54d6fcaafb96e6ba0381d88d2cfe11d1c60d2e4311f95329f6171412c57dd15c

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_2d856166157f5b578abf1e1fe5aad8ea_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 4.9MB
Sample261003-snzffast2p
SHA256 54d6fcaafb96e6ba0381d88d2cfe11d1c60d2e4311f95329f6171412c57dd15c
MD5 2d856166157f5b578abf1e1fe5aad8ea
SHA1 98698e36bb0a3995b030f1e012ae32d6fc6acf8d
SHA512 3b5c96b201fc72ca411c6c2fa99241bf6e2a64f858680fa2e35790816580d5b900c3c814ec60d396a0d662a2f5b1f05789b0d89e90eb2dfaa447ecdfb5d43f89
SSDEEP 49152:tKy7QeeHFw1IkSKreUnlzevKgBOl9fsaUiDbatPEHF6Z+EK/hvgcEfLUTq0gDNar:UIQ9zNBmsOqQgDNcEanicl5P
TLSH
T111366D4663F885E9E5B7D1788E7AD632EBB17C120530A34F07A0DA9B1F376205E2D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware stealer

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4996	temp0a1.exe

Executes dropped EXE 4 IoCs

pid	Process
4996	temp0a1.exe
2512	2026-10-02_2d856166157f5b578abf1e1fe5aad8ea_cobalt-strike_elex_icedid_njrat_vidar.exe
1292	videowin.exe
4936	temp0a1.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jaremore = "C:\\Windows\\videowin.exe"	temp0a1.exe

Enumerates connected drives 3 TTPs 26 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	temp0a1.exe
	\??\F:\	temp0a1.exe
File opened (read-only)	\??\R:	temp0a1.exe
File opened (read-only)	\??\W:	temp0a1.exe
File opened (read-only)	\??\H:	temp0a1.exe
File opened (read-only)	\??\J:	temp0a1.exe
File opened (read-only)	\??\L:	temp0a1.exe
File opened (read-only)	\??\O:	temp0a1.exe
File opened (read-only)	\??\U:	temp0a1.exe
File opened (read-only)	\??\V:	temp0a1.exe
File opened (read-only)	\??\N:	temp0a1.exe
File opened (read-only)	\??\G:	temp0a1.exe
File opened (read-only)	\??\I:	temp0a1.exe
File opened (read-only)	\??\M:	temp0a1.exe
File opened (read-only)	\??\P:	temp0a1.exe
File opened (read-only)	\??\Q:	temp0a1.exe
File opened (read-only)	\??\X:	temp0a1.exe
File opened (read-only)	\??\Y:	temp0a1.exe
File opened (read-only)	\??\B:	temp0a1.exe
File opened (read-only)	\??\K:	temp0a1.exe
File opened (read-only)	\??\S:	temp0a1.exe
File opened (read-only)	\??\T:	temp0a1.exe
File opened (read-only)	\??\Z:	temp0a1.exe
File opened (read-only)	\??\A:	temp0a1.exe
File opened (read-only)	\??\A:	temp0a1.exe
File opened (read-only)	\??\B:	temp0a1.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\bb.ico	temp0a1.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	temp0a1.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\file0a0.dat	videowin.exe
File created	C:\Windows\videowin.exe	temp0a1.exe
File created	C:\Windows\temp0a1.exe	2026-10-02_2d856166157f5b578abf1e1fe5aad8ea_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\file0a0.dat	2026-10-02_2d856166157f5b578abf1e1fe5aad8ea_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\videowin.exe	temp0a1.exe
File created	C:\Windows\temp0a1.exe	videowin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-02_2d856166157f5b578abf1e1fe5aad8ea_cobalt-strike_elex_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-02_2d856166157f5b578abf1e1fe5aad8ea_cobalt-strike_elex_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_2d856166157f5b578abf1e1fe5aad8ea_cobalt-strike_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp0a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	videowin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp0a1.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2804	2026-10-02_2d856166157f5b578abf1e1fe5aad8ea_cobalt-strike_elex_icedid_njrat_vidar.exe
2804	2026-10-02_2d856166157f5b578abf1e1fe5aad8ea_cobalt-strike_elex_icedid_njrat_vidar.exe
1292	videowin.exe
1292	videowin.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2512	2026-10-02_2d856166157f5b578abf1e1fe5aad8ea_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 4996	2804	2026-10-02_2d856166157f5b578abf1e1fe5aad8ea_cobalt-strike_elex_icedid_njrat_vidar.exe	89
PID 4996 wrote to memory of 2512	4996	temp0a1.exe	90
PID 1292 wrote to memory of 4936	1292	videowin.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-10-02_2d856166157f5b578abf1e1fe5aad8ea_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_2d856166157f5b578abf1e1fe5aad8ea_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\temp0a1.exe
  "C:\Windows\temp0a1.exe" ejecuta
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Users\Admin\AppData\Local\Temp\2026-10-02_2d856166157f5b578abf1e1fe5aad8ea_cobalt-strike_elex_icedid_njrat_vidar.exe
    C:\Users\Admin\AppData\Local\Temp\2026-10-02_2d856166157f5b578abf1e1fe5aad8ea_cobalt-strike_elex_icedid_njrat_vidar.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of SetWindowsHookEx
    PID:2512

C:\Windows\videowin.exe
C:\Windows\videowin.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\temp0a1.exe
  "C:\Windows\temp0a1.exe" ejecuta
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 333KB
SHA256 59a397cadbd652bf993fdb31fd6b79a8c7fc561d845b3004f1ab2fa270d7fe3a
MD5 d6b2377c116e1ca850193401d7a47fdd
SHA1 f7b0fd2810cf9a711f0c044b31e469acc93e6697
SHA512 91f1f466fc8d07f5943af6826cadb0899066593e03f78f0332d182fdda302141d9d341e65cbf0f0b114de82ce3d3107b19d91dc6c406b53cb0eb05c8e293f6fb
SSDEEP 6144:RUgLOOr/BJ/GKWWBNU6ITLBi0qttclOKgU91B7:SeBNUbTVO86U9
TLSH
T1E774F73BEE28ECF2C27A8DB85A518640E77678304F21A3CBE165834DDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.2MB
SHA256 d1f6f969bb12616c0225745769ecfde5623f11a480420a0c189ce2274724c11d
MD5 28d09d6727fd9dac16ecf02db97a6bc2
SHA1 dbba3d6d112d0b702921b575a1c7b5b983255f1d
SHA512 20c559a6cdb3c072782c9b3ccb62540d1fdc63960be8d94f65636d45b902add28836f60c63796ab4e04dae89128a34e00afadd9c4b2cd688f1552e5f23785a06
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3THO:gQvGAdlCEL8c/bRNw5CF
TLSH
T1E3165C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 410KB
SHA256 3e151eebcc53813305856facf9f5be828b9be23659c4f0115f528970e5f7eca4
MD5 b49295ba6050dcacb8769b6c5c28c0f5
SHA1 e2a71f1d585b5f7f12272d71f1d3c5506d88d8bb
SHA512 4c39ce03e674542c5664474755c0bdecc03f7fa27be4bddcd824b7756d568838b34dd6ee7ad23c24d2e645456144a57ac931e093ae2ea1ccf3ad34d538cba70e
SSDEEP 6144:/UgVWhzr8SfxL/2Dc33C+U4tLsUL6mmt0fSoD78uLwsehNjRMt:PAwSfxL/2Dc3jDLLmt0LDQewsAjR0
TLSH
T167946B31FA74D432C2BB0DB61B25C716683DBA204F6119C3F3E89E8D59742D2673AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-02_2d856166157f5b578abf1e1fe5aad8ea_cobalt-strike_elex_icedid_njrat_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_2d856166157f5b578abf1e1fe5aad8ea_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 4.9MB
SHA256 95ff667b36dbde1bb9bf740dd6f9e5b74ce9e0e9becd427600aca700261a8470
MD5 9b184bbf6c7d1bacd7e292241002e5bf
SHA1 a537ab7af82d76d6d9f73e499a93536695250373
SHA512 8db2c3d1038569f8b5c251c209c2c9cfca400d8ed5daa99856f46bd3eca7e5a1ac6cfcc16e473e57ab29f64f8d7702db069463a4a6e969720d57d3e27b38c57e
SSDEEP 49152:eKy7QeeHFw1IkSKreUnlzevKgBOl9fsaUiDbatPEHF6Z+EK/hvgcEfLUTq0gDNaI:dIQ9zNBmsOqQgDNcEanicl58
TLSH
T177367D4663F885E9E5B7D1788E7AD632EBB17C120530A34F07A0DA9B1F376205E2D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb.ico

Path C:\Windows\SysWOW64\bb.ico
Size 4KB
SHA256 823cbf89390733bd09d5541839786670d748064e50ff235928abd9e2433192b7
MD5 84a8ab049bb249ce1b1e25d5648571a9
SHA1 66b48c0e63f542b74a5b003af9660222c1d0f324
SHA512 8ce3b7fa9917ee0164b3a09920aaa1ec6806159aab184e3fbb15fc58134c64957811eded9ad3d459c0c1a257aee3129473136d1800f5d89bc9adc5a43a4b6c64
SSDEEP 48:z2pe4sdnY/3XXXXXXXXXXcDD3V+yD3/6k0vucpb:z6bsdnY/XXXXXXXXXXcDD3Vr/6Jvu6
TLSH
T19C91553EA718B8B0F98E6DB1236FC064505E7504151BCDA6B1A9FCB07F92CEA40143CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file0a0.dat

Path C:\Windows\file0a0.dat
Size 119B
SHA256 a8934f8a1dad2f297b29cbffcabafd7a4797c1114e05615d2cdc085da51399bf
MD5 fbdd7a1d3c0f9eca8dbc3c0fd1260b57
SHA1 6b60eeba6a8126ff7181abc360ea5549ae0b454b
SHA512 eec9a37b2ef0d97c60dfcd69e9d16e7843b83b83a6e6f961e064cc5672eea2fa3a50e6c72ad34fd8fa1ab8ed568f3fddb0d61b118b3ea5588732b245fb1f905f
TLSH
T1AEB09281C9CACA514475616B89E6099EC57129099F182614AB48C9191189C4EECA02A7
MD5 SHA1 SHA512 TLSH

Submit Download

file0a0.dat

Path C:\Windows\file0a0.dat
Size 23B
SHA256 3224ad42688841dbfb74314e28a83eac0c57e362f219e4f36ffeb81dcf009e6b
MD5 e3073885480071db7f127992bdae05cf
SHA1 6e57f18d033b889714cce6f32241bab0582f49ec
SHA512 3069375275eab5eb6adea6c3ebcc14b419289c38e79e8f2000d4e089f381d6cdd0579fab29af36f233d984bb48a7c3b2cd1345435ab11620421bf9ec3243e733
MD5 SHA1 SHA512

Submit Download

temp0a1.exe

Path C:\Windows\temp0a1.exe
Size 4.9MB
SHA256 54d6fcaafb96e6ba0381d88d2cfe11d1c60d2e4311f95329f6171412c57dd15c
MD5 2d856166157f5b578abf1e1fe5aad8ea
SHA1 98698e36bb0a3995b030f1e012ae32d6fc6acf8d
SHA512 3b5c96b201fc72ca411c6c2fa99241bf6e2a64f858680fa2e35790816580d5b900c3c814ec60d396a0d662a2f5b1f05789b0d89e90eb2dfaa447ecdfb5d43f89
SSDEEP 49152:tKy7QeeHFw1IkSKreUnlzevKgBOl9fsaUiDbatPEHF6Z+EK/hvgcEfLUTq0gDNar:UIQ9zNBmsOqQgDNcEanicl5P
TLSH
T111366D4663F885E9E5B7D1788E7AD632EBB17C120530A34F07A0DA9B1F376205E2D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

videowin.exe

Path C:\Windows\videowin.exe
Size 55KB
SHA256 a04c10a45718cd6f7551a57547a59ee1bd5b1a1f18ba080a7abcefd4bb3cfe87
MD5 dc3bb94b97636fbed29e63b39a5414d2
SHA1 7a6c8344dfc09d3163375d2910804a6f49483ed2
SHA512 2dc5ffe875047890a14a0734e2999ac8da11d68fe140b7ab2515bbc618d70c1d3dfe3ba26456c32fc2eff9d274a28836a241da37804cb9b58dabb2dabb8d2025
SSDEEP 768:XkJvvqaxRyEtyZmC9Lm09Pv2pMJ0+s4t9cpO5vAjXFBS3Q70PcLHQitRr1DJSB79:M3qaxRyEk9LmQuyPt9cgY4PcLH7n/k
TLSH
T1B6436B52F681CD72E025DABC9C19C394AB3C7A306D3A8096BBED1FCCDF6D190591D682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1292-15-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2804-2-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4936-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4936-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4936-17-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4936-49-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4996-12-0x0000000000400000-0x0000000000414000-memory.dmp

Download