Analysis
- max time kernel
91s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 04:57
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe
- Size 1024KB
- Sample260803-flbkdasshy
- SHA256 fddf83066f3afb672d3c92c6cc2b5c4f50345f7e668e9f3ed46a1a68957dd867
- MD5 90dd7c72b2163926fd44ef3f48aa4a3b
- SHA1 27739458cc35c9ed1b024090cf6a4d53d9736a54
- SHA512 135139913f42e2ef15a87a98230fa65b91feb2c3962b72538a6f17ad8b82635f7cd0bd369ae1201c45a3bfb7e724ca182a7b70477f395414f6aab81d7fd3df64
- SSDEEP 12288:fZ7jC6VOlvEyJVjEF2tSiQyuUNFt+SuWpUhPQFrUo+03/DipGxSo9tp:BCbvtJqc8iHNFpuWvWL0vbxSI
- TLSH T1DC25D04273E448FAE26B027488755711973AFC710B61CB8F2758655A0F727C26E3AB3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/5516-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b809-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000016ca8-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-453.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001998a-540.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bc9-660.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019ca9-1279.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001892b-1450.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5516-2075-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4684-2082-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 4684 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5516 2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe 4684 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_90dd7c72b2163926fd44ef3f48aa4a3b_cobalt-strike_elex_icedid_rhadamanthys_smoke-loader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5516
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4684
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1024KB
- SHA256 fddf83066f3afb672d3c92c6cc2b5c4f50345f7e668e9f3ed46a1a68957dd867
- MD5 90dd7c72b2163926fd44ef3f48aa4a3b
- SHA1 27739458cc35c9ed1b024090cf6a4d53d9736a54
- SHA512 135139913f42e2ef15a87a98230fa65b91feb2c3962b72538a6f17ad8b82635f7cd0bd369ae1201c45a3bfb7e724ca182a7b70477f395414f6aab81d7fd3df64
- SSDEEP 12288:fZ7jC6VOlvEyJVjEF2tSiQyuUNFt+SuWpUhPQFrUo+03/DipGxSo9tp:BCbvtJqc8iHNFpuWvWL0vbxSI
- TLSH T1DC25D04273E448FAE26B027488755711973AFC710B61CB8F2758655A0F727C26E3AB3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 1.1MB
- SHA256 abb4e84bc44ba063146808c068fdc9ae9a94dd5abbb1c793bc3f8ab7c9bd03ac
- MD5 1bba522700f6d81ce6b55840ba31bf58
- SHA1 514300cf9ca3aecefe2725b678dd5c8e810753f3
- SHA512 72a455a0233c444e6ce2bc10eac295fd62ab8f4bd715f70447ebf6267f034086d55ac6864276aebcc030c874a8b640bc9ffc53edb7af8bd870e1b9acd31426c9
- SSDEEP 12288:fZ7jC6VOlvEyJVjEF2tSiQyuUNFt+SuWpUhPQFrUo+03/DipGxSo9tpF:BCbvtJqc8iHNFpuWvWL0vbxSIF
- TLSH T1E235CF4373E448FAE667027088755721977AFC310B61CB8F2798665E0E727C25D3AB2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 931e21140eb4f60a0c268ba2c59789c4e1f9be02205201a3401154e9aa18d1cc
- MD5 e16c2150fba4520b85db5b4ca9d1d318
- SHA1 32c1addfd39c5ed5544f4377eee87360ff96cd2e
- SHA512 c35300d5399fd8029ccc67af32053920207a102a6c89f33394666749a9f5924a967f9c7d28dab6e7eb5d4f250689d575b2f7348572377757ebc5c626387ebd5e
- SSDEEP 24576:BCbvtJqc8iHNFpuWvWL0vbxSId0Le5ji0hmxNrM:BCL2c8MNFLA0vb7dPji0Aj
- TLSH T15E757C16F3A446B5D073C1B5C4E2965AEA32B8510B308BCF1385966D2F777D28E3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe$
- Size 1.0MB
- SHA256 e01e16ab6901cd8c4ff944ab1262e50ae77234da5ab10ae1ea53b1794ca41796
- MD5 7d8865ec5db39c96eb5e585fa15816cd
- SHA1 04380f954b0d31c07f0faad557ace4320a42c2b0
- SHA512 942ebcefdc529c09b99d2237aec216b156ccb282491384418b4ef31f205a569e0fff51941c87f51af784e00caad64d1134986d6110d314346bed1113a78b2dcc
- SSDEEP 12288:fZ7jC6VOlvEyJVjEF2tSiQyuUNFt+SuWpUhPQFrUo+03/DipGxSo9tpgh:BCbvtJqc8iHNFpuWvWL0vbxSIgh
- TLSH T1EA35D04273E448FAE66B0270887547119B3AFC710B61CB8F2758655A0F727C16E3AB7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$
- Size 1.0MB
- SHA256 fd0a310f2d02b1058e98dd441d307cb2193458444cdd5a47f5db252300145617
- MD5 d9d1f9aed08b2291bc56057ace450d28
- SHA1 f84ab0f5d499ef60eaece0a588cf3b0bf86aa2b3
- SHA512 091f91f460e2a3b00453bd4b14f938047251dbcd23ba12e2dc270dd4005a347d21f7a2e008b79d6f7b49eb2bf3589ffc809023ea636f416ac15ce16549499315
- SSDEEP 12288:fZ7jC6VOlvEyJVjEF2tSiQyuUNFt+SuWpUhPQFrUo+03/DipGxSo9tpk/:BCbvtJqc8iHNFpuWvWL0vbxSIk/
- TLSH T15935D04273E448FAE26B0270887557119B3AFC710B61CB8F2758655A0F727C16E3AB7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
- Size 1.0MB
- SHA256 55f68cdd02511330f2a5e457502a274ea17911e31b777e2b68d5f5e20fff4b8c
- MD5 2c78c8234eee649b565f5c35fcaaa9c6
- SHA1 9a66cb4282485f17bbcc7e865054e470253b8d2e
- SHA512 3af39ddf0557d4c8c516f95a5a2b9a00ce19fcdf494216b9e448f37d9e5e4f62a1c65374ae27c8e46b033c4985043364fb3e50cdec941a6e1d74e0cf2f420148
- SSDEEP 12288:fZ7jC6VOlvEyJVjEF2tSiQyuUNFt+SuWpUhPQFrUo+03/DipGxSo9tpfV:BCbvtJqc8iHNFpuWvWL0vbxSIfV
- TLSH T1B435D04273E448FAE26B0270887557119B3AFC710B61CB8F2758655A0F727C16E3AB7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.1MB
- SHA256 f58c18de52b404af08047274fdead03776d657bed5cc2f5f2fe7084524ed504a
- MD5 151ee481b2bbf1a1ab63711e8a0c71a2
- SHA1 98c3df8bfec7944cba82d5daeedc8617caa697f5
- SHA512 9060b1e07d825babd7bdbbc1e9c61c21df93da235ead9e4ef1b7b415ec4957ad55fec34afdf6fb7c3aa0a2e706317f22190887c8f9e4a1461954729defc7e379
- SSDEEP 12288:fZ7jC6VOlvEyJVjEF2tSiQyuUNFt+SuWpUhPQFrUo+03/DipGxSo9tpNF:BCbvtJqc8iHNFpuWvWL0vbxSINF
- TLSH T1BE35AE41B3E408FAE7A60170CC654710A639FEB10A618BEF1758776A5E723C17D36B2B
- MD5 SHA1 SHA512 SSDEEP TLSH