b8b265ce98134060dd852ad0d7490c251a2b9ea66c652f942a6a538a1d2475ad

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 2.2MB
Sample260801-3tfwdsaf33
SHA256 b8b265ce98134060dd852ad0d7490c251a2b9ea66c652f942a6a538a1d2475ad
MD5 c5191215f6da1be88ab6fae087532e68
SHA1 596a654d49d72f44470318afb0a4aad4545197d8
SHA512 911ab05740d1d4baceeac1fd62c748aeb0b18b882115940d108c81e2672d658a60fd498a091d0b4427be0d1ec6b639a570920a86a404751c7dade6a80fdff857
SSDEEP 49152:nVRnP9aJDH92yv4VrRHYlArPlrl/ohdTUzw:TnVgF4VFFo
TLSH
T1B4B5AE07F98562E8C06DC1789752B576EA32BC461F3CB5DF03519AAA1E32AE44F3D324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3548	2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7z.exe.exe	2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7z.exe.ico	2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\RCX7B70.tmp	2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe.exe	2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe.ico	2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\RCX7BFD.tmp	2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zG.exe.exe	2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5124	4244	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4244	2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
4244	2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 3548	4244	2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1652
  2⤵
  - Program crash
  PID:5124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4244 -ip 4244
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX7B70.tmp

Path C:\Program Files\7-Zip\RCX7B70.tmp
Size 756KB
SHA256 c493a9ad077d830cf96fe5956cf05369f24197a2af2ad43c313001fe5a63cf53
MD5 1405519de84e934fe08794f4de17596b
SHA1 19b8c953980d0e4904f3d0070c87c4105ee9c560
SHA512 1b8eebdfdb6165bfcc53083ea5ffa5882b72d645bc9ce7170e2eebc9b536fb1c21bfa13c6c1ff440b86b8d70c9d6256ca044870667de44089febfd98dfceac5a
SSDEEP 12288:mgBYQekZt05ADTMKaGyIs4TqdSim8C9WVw5i36:6QVRnaGyIidY9WWU
TLSH
T18DF49D5A7C48BEAEC65D18BDA2B178EDD3793D12995CD0CBA6426DFE1D2040C087E23D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-01_c5191215f6da1be88ab6fae087532e68_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 1.5MB
SHA256 8ca9141a5a91703dd4c60fba829a3b9fbf09591543c4f8bfeffe925cdcbde046
MD5 ccec34a2ca5d129ad555f3362dd735f3
SHA1 d284678a310453269732b516360dfc4ba6eaa660
SHA512 19224035243855a1cd09f15f3d510ee1b55fcf330e875c1c0ae467255ec96931d7d1c91ec805ce971c5d2a8a6a6d0012b45565a4271a6bcb7d0bf0da11a21dbf
SSDEEP 24576:XJtrFXHlSIL6/yv4Y6r+jurjYlfnIrPTpxVl/ohNXrTUzOozUnxC:XJDH92yv4VrRHYlArPlrl/ohdTUz
TLSH
T139758D07F6D542D8D06AC1748746A533E932B85A1F34BAEF0391926A2E77EE09F3D710
MD5 SHA1 SHA512 SSDEEP TLSH