25d492fd6e51affe9ddb1909835969c2082298038ab603f392a10e02b97118b9

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe
Size 898KB
Sample260802-a2x6esba89
SHA256 25d492fd6e51affe9ddb1909835969c2082298038ab603f392a10e02b97118b9
MD5 57fc529e534e143e02e45f1479559764
SHA1 9e987a364fed68aba2c3b34846be818b7026bb6d
SHA512 477a4396f88670fd29fcf1967bf0240ffd23f332eb3c855cac6bace826d84d1d233a709da481d6ee2add333413f460406f6615c262d2c16c5664ccad5eeae858
SSDEEP 12288:aDZBVlndNssJY2jkrKgRn8qpIk+FjPDKWPDxt+tyw5iNkALRMX5u6qDNT:afdNA2jkrM1Fj7KADT+JUL6UT
TLSH
T13D15AED87B6184D6C0AD0B37050052D8967E2B7769035F1F2A05739CEEA6712BEB7A33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5844	2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\7-Zip\7zG.exe.exe	2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\7-Zip\7z.exe.ico	2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe.exe	2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe.ico	2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\7-Zip\7z.exe.exe	2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\7-Zip\RCX715E.tmp	2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\7-Zip\RCX721A.tmp	2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2244	4528	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4528	2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe
4528	2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 5844	4528	2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:5844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 1856
  2⤵
  - Program crash
  PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4528 -ip 4528
1⤵
PID:5916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX715E.tmp

Path C:\Program Files\7-Zip\RCX715E.tmp
Size 800KB
SHA256 94e9ec7bdc1be6544591159898e3c4ce94f0750400ec311ddd2d9a6de68bf3ab
MD5 dae2b886c0da2137a190b1c23bcd2410
SHA1 71ede777c4fd20302437d849e0cd1869ee35aea5
SHA512 7953f21f325368c456f333c69cc3cc3adb32e69cda9eb7c6a5cbb670e62d41d93c786abe7d1d61ea0e862bd81b5a5d7c2603cb3fc37c31ce70640c8528fc4c73
SSDEEP 12288:aDZBVlndNssJY2jkrKgRn8qpIk+FjPDKWPDxt+tyw5iNkALRM:afdNA2jkrM1Fj7KADT+JU
TLSH
T18505BED83B528486C09D0B77060553D89A7E1F7768035F1B2A06739CEDA6B12B6F3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-01_57fc529e534e143e02e45f1479559764_cobalt-strike_elex_icedid_vidar.exe.exe
Size 104KB
SHA256 895892610148c5b62f718cc832068a74a7ccd4ee0fc58e4649a756d4f33db302
MD5 28f628531471adcecec9890e592f4e9a
SHA1 9f572633e7eeb992dbe89e98866a19be4d372dcd
SHA512 6c38a0db214ac53231f284ed2548efb68d06c3326a88815c6715c939b14df43261d978849b7208b084d571cba6fd4965dc4cbba7ed5714c33e46613bbf86beee
SSDEEP 1536:Rt90alFHfRr4vkK/sTZSGJcXaDNUjVa51UysWqEdU9dldSGyBkc:D9R7fREvkgsTv6qDNUgzU7usKGuk
TLSH
T11DA35C86B3A050E9F2734674C9609A05EB36F87107618FEF026483AA1F677D19E3DF21
MD5 SHA1 SHA512 SSDEEP TLSH