General
- Target 2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar
- Size 404KB
- Sample261003-26c5layfle
- SHA256 f6eaec12741f71039481eda0f5f004a56fc9438f36e088d0c39d2ca344eeb978
- MD5 f7e85a2624f879ceb8ffa98421a11851
- SHA1 c31fe7efc967c06d6097457ee66033a92f52c6da
- SHA512 996bb9104e7514a480c6d0ba436b0f1654878c19dbc32609039a5b279bb2d8d3208906b819ef42e426d1c1c9d5f3cb5cfc7ded3b0ed371e65bd983e9a8f6a0b1
- SSDEEP 12288:w4Ryed8I7r/7mdJXAm3ggRUeMz9TNXvkk:w4R5CIH/7Qam3NCdBTNsk
- TLSH T1C5948D61B75048B5F863857EA824850AE9723D750AA0C91F73D43B5A2E333E378B671F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
Resource
win10v2004-20260911-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260911-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar
- Size 404KB
- SHA256 f6eaec12741f71039481eda0f5f004a56fc9438f36e088d0c39d2ca344eeb978
- MD5 f7e85a2624f879ceb8ffa98421a11851
- SHA1 c31fe7efc967c06d6097457ee66033a92f52c6da
- SHA512 996bb9104e7514a480c6d0ba436b0f1654878c19dbc32609039a5b279bb2d8d3208906b819ef42e426d1c1c9d5f3cb5cfc7ded3b0ed371e65bd983e9a8f6a0b1
- SSDEEP 12288:w4Ryed8I7r/7mdJXAm3ggRUeMz9TNXvkk:w4R5CIH/7Qam3NCdBTNsk
- TLSH T1C5948D61B75048B5F863857EA824850AE9723D750AA0C91F73D43B5A2E333E378B671F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1