e2df8e757e09adb84936608cac84551be6697aef80dcdf9f7d2b4946cc524101

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 1.9MB
Sample260814-pl343asgre
SHA256 e2df8e757e09adb84936608cac84551be6697aef80dcdf9f7d2b4946cc524101
MD5 d327525df2780569965388ccba2dd92b
SHA1 c1969bf9f29e6ad43d1de7bc3992fec2bfa548ac
SHA512 c6281d2ced47eadf873662e4a9ef08d736a47c17200c7171f71aa3653f86da5b62721d5b83040300cd228a86ccbe67f8b5a6a31b933d32eabc5e1ba2010c943a
SSDEEP 49152:JEcRNcgBTUETqjR0hsIgU34LvUV0B9SF+:ibgmFygUQx
TLSH
T148959D16BAE685EBD02DC03497528336D663B8520F76B5DF02B0A25D1EB7BD01F79B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3736	2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7z.exe.exe	2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7z.exe.ico	2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\RCX577D.tmp	2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe.exe	2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\RCX5839.tmp	2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zG.exe.exe	2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe.ico	2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3156	4144	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4144	2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
4144	2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 3736	4144	2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Users\Admin\AppData\Local\Temp\2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1848
  2⤵
  - Program crash
  PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4144 -ip 4144
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX577D.tmp

Path C:\Program Files\7-Zip\RCX577D.tmp
Size 756KB
SHA256 9612cf7e0fa31298ec0c8dc0892812874acb7b8d3faf80159e159c1613352570
MD5 b31bbd8f2124e9a64663bf47ce65b5e1
SHA1 9869bed621a804b6ccda5fc57e6b2f3b4901add4
SHA512 1f21fd539e03a6194b7fc427e6acb931f15080797132aa1bc25694c06c3f1d8f2fe112265ed801d63fbd8bd2ffcc3aca6a2c0af351b7322ecf2c72ef63907a40
SSDEEP 12288:JX+Tu5UMgA3F/j2PKw3IrV9egVzrUoDg5RPskw5iYj6cSIQ:JX0I/R9j8AVAgBUoUPsBLeI
TLSH
T187F48DA4BEF3E9E3D939C432B5A2D3775323B8234C57B01B65B0629C58B47D029B4978
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_d327525df2780569965388ccba2dd92b_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 1.2MB
SHA256 92298ba31d944be2ae352848e0a68818f89811c5a03dd822fdaa779cf1c06a68
MD5 9f20c741c94fa9d2288978ce7bb9cb82
SHA1 37dcd83be479353190083a2195b471e2af13986e
SHA512 5f87f28254143a0c5c22ab383a07cd5a44aaae069e7e4cb4bdfb42b5d430f97ab059105da5819e57abe4b5af98495f351f483259f1f943428c45d6d0fd27be8b
SSDEEP 24576:MOuJ7qjpeUPWZbhsIgUP34L06bUH10BBA8y/0K:cqjR0hsIgU34LvUV0B9SF
TLSH
T1F6459E17B6D541E8D02DC174CB468636EA72B8420B34BAEF07A0975D2E77AE05F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH