a959f59ff915b49d9f150f9398bb4136651efc72cd71e32256b162dfae2fb3db

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 1.7MB
Sample260825-1vmdfszbmc
SHA256 a959f59ff915b49d9f150f9398bb4136651efc72cd71e32256b162dfae2fb3db
MD5 ca9c7b06d8a6c97aa419b66e7ef04793
SHA1 b4da3ba0833244aead08cbcdcd21d91c4201f155
SHA512 92968f1feaab24472b96bdf5624da637d73bf65eb1cfbaf11334cf415369aad7a02ae564887b7f352f770774162cc1dc89cdf4fcff0ec59dedb9110f0bd3bec3
SSDEEP 24576:+04SbU8cXk/6d22DzPBD9qh70m7MVyppWwUeY/vnS5QhJfgtwy+dFA0zq:+0Uo2DzJ4XMwEeY//IQhJowy+Tq
TLSH
T1CE85AE1BB2C085F8D41880348A629276DAF278634F2DD6DBC7949A0D1E76FF46F39760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5908	2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\RCX931E.tmp	2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe.ico	2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7z.exe.exe	2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe.exe	2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\RCX93CB.tmp	2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zG.exe.exe	2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7z.exe.ico	2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5208	5184	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5184	2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
5184	2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5184 wrote to memory of 5908	5184	2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Users\Admin\AppData\Local\Temp\2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:5908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5184 -s 1856
  2⤵
  - Program crash
  PID:5208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5184 -ip 5184
1⤵
PID:3992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX931E.tmp

Path C:\Program Files\7-Zip\RCX931E.tmp
Size 772KB
SHA256 255e734f4ac9319cd360696d5dbd966046ac2272fa803b0b873b89869ef1aef4
MD5 c9000e74fe68817a15832154068f3687
SHA1 815dbe4262abfbcec2314c7f3c6a4c07d531059d
SHA512 880a6fabcaa7f4f2e2593859dc11a05ff56124ac0840a67f34f6c52c1921f74eb834897f53ac6e91cb0305784d54ed08d307b5c91252608160d5843a167cb530
SSDEEP 12288:uClODd40Tw4SOJeU8ToFFXHE/6b3h24fi6rrXPPDNyC9rYSwjU0w5i+kkkXvtx:+04SbU8cXk/6d22DzPBD9qL
TLSH
T1CEF48C1B74C0CE75EC18043A25A2A7F955E67A72CF6EC243C3586E0D1938FB99E646F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-23_ca9c7b06d8a6c97aa419b66e7ef04793_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 1000KB
SHA256 0e9d001ccaeced1193a38d49cfdee36f69d24e1a8e02d7eb99fd4b5b0ffff0c9
MD5 72ba2d9d183f3d515faea6558d760763
SHA1 29bf1ca6c894e6545ba7995820add46300f9c53f
SHA512 01ecfdc8e5d0b9a8863b09be55cc8c513160fdaa529ca0213db9dc521f73242b39e8ccb06c3922fb519132df120ea4243a7cfed106c6f388f46f92cb1ef2162c
SSDEEP 24576:20m7MVyppWwUeY/vnS5QhJfgtwy+dFA0z:aMwEeY//IQhJowy+T
TLSH
T127258D1BF69500ECD029C574CB668132DA72B8970B34AAEF06D1D2591E7BAF46F3E710
MD5 SHA1 SHA512 SSDEEP TLSH