a03ec82fb44c32e79e7265e6e1cf0ec3dbe44ff236353f265c34aadffdce4341

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 08:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe
Size 902KB
Sample260802-j8bqfaycle
SHA256 a03ec82fb44c32e79e7265e6e1cf0ec3dbe44ff236353f265c34aadffdce4341
MD5 8f094270fd345a0f067d97e0b417a400
SHA1 76e761c8a6205bf90c62b44ec2b010fade211050
SHA512 29ac146d703e1d2011c34ffb61a865ab063e7705072e21e739d888d3061c91eaa4ce0a312f4c8a5e1d3b409ed12394ce318249675566677ca8ea55e1cf1d43b7
SSDEEP 12288:EBoyGqHmc9An6V2dhnY6SwTb57mMxLgWnQw8sKk5U8TI1Tw5iK7FrAa/5u6qDNT:k/HHAnW2XY63v0Wiw89k6II1EL8n6UT
TLSH
T12015AF5B3780C4E5F54A80FB80BF85F2636AF4135941C61B212C562F5E78C6C7EAEA72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4840	2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7z.exe.ico	2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe.exe	2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\7-Zip\RCX4D1D.tmp	2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\7-Zip\7zG.exe.exe	2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\7-Zip\7z.exe.exe	2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\7-Zip\RCX4C61.tmp	2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe.ico	2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5556	4920	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4920	2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe
4920	2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 4840	4920	2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 1720
  2⤵
  - Program crash
  PID:5556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4920 -ip 4920
1⤵
PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX4C61.tmp

Path C:\Program Files\7-Zip\RCX4C61.tmp
Size 804KB
SHA256 0fa93e99f3cdd0ed9c730c3eb8860b0b48148f3be007f208b0159974b2840567
MD5 97ce3ddea8713f68917cddda8c8fa540
SHA1 cb848a6385d016b968e091f3b84bf67b0e1940cf
SHA512 73f43295c6f93e510e3aa744835dcac3960920da07e1979d34247dd9457e008dd1a9473d93e66329d20e607ea150fd1d70879d6c8e12ee649802afca5c23bf36
SSDEEP 12288:EBoyGqHmc9An6V2dhnY6SwTb57mMxLgWnQw8sKk5U8TI1Tw5iK7FrAa:k/HHAnW2XY63v0Wiw89k6II1EL8
TLSH
T12205AF6F3B40C865F54E90FB80BF81F3626AE4175841C217312D662F9D78C2C7A9EA76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-02_8f094270fd345a0f067d97e0b417a400_cobalt-strike_elex_icedid_vidar.exe.exe
Size 104KB
SHA256 723e7a75a39de3398748b022d02c0a4171f95490c25572c67e0e777fa7abf5a6
MD5 a0e049e243c355359e1c7fded4041a2d
SHA1 d7e074646641732b3237552b244a0283621c1e80
SHA512 0c59da32bd6ef981ea609495c7a355101607a58eca896e73fd6886bc0043d3616874aea7c8c90a66994e9714a7bc1c62ff957fb7e94e398911caebf58ccd5a8e
SSDEEP 1536:Rt90alFHfRr4vkK/sTZSGJcXaDNUjVa51UysWqEdU9dldSGyBkc:D9R7fREvkgsTv6qDNUgzU7usKGuk
TLSH
T11BA36C86B3A050D9F2734675C9609A05EB36F8710B618FEF026483AA1F677D19E3DF21
MD5 SHA1 SHA512 SSDEEP TLSH