbfbc56f28c65de6cf80791264b3f2cea034eb07c5b0e616d8db0ab3f70cfba9835186d3a8e8c3cce86e4ff83a87014310e36aafee697dadc33a3
- SSDEEP 24576:d3I5kAGu6McqpA7D9ruO3O7Q7OBLLMdus7CtW7KSdHBxmRkkkkkkklQXBysWAb:lIZGu6qG13O7Q7gLYduZrSdHBAVfb
- TLSH T197958D03F6DA80E5E05DC2B8CB768B35DAB17C555F20A6DF0680BA652E77AD04B3D390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
- Size 1.5MB
- SHA256 903517e4239a2930a4a571fb98ea816042239b25a5ea40a37271ba5eaeec71ad
- MD5 303ea91fd01cba89ec780d511d323b40
- SHA1 272ea0f2ffd0a1afe7d7dfe003f090293a3a72c0
- SHA512 b6fb0addac5fce646969073422491122e594a72df3366fb8ab3d80dd79c19c9e71fdbc7671845c9df80cd792979e55cae24a257737c7087b38446127f545f0b4
- SSDEEP 24576:6yoteh6euUHmEhK7eTuNdfxINakEtv9kWG2L1oaedpEukUoygGmq/Sl:6fehjvHHKTdfxINPEt99G2Bo7EukU1a
- TLSH T1CD657B03B2D901E8D06AD1B8C7468536EAB2BC450B24A6EF0B90B7551F7BFE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e59b200.tmp
- Size 2.8MB
- SHA256 aa0a34300a93a2882b241b7fbf23e590f594f811fabfb8fccbc789796b7fa80e
- MD5 5fb303dcaf8de9324c9e4824718c0195
- SHA1 068710eaefe9da6aac750553546c08d2ad723b3e
- SHA512 1b117e044862a9a6bfc55984e6fd5093e0baa413507ca3055becd321ee602dbd5fb41c1bfa5e21327390e83ed50f6d1dabfea6e84896c11bb284578df8e7e7ee
- SSDEEP 49152:jY2fF8FhmS86IUJWQn+6h27d+Y2fF8FhmS86IUJWQn+6h27d6:jbOjjst4bOjjsts
- TLSH T1B6D57B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-17_68d32e215a4f37d2927014c98bb8555c_cobalt-strike_elex_icedid_njrat_vidar.exe
- Size 515KB
- SHA256 225444b3a6b8b38119c8592c8143d7ee331ed5375992cf8f21673c46192f5333
- MD5 b239888f10dd59220c7f6c8018041b39
- SHA1 d83c3626d658ca32b7a4d8d9ca095ad8436280ad
- SHA512 d1b33ee65e2f4a0a489fda4fe1de320206f435e90944e4a4695040a10bb840ffb0a145e16a0049fb6ba5fa3984a3250654026cd0fe9ccf181da8fee60098d74c
- SSDEEP 6144:FfArhIg7uozDRblToGSxD0HLdRl82HFLlr4StqUFKS6/H7a+X9geni8:Ffu7uoJJT9Sxo7dLlr4StqyKS6fu+hi8
- TLSH T1C1B49E41B3E846E9E06AC534CA078646EAB278560F64E6DF03D092792F37BE55F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH