476edae18c5a118d226dfe85cb30a09f76a47e605fa655940559d08fc3e14c7c

Analysis

max time kernel
149s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 761KB
Sample260415-2c73waa19q
SHA256 476edae18c5a118d226dfe85cb30a09f76a47e605fa655940559d08fc3e14c7c
MD5 9fc60453ab876098b0b4c133d30b11a0
SHA1 f27f78aad2051d5c71dc8509cbd9145d26fb6c78
SHA512 4934e6cc1088949cb6f1dd09f5e5c17b4b9233b3a5e855a470021a299ed556a311c0eb783174d9f841f96847ae3f351b555b1c1696ad5c15e4ffc1a80fd6606c
SSDEEP 12288:w4Ryed8I7r/7mWGObdaFjdsTcFyn/7Iw9DXXAm3ggRUeMz9TNXvkk:w4R5CIH/7zGObda9dsTcQ7IwZgm3NCd1
TLSH
T1CCF49C22B79004B9D866C179A9558617EA713C710360DACFA3C43B163F336E27A7879F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4964	UpdatAuto.exe
2520	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar~4.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
444	sc.exe
4356	sc.exe
2140	sc.exe
4612	sc.exe
3944	sc.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3516	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
4964	UpdatAuto.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 1176	3516	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	83
PID 3516 wrote to memory of 4964	3516	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	86
PID 4964 wrote to memory of 1652	4964	UpdatAuto.exe	87
PID 3516 wrote to memory of 2520	3516	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	89
PID 3516 wrote to memory of 3820	3516	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	91
PID 3516 wrote to memory of 3988	3516	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	92
PID 3516 wrote to memory of 3984	3516	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	93
PID 3516 wrote to memory of 3940	3516	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	94
PID 3516 wrote to memory of 3756	3516	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	95
PID 3516 wrote to memory of 3908	3516	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	96
PID 3516 wrote to memory of 964	3516	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	97
PID 3516 wrote to memory of 3944	3516	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	98
PID 3516 wrote to memory of 4612	3516	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	99
PID 3516 wrote to memory of 2140	3516	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	100
PID 3516 wrote to memory of 4356	3516	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	101
PID 3516 wrote to memory of 444	3516	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	102
PID 3988 wrote to memory of 220	3988	cmd.exe	115
PID 3756 wrote to memory of 216	3756	cmd.exe	116
PID 964 wrote to memory of 1592	964	cmd.exe	117
PID 216 wrote to memory of 2320	216	net.exe	118
PID 1592 wrote to memory of 4888	1592	net.exe	119
PID 3940 wrote to memory of 2256	3940	cmd.exe	120
PID 220 wrote to memory of 1256	220	net.exe	121
PID 3984 wrote to memory of 5044	3984	cmd.exe	122
PID 2256 wrote to memory of 3548	2256	net.exe	123
PID 3908 wrote to memory of 924	3908	cmd.exe	124
PID 3820 wrote to memory of 332	3820	cmd.exe	125
PID 924 wrote to memory of 2988	924	net.exe	126
PID 5044 wrote to memory of 1168	5044	net.exe	127
PID 332 wrote to memory of 3428	332	net.exe	128

C:\Users\Admin\AppData\Local\Temp\2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1176
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1652
- C:\Users\Admin\AppData\Local\Temp\2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar~4.exe
  2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:332
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:3428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:1256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:3548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:216
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:2320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:4888
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3944
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4612
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2140
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4356
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.0MB
SHA256 b384007a7ecf13c24603a4c82355e8ff06f5a10ecf95a5a737b10cba26c09435
MD5 28d59caf66470969913d64e2343cda86
SHA1 b95515aa15d9f3011f741f8070f1b64289372cfa
SHA512 bb09af2ef9f3482716e52424d58b9bc8be8f0804c1d36448772454521519e2dca1bce3062c7a226261230bfa31b29e44cc09fc7cf090d019256945ad6baa1dc3
SSDEEP 24576:w4R5CIH/7JGObda9dsTcQ7IwZB0Le5ji0hmxNrM:wabH/tW9dsTh7IwDPji0Aj
TLSH
T1E8356B26F6648335D073C0B9C9D2965AFA713C91073099CB5385E7683F37AE2963A336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.4MB
SHA256 089c6d1a9d30e2046ac9f5accb64969dc0929c4c5604f0b4321dc3f54b87838c
MD5 49b772e105a5fd35f9b7899b3c63c005
SHA1 4358d06df6f0bb948cd6d45345401c32eb975a1c
SHA512 3c081f00bcaa24083687e9ac6ff12e817626007e0a6e6d042177b9336dedd6d590629ba4fedf2ab768e8ab9388047b17ffbfd0adb6cd7c421ffee46d13817a0f
SSDEEP 24576:w4R5CIH/7JGObda9dsTcQ7IwZTa7/ezSC6vUyD/aqgrvWx6q8wyu:wabH/tW9dsTh7Iww/ezSC6vUzPvMHjy
TLSH
T181652C26F5788323D0B2C0B9C5D6A65AFE723842073089CB5346A76C3E377E6953573A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e6bf9014bda71902582d2045ee974af3031005db40ba159ca93c0be7d3518518
MD5 13a3643481a8703db5c5233757d5f917
SHA1 bf4d8ab32d21933455afa2abfa04dd32633b7fc6
SHA512 2c2ccd658cd30d03beb3da173d60fbc4e2a5ae8f2b102431fb219e64c25a883ffac484d6834ce4a69eb160fa3508999c0392e4f5c2365cd5e51a2d723d903725
SSDEEP 24576:w4R5CIH/7aGObda9dsTcQ7IwZ1VbqPb88hv/l+7:wabH/mW9dsTh7IwDVO88hXl+
TLSH
T14C454B26F6648235D073C0B9C5D2965AEA323C5107308ACB5385A76C3F37BE6E636736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 504KB
SHA256 6fa29b26a1ce021fe9bb6bb3d000fbb72388b306f1a6a60d6047220d410ab216
MD5 3f389af056c491a1a38e6a67aef04d72
SHA1 7605a80378f0a040e5366a739c95d0e969b754c4
SHA512 f2245937fcc85d46ab193af5e75ef77611064504559232e3da0cc7420456d9168f024c9d2fa1e2150741f26b18060864b6d35e9ec7d3302455df4f0df347e75a
SSDEEP 12288:w4Ryed8I7r/7m1GObdaFjdsTcFyn/7Iw9Dra:w4R5CIH/7AGObda9dsTcQ7IwZra
TLSH
T192B48D23EB8040AAD466C1747AA98617FA713D710360A9DBB3C07B553B33AD276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.5MB
SHA256 9a7d7e6a0d01f16bf434d5f2ea06fdea1becf9a1bfba5bea2e01161481df25d0
MD5 b140b121accc683a52358bb424bcc3ef
SHA1 b8633b11980a3fd1c2d3708e55ff9201f396c3f4
SHA512 4fb75d3250856ad9e93195bb6551ac9d768484262ec94fb88750f8dbfe52e8480f51666e629530b180e176d6c3ad978ac081c1d8d39cebd5c496010a19e0ec2e
SSDEEP 49152:wabH/FW9dsTh7IwOj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMr:F7Iw9QRQyi36YOcP+Lvw2gAf+PN34
TLSH
T1CE666C13F3A501E8E05ED974CF3956229B357C4A8BB092EF25D436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.5MB
SHA256 a9d53d17cdf587e6009be9514292f216f768c3d33feb4a009b9b12b1f810ee83
MD5 75f6b20087f1f85e867503761584d5af
SHA1 519812789897bf1222542cc2dfc20293adcc357e
SHA512 4cab6758c6f60ca605185954b84ec984092acaad264c2f9fc3815422c2341497a1dfc1f14e1cae97838f211029d7e8f49d927a2332516259976710544e84edfe
SSDEEP 49152:wabH/UW9dsTh7IwOj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMr:c7Iw9QRQyi36YOcP+Lvw2gAf+PN34
TLSH
T1A8666C13F3A501E8E05ED974CF3956229B357C4A8BB092EF25D436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 c115acced75ec5ef3a51a325221f1fc9cef67ad39cf55fcb24766537644fdcdd
MD5 95a96f7973c63985a80a00c3b5b37ef2
SHA1 26c16991230bddca3d2ef4b98df1a053a209b598
SHA512 6f92ff7a9c7c17d515209b7c3a3cf37d036126883cfc1e143c522f9097ae41fa4a924fbdfd9d75cf946cf34e5c6b567122436b92eb46ac35baee2c145d1e21b4
SSDEEP 49152:wabH/FW9dsTh7IwG68Qg55nhoeWu7PNU3/Q:F7IwkthHRc/Q
TLSH
T1E1B52833B2E200A9C45DD1769F568722A6E17C718FE0E7DB824173161BB2AD07B3971B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.9MB
SHA256 db5ebb022b073bda828585148de61cb6d2dc688eba8266fa77e163437f420a44
MD5 209ffc08d6f25c559f91a54a2e5cf549
SHA1 fc4be2532914a7a2e3ef4b640e8e35a974191856
SHA512 b9f6ad7892dffd7e5edc9e1464b75ffed7bf888ec6aed25af95b639eae5b65c7d6190a3265862f3f7775ccb1ff57ffc51772725a74c883922f93f329d01ea073
SSDEEP 49152:wabH/FW9dsTh7Iwq3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgN3Oh6tznT:F7Iw7y5112gYy5azzVvf69nLKnhZO
TLSH
T10F166B13F29900E8D05DD179974A8232EA72BC564B31B6DF0A9077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.7MB
SHA256 64cf886e409ecf99349cae00d5bd1149cdd96426b8487425e8b578d2e902ff00
MD5 496a964dc95207f34dc7c5933b782173
SHA1 4838e92c5d3c384d9b289d219950728657d3661e
SHA512 b78a3c6cdbe5e558438934d7fc33f67e4f08d1bdaf799330236ce418287f1a92f22e369893eeabf356229353e84bc45435fd13c42beef5082b38a4386c913c8c
SSDEEP 49152:wabH/UW9dsTh7IwjB+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:c7IwVu6Jm0xd2d3
TLSH
T16ED57B13F6D901E8D06AC078974A9233EA62BC590B30B6DF0B9077562B77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.1MB
SHA256 0b09168661d4cec0a6186a34c99047791bcace0a6622b364638081f5ac00295f
MD5 c8336c0d401514f99c1852a7fca1141b
SHA1 09f0282003eaf939e0043f51acd9fe9a13ede606
SHA512 153e0142e0e38abca73d4cd78c9e5f1094e9880ff65fcbcff9166fb16969dc8bd09823a754244dcd45ce5f6d318ac18164b55e165c34f7c25c1ccddb07b83fbe
SSDEEP 49152:wabH/FW9dsTh7Iwb1hpsNoJpF1A6GU44CwH7R4xu:F7IwbmifP5R7
TLSH
T161A58D13F29800E9D06AC1789B569632EA72BC550B30B6DF0780B7962F77BE06B3D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.3MB
SHA256 9c7ae5c70ea99712415481b2a16eaff2bf935f128ac1e23a252d536f42c714e3
MD5 3f5bfd57a6a280121e822d0b514bea2f
SHA1 24766af40cc932812d1ad5d849f67d5691ad22af
SHA512 a87a3fae0b07fc94fb859f8a4c0a3b4fcff14e07d688a334400d3127ac5dec43d25e105f2910f63db872134b873e1690d3d4c0cbcda5d77685b3ed7947bcfc38
SSDEEP 49152:wabH/UW9dsTh7IwmSuZQIY0Be2K8RVtOnks6NMHq6:c7Iwo5dKCi616
TLSH
T113B58D13F2E940E8E0BED5749B659226EA72BC550B34A6DF078072551F37EE06B3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.5MB
SHA256 ea153900a8557c6318b8e6ecc84ffb536e02fcf388ec85b9f049ecf99290083c
MD5 49012a6dc9b98aa745462835d8a8a87c
SHA1 34e017a5810203bfd4824155d408d172371dfc38
SHA512 4037c7c19acdb31dda082be9fd6c9448bfffafb2393822fe9f183c37784bda472c3274b853f9814191978d005d773896657d2182776137fccd66fa38544ddfb6
SSDEEP 49152:wabH/FW9dsTh7IwDyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTH:F7IwKm7vj1BDlZG
TLSH
T1DB069C13F29940D9D05AC078974A8232EA72BC594B30A6DF0790BB563F77BE06B3D725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.9MB
SHA256 447b64264df08cf166f004b1d513131ece6641c1909cb1d9979828c6fdac68c0
MD5 48876fd4fb789b91d5b85f3ef23f37db
SHA1 02b229dae355129c51317f0b03b210e0bcaddbce
SHA512 0faa699de1eb2c2348d33a7505c2ada4cc6b2b2d847ce7cd9c3d85364990f3b098a3f1260a8bd8aae22a1955a9af2fa68c727148992ddbd6744cfca462843cc5
SSDEEP 49152:wabH/UW9dsTh7IwUhtSn8EApI0fig1giDn0AP5w2:c7Iw1X2iwphX
TLSH
T104958D13F69500E9D06AC174DB568632EA72BC610B34AADF0790B7562F37BE06B3D316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 514KB
SHA256 d0169b4c87dfacf887ed25d8ecbc56217afebe919a61f231cf6f91c3bad4f541
MD5 9aa59e154f14985de20f87b3d83de5fc
SHA1 e89dfd4bdadd4b1d5c464ccc4725d3fb23ddd75c
SHA512 8b839611e4c1060eb303f98bd6bddc029e72e57c2d6d52cdb72a588f38f1c3ce36d30020faab91a3eac8588b7968ffd3b1328fc20b2ca1dd31333de7804e9c4b
SSDEEP 12288:w4Ryed8I7r/7mgGObdaFjdsTcFyn/7Iw9D47:w4R5CIH/71GObda9dsTcQ7IwZ47
TLSH
T199B48D23EB80406AD466C1B47AA58617FA753D710360A9CBB3C47B153B33AD276B439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 514KB
SHA256 39861159ce0d52d2452f45a10330ccf7a79ab6d60f330560079b1954b729c50d
MD5 32dde8662a0d2514869f5268c06a5823
SHA1 e3f4820f44520c8b50632f49c00450651e250afe
SHA512 6aa92f948b40a7d164125e3a56439e17b92adcbf0eb463b3b8b868ce0926d211e722282b292ceead9e71cd342112c6d711ca8af81e75adc058526e772576c7fb
SSDEEP 12288:w4Ryed8I7r/7mdGObdaFjdsTcFyn/7Iw9DWx:w4R5CIH/7oGObda9dsTcQ7IwZWx
TLSH
T1ADB48D23EB80406AD466C1B47AA58617FA753D710360A9CBB3C47B153B33AD276B439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 514KB
SHA256 300313b300a131c2861abe6aca5a894229f64a2474abbd90d1e62b6f1b33ae2b
MD5 3c2d457cf9d4e534a8ad8c6897846e33
SHA1 5e3c38d5859052422f1bf29e7568614fc5a6c4b0
SHA512 2d0b16ead9b811dbdb6e7e4874f34fd6899f9832f6255dfec178033951badd15cb644abd95e37185700957653df0348974a8de40014fedd3be1303afc4dae2bd
SSDEEP 12288:w4Ryed8I7r/7mgGObdaFjdsTcFyn/7Iw9DUs:w4R5CIH/71GObda9dsTcQ7IwZUs
TLSH
T139B48D23EB80406AD466C1B47AA58617FA753D710360A9CBB3C47B153B33AD276B439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 534KB
SHA256 b997ac8f20e6a9746c155331d23d6313098b845adf940d739aa34fa39e5a8c44
MD5 3edcadf473677ff2690d5fe180fc1218
SHA1 3c4d4992acc3089ef4e2fb6ceb6e92b12c714bff
SHA512 5ebc92beeb30f078ebaf7c1ecd51829a95f9b103c64125df69bef2b1017b8f6be294b70678b5187cd27be9c06f8f6bd9c01916faf5a28edcf2894338a12c7ecd
SSDEEP 12288:w4Ryed8I7r/7mtGObdaFjdsTcFyn/7Iw9D5Vc:w4R5CIH/7YGObda9dsTcQ7IwZg
TLSH
T177C48D23EB8040AAD466C174AAA58627FA753D710360A9DFB3C07B153B33AD2767435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 514KB
SHA256 9427df9cd8516c42369e50891cc8235eaa5469f5f7c1a36e61c09174c2112b01
MD5 6100460e95aa85cef7e7e341aa285f43
SHA1 6aee3e35ae6717a846fba2292bfe75d836a05c5d
SHA512 5e33dd995d127d936d03a5d9e23176a50715fdb56dc7fbb5865ed29a8339b197a68ebd19663b5bd6c75e2cc0cd907ed1218b5670a82e868d42d659a5645718ad
SSDEEP 12288:w4Ryed8I7r/7mgGObdaFjdsTcFyn/7Iw9DDZ:w4R5CIH/71GObda9dsTcQ7IwZDZ
TLSH
T123B48D23EB80406AD466C1747AA58617FA753D710360A9CBB3C47B153B33AD276B439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 634KB
SHA256 7402a7cdd19d07e9351f66fda8d35e9beacaf2c0f2c5e15ef9c961362ce5253f
MD5 5efc12c2ff394d5d8016f3cb37f1f856
SHA1 54648e8c919b6d851eae0af3e2784e54a6a750fd
SHA512 2e18d8febac8df7670a391806e37b53254804f5b18cbd6d6da2da6462725d59901adca358a3fcd464f59dead15fb3db6d731cac77dfb809e635ee215f1d40ae1
SSDEEP 12288:w4Ryed8I7r/7msGObdaFjdsTcFyn/7Iw9DTXsf3z:w4R5CIH/7JGObda9dsTcQ7IwZCD
TLSH
T150D43A22E64040A9D46E8174EB558616F6773D7103E0AACBA3C0F63D2B336D17AF875B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 546KB
SHA256 20c2d18f59bf14463c576cd5cf7e70bfefd6b5b8fe63a0ee7792f604179457d3
MD5 15241e8483f4c9f87e7f1ae795a8bc44
SHA1 65605427120872d829728cc1633b18a58ef40c4b
SHA512 3bb114119c0e442102e7b96d5116d69ee38fb7f796d972e244c331d238e7ae81ae1bccf0911436372748efdfd58be0535074cf3d9ae7429eff7b7ff3866edcbf
SSDEEP 12288:w4Ryed8I7r/7mgGObdaFjdsTcFyn/7Iw9DAr:w4R5CIH/71GObda9dsTcQ7IwZa
TLSH
T118C48D23E78040AAD466C1B4AAA58617FA753D710360A9CFA3C47B153F33AD2767835F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 554KB
SHA256 03e55377a4244c8d5f36ea8060de6235dbcf6ed7404a830858313cf4209de8bc
MD5 907a2ae134efd627cc74776f32eb0ee1
SHA1 fd845fcc2e1a32b8f486f9fb830d89409f99a8b9
SHA512 0075d9772e0c52549c0f252f4646d772d250dfd91aa56a1482bb65d7032e01277fba62fa229834ec2e0bcf2e59ffd81cea0ae382a9220439b8a2328ca7e8ff13
SSDEEP 12288:w4Ryed8I7r/7mdGObdaFjdsTcFyn/7Iw9DqqnkraG:w4R5CIH/7oGObda9dsTcQ7IwZqj
TLSH
T1B0C49E23E78040AAD066C1B4AA668617FA713D710360A9DFA3C47B153F33AD2767835F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 550KB
SHA256 e9376ca14d79edecb241cab300513e99160d4265c0010cde940a6b6bf43c8568
MD5 63f963896912e666edccaf89dd919707
SHA1 817ab296e5b0c59f2fbd804e5dd36656bd0196a3
SHA512 98246f36e4498c650c0e491a4f2b6aca7c3ec073a180a75dbd0b03533fcb9e1ae36c938ff9feac280ab0be75db639b8e75b9005b5733d8a4eab5185482e8f9e2
SSDEEP 12288:w4Ryed8I7r/7mEGObdaFjdsTcFyn/7Iw9DQpIyvJd:w4R5CIH/7BGObda9dsTcQ7IwZQjv
TLSH
T137C48D23E78040AAD466C1B46AA68617FA713D710360A9DFA3C47B153F33AD2767835F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar~4.exe
Size 270KB
SHA256 f6db5b9217d190c6d8f16a95b67d2f26f1bff4ec79d95f00d3755f182cc8e5ca
MD5 4e61919354a60148cb77981ff58f5ef3
SHA1 74dc9d4189c09ee8079375d579b3a7ba6d561488
SHA512 852d5726b8f0df036ce75ef5b0a81981526b80a313b968a66aa615fd234be54ceed89f0e7d746e94549254afe988cb854374f5cdfb83516aed7ad849a930c626
SSDEEP 3072:NMZcwhYciHmqo3v7ro/2szqJ71rISTQt8UPDSzXZc22Pb2pEx39TBf/uyfWIEICI:uZcweFm37cxzmRHUPD65Mb289TBnXvks
TLSH
T14D449DA1B3A04CF4EDB7813EC8518916D6B27C5A06B0C74F13A836665F733611D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 490KB
SHA256 462a58e972d8ffc94989441a545de86504da4df0f17703fdc718afd9643d2aee
MD5 ac9783c524fde6df434bf171e9451044
SHA1 794bca260b41aeb2a0bb6ec754cfdd1bb1946cd3
SHA512 0130869d8cd3ec326976bfe156b4e3c821c94ab2bd5925515237b448c2ca5b72aa180b167ac73e66eafc702b9b6d517c3917f273e16ac722af1dfe56852faf76
SSDEEP 12288:w4Ryed8I7r/7mWGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7zGObda9dsTcQ7IwZY
TLSH
T1EEB48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 d0a82263b7a88627332ab989a473dd72a5e6cee20b1f1682e223f88be9e399b6
MD5 6ac995096fa55748b35e869f84aad524
SHA1 8e2bbb6591b7ea4d15566e85e17abfc9d8d6dfba
SHA512 395922fb66278da02c8b43feae40335a553bd9dd4aaf58b55ee9272012a265050b112b36ce296bf3c95056799efce557e84c0ed73f5b3941bb2fe60b9b1b434c
SSDEEP 12288:w4Ryed8I7r/7mEGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7BGObda9dsTcQ7IwZY
TLSH
T1C5B48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 959a59cea2f46fc5d84c0388e252e20daf6d57d068f5b7e1f17f1c9f418441c3
MD5 518c909674a731985fd3f22d79447898
SHA1 b1100f2ebd9fd678026e24a3a082c54b120670c4
SHA512 471ce309d4b0330dab99cb26525d36bfc177dec8eca88e7752e6bda0e9b3129b90c4e4efe0a04d197621de5e63fba18ed87f5fef19d3dae50de90052aa8ac44b
SSDEEP 12288:w4Ryed8I7r/7mtGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7YGObda9dsTcQ7IwZY
TLSH
T1F8B48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 ad971b8688aa83ba6070c7bf4af3424c6d2ed8238851bdce2a6597deb9e10921
MD5 18faa385eb243ef15913feecf1228cc5
SHA1 dd99cdec9bac0fafb6476f9be2c90c790576c2a6
SHA512 bb726c7d4a72f8db388c97b42818d6361e40fd8ae76386971736a8eebf6e8ba72d92c38ed6d435489a752bf54e617311f0d0045cac4e98795c7c25f9c004fba2
SSDEEP 12288:w4Ryed8I7r/7msGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7JGObda9dsTcQ7IwZY
TLSH
T172B48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 658e5d3a3c58341f99e0fa494aeb89717c62c8617e5e713541c3e9a21e13f7eb
MD5 c28cbc82213d9c700aeda37a52102ee1
SHA1 016e631948ed6b6a2e62ab6a26f4a8117157e4ea
SHA512 7122aecdec26e1dac9c45d25904f337c89cfb0b79a40b3bc8c3939d049a7c0311f950f99368f082f3a54ee8c3763e4c62a2b0e43853196692fd8f1655bfb4865
SSDEEP 12288:w4Ryed8I7r/7m1GObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7AGObda9dsTcQ7IwZY
TLSH
T166B48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 39465baf6a0dc9ecb2ac42dc3b5e08160bf8872ce653806881c936bd010a09f1
MD5 7bb90f143c450905b001b816e71d5228
SHA1 75124b502d94db383e4fee2805f8cd7f6a858d88
SHA512 ddc38f866f0153d12c7a54a5e0511754f4e63325c2e557960805eb091394bb28f26b6d2229b956a80ccdc3dc01d716276afd8cbed374a648ef8aa14f8b4487b1
SSDEEP 12288:w4Ryed8I7r/7msGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7JGObda9dsTcQ7IwZY
TLSH
T159B48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 0920817ce7541ec32d88a5a309f373a37cf2e612dee651c18b7d9cd11da67f4a
MD5 c5f533aab1e286ce5a2052194c4dc47d
SHA1 cbd2dde5d1a9d2fcac51b4e195d3a19c72f78a87
SHA512 a6574a33e41d446c8d27e8578a619dd0a981ef81c2753a1f3e52dad40f0fd4f015190d31b4c6751b177437611cbbc4ef96ab09df3cc7d6add905a62a87b8f4a7
SSDEEP 12288:w4Ryed8I7r/7mfGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7aGObda9dsTcQ7IwZY
TLSH
T1ADB48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 f7bc153c95def683df97be98374b0b6c3e66d16655a2363b7401bd4f738d86a2
MD5 d74da7e69378774a94e9a08e24463363
SHA1 1aabf7014f4d82f1c824ba50a0e8706dd73849cc
SHA512 9297614c05ed9a55d6b6b4246d9e8aeb8c0b7c8dff9d842761c1f4f911424560ec1872f0edf2cc98d3b530af5a6bfca959116c1a6e600048596264b5577bc4a5
SSDEEP 12288:w4Ryed8I7r/7mgGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/71GObda9dsTcQ7IwZY
TLSH
T147B48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 db01dcf3d024b467a43711f5d9a8d4119bd2a9de0f4e24c06dfefe0765ae902e
MD5 8b9f9fbbfe21bdf2d45f6803087dcb6b
SHA1 3012d159ae9ca85c2c1821a049d59a69ab6ab3c5
SHA512 4e7e343de264791d117c57e3400f5e57b60f6a87f60f5f9a8ec20850cdd4034bf3493b36fc77d9996ada98cee35e04e78c0f036338326000d27607c0906478fe
SSDEEP 12288:w4Ryed8I7r/7mdGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7oGObda9dsTcQ7IwZY
TLSH
T1A9B48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 0b3009002ba6b33ecae1fe0664ca0fcf60c94128b9e46cfd81ddad56f615b73d
MD5 f228b649a63fa9547e965ef27032aa7b
SHA1 ba0f1dd3e7ac7acdf920922d51a4048bd83b4e79
SHA512 a9b6c5a7fdf647d739b56cec0ddfb86319b38b6901b531f9259f22df73dd664c714aedc270a9d4282093371f105e6e29ee5dd26afb2857df7df212236d2b7722
SSDEEP 12288:w4Ryed8I7r/7mEGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7BGObda9dsTcQ7IwZY
TLSH
T1E0B48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2520-33-0x000001F700000000-0x000001F700270000-memory.dmp

Download

memory/2520-43-0x000001F77D2E0000-0x000001F77D2E1000-memory.dmp

Download

memory/2520-45-0x000001F700000000-0x000001F700270000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads