02da4cd41895843367ddc039630d479ae93adf80af5f798dc0939a3d77532726

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 05:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 3.5MB
Sample260729-fsxfeseb77
SHA256 02da4cd41895843367ddc039630d479ae93adf80af5f798dc0939a3d77532726
MD5 d386fa9e4b99c34b2ab50ce1ff371843
SHA1 976c3b9ad64a962548715636fc8fb6932f56fe94
SHA512 0e04165401e977ee957a8536f9dd30af8f003640f2440c872521e3b51659c521f0f637410ccd064dd0b9916bea439231755d2c7a7292ea50f1c8ea6c758a79b3
SSDEEP 49152:G7N7L4cFaCxNXyLfWwagTNFsEd3p0uBjfKPh1pXqlzgyXMw7K6mwFK6Y3TbZ:G7NooaoFOTNSQBjgitA
TLSH
T1ED068C03E19504E9D299C174CF568939EB72788D0BF9A1FF36909A192E37AD07B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2836	2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7z.exe.exe	2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\RCX6067.tmp	2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zG.exe.exe	2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7z.exe.ico	2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\RCX5FBA.tmp	2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe.exe	2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe.ico	2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	2916	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2916	2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
2916	2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2916
- C:\Users\Admin\AppData\Local\Temp\2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 1860
  2⤵
  - Program crash
  PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 2916 -ip 2916
1⤵
PID:5860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX5FBA.tmp

Path C:\Program Files\7-Zip\RCX5FBA.tmp
Size 812KB
SHA256 d2f3cc87b9608989155fc4c037d3ec59f2a9e8a5dfc8b4d5f10778d5093d78ce
MD5 91042ace1dd3595fd21761bcd6f6cf28
SHA1 18910e9e56347a482f55c7df43d6e9fd794e3b36
SHA512 49b499a06e5a79957bd3fc5d6c4680828e7327b65b95caf6d143ae2fb3afd78d839dcadf4d70320ab807002117f5945f53e455b2e41128c8ec6ba89d9517e049
SSDEEP 12288:kTsglLQY4e4mL4w5x2EBW4TksadkxcLoh0vpH/Vw5iWxyLs:G74e7L4iU74TksadkxcLiuk1xyL
TLSH
T184058D46F2926C32F73C57F809F95EED0A7328E10D5D05CF1E12AD0F2F2A85A4995DA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-29_d386fa9e4b99c34b2ab50ce1ff371843_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 2.7MB
SHA256 fd1c3eea6be57986f139d2cf8d61ac07bc51946410f84f7f6038ae8fdde04cf3
MD5 027068248ee160861e7b96009882f2a6
SHA1 6d6bb6d250032bcca9ab32aa7a890e946b604664
SHA512 b5000f65a282afc14cf928184072ca258eb5f665af16e4127ecd096193d3c8b0fe28735160338129dcd0b215d649a921ce3c0a1dc31bbfa59e66d4311b8113a2
SSDEEP 49152:9WwagTNFsEd3p0uBjfKPh1pXqlzgyXMw7K6mwFK6Y3Tb:kOTNSQBjgit
TLSH
T1F7D55A03E19500D9D199C174DF46C632EB72B88E0BF6A5FF369096152E67AE07B3EB10
MD5 SHA1 SHA512 SSDEEP TLSH