4db8d81fd21d481edb8673adaf77c8dd5bfad6e2dca733b5fcd30d0732b8793f

General

Target
2026-09-28_603624bc4cf7b1fdabc0b6428042063e_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe
Size 2.7MB
Sample260928-styfbsxzhx
SHA256 4db8d81fd21d481edb8673adaf77c8dd5bfad6e2dca733b5fcd30d0732b8793f
MD5 603624bc4cf7b1fdabc0b6428042063e
SHA1 0e0ed80b69df53a8cd507bab7b54bd1ac751246c
SHA512 168b5fdb19c4c095c1afebbf35b6fbf98ee028b45ce32e3f4c6e2df46cf062c5149c2b8e1fa1c1df5743939c687541138ee0155a78bc52c61c8c3ee263ca4331
SSDEEP 49152:MMDRZ9IBVL+s0ezJGd80SHMsThF35Hj1BzuLa6o0V:MMDtIXLr06AdfEThF35PzuLa6oo
TLSH
T161D52245E7F104F8E1B7AA7488B20216D7777C561AB0DA9F23E8415B1F732A06D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1596	2026-09-28_603624bc4cf7b1fdabc0b6428042063e_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe
1932	maintenance.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4512	cmd.exe
3088	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenance.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_603624bc4cf7b1fdabc0b6428042063e_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2492	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2268	schtasks.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4512	4204	2026-09-28_603624bc4cf7b1fdabc0b6428042063e_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe	89
PID 4204 wrote to memory of 3088	4204	2026-09-28_603624bc4cf7b1fdabc0b6428042063e_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe	91
PID 4512 wrote to memory of 4940	4512	cmd.exe	93
PID 3088 wrote to memory of 4112	3088	cmd.exe	94
PID 4512 wrote to memory of 2268	4512	cmd.exe	95
PID 3088 wrote to memory of 1596	3088	cmd.exe	96
PID 3088 wrote to memory of 2492	3088	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-09-28_603624bc4cf7b1fdabc0b6428042063e_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_603624bc4cf7b1fdabc0b6428042063e_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zbe2026928152544485.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks.Exe /delete /tn "Maintenance" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4940
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks.Exe /create /tn "Maintenance" /xml "C:\Users\Admin\AppData\Local\Temp\zx2026928152544485.xml"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zb2026928152544485.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4112
- - C:\Users\Admin\AppData\Local\Temp\2026-09-28_603624bc4cf7b1fdabc0b6428042063e_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-28_603624bc4cf7b1fdabc0b6428042063e_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe"
    3⤵
    - Executes dropped EXE
    PID:1596
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2492

C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zb2026928152544485.bat

Path C:\Users\Admin\AppData\Local\Temp\zb2026928152544485.bat
Size 908B
SHA256 c188f994aeeb84a3f637b11fc48ec3c132be8cb82e3dc634ecbe4b7ef8de1dc9
MD5 21b24f72f43b7402e824b8c847757f9e
SHA1 d69a8a325ae03882eef02cbf8c3bc4da2c79373a
SHA512 a3986b3037f1867fe29f23879088bcdbced681b5ee80144b9d97c4688160d46ab07ad6fc5dae4affcd996f5bb11f5075c2eb1bfdc779315747c7aecb300c14e1
TLSH
T12C112986B6EFCB590819729B0BF1A9DCC465296C6F8937109F51910D23D680CFAE17E3
MD5 SHA1 SHA512 TLSH

Submit Download

zbe2026928152544485.bat

Path C:\Users\Admin\AppData\Local\Temp\zbe2026928152544485.bat
Size 366B
SHA256 354c1c49f930196d08c14f80a354996662c88544bbf1570b448b33de137dfdda
MD5 0e5727d229f0d14ca412b159206b6435
SHA1 cdc582d637e46351cc930766c4d5f2b2792dc655
SHA512 2c75f9cf07778784e2c1974bedc62b7af2f26326e0aee4330b39d0b707936ef8c0c1f74ba52a00bf93d4a0a3e3a08c08bb9a9f1efe67a35a36148c9df5bb1ddd
TLSH
T1F8E0680E03A7C499600DE24375DB2A1368B1706AA6E133282DC720208A9B049F8AB703
MD5 SHA1 SHA512 TLSH

Submit Download

ze2026928152544485.tmp

Path C:\Users\Admin\AppData\Local\Temp\ze2026928152544485.tmp
Size 2.7MB
SHA256 a7d2907d75389f4450298a446088bb7f53b0fb704814c017c0efc35ff92b9533
MD5 5a7556ed16a2cc0167f9c06165aadfda
SHA1 337d4afee810e63a4fcaa4c62056012f0e0fd70f
SHA512 1001b72692c27166cf8920b0755ec4471f3ce077c23aad71c74375de3e02eb8b7b6bdc656101725863de623dce149bbbe1644cfbf27a2dfa0bb6e1cda5a7bc79
SSDEEP 49152:2a6o0O+7FiB+cfRWkkjY5qUHj1FhW825PlJ0TJcta:2a6oi7XsWkkjaHjTo82Pb0cA
TLSH
T11FD5220ADBD404A8E0B7A634CDA61116DFB77C9A1B71C65F23E842261F737A0DD39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zx2026928152544485.xml

Path C:\Users\Admin\AppData\Local\Temp\zx2026928152544485.xml
Size 1KB
SHA256 8691add2ab3607d153b6d546b5d54f68eeb1b1872af3f723145ae390a9046bbd
MD5 938f691bb287555ac2da9d3996228d4f
SHA1 9203b778ba9a2c944fb99356761d6c223c080afb
SHA512 8108f6579f16c57d7fc2e610fb612b6dbd3fb55276d849c8dc9e2051b26dedd8bc221eeef118fdb1eab4b80c1a1a28f39e719da62c28969753b96b23a5fc65cc
TLSH
T1803105589CC0F72BB533922BE7515282EF768393456A4038F4CC4B7B1FFA1466153563
MD5 SHA1 SHA512 TLSH

Submit Download

maintenance.exe

Path C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
Size 2.2MB
SHA256 a77315296dc58edac4959c9ed69ec96e9517883684edaeba3e64c48a44c186ae
MD5 73ad6d009f1c53c23f5d068caa805299
SHA1 f50493f49c3b2b3697b5eb571738dbc70383cac0
SHA512 1f9c739c7b745ba57b3d7e50e00bac9d3019de25aab5bb22c0da810d963dab93d71c56686fccf737cf87a4c95fe53b8e4b3dda09ac1526fb4899aa0e1336e920
SSDEEP 49152:uo7TN6XYwGRV1LCnO9DivWp1daCCN2eLF6I5YDPRrBdSm2610V+9dmhBafgE:uC6NIDLCCiO/dat6I5YPFBx0VmKafgE
TLSH
T184B5337F996640A6FEB86ABC24127F7C892BD12703306D71D9D59C37045E223AB324ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads