476edae18c5a118d226dfe85cb30a09f76a47e605fa655940559d08fc3e14c7c

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 761KB
Sample260415-2c73waa19q
SHA256 476edae18c5a118d226dfe85cb30a09f76a47e605fa655940559d08fc3e14c7c
MD5 9fc60453ab876098b0b4c133d30b11a0
SHA1 f27f78aad2051d5c71dc8509cbd9145d26fb6c78
SHA512 4934e6cc1088949cb6f1dd09f5e5c17b4b9233b3a5e855a470021a299ed556a311c0eb783174d9f841f96847ae3f351b555b1c1696ad5c15e4ffc1a80fd6606c
SSDEEP 12288:w4Ryed8I7r/7mWGObdaFjdsTcFyn/7Iw9DXXAm3ggRUeMz9TNXvkk:w4R5CIH/7zGObda9dsTcQ7IwZgm3NCd1
TLSH
T1CCF49C22B79004B9D866C179A9558617EA713C710360DACFA3C43B163F336E27A7879F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
3524	UpdatAuto.exe
904	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar~4.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\StartInstall.doc	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1752	sc.exe
3920	sc.exe
5628	sc.exe
1072	sc.exe
4064	sc.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5084	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
3524	UpdatAuto.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 5116	5084	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	78
PID 5084 wrote to memory of 3524	5084	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	80
PID 3524 wrote to memory of 4740	3524	UpdatAuto.exe	81
PID 5084 wrote to memory of 904	5084	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	83
PID 5084 wrote to memory of 3896	5084	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	85
PID 5084 wrote to memory of 4388	5084	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	86
PID 5084 wrote to memory of 5508	5084	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	87
PID 5084 wrote to memory of 3612	5084	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	88
PID 5084 wrote to memory of 1800	5084	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	89
PID 5084 wrote to memory of 1980	5084	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	90
PID 5084 wrote to memory of 2544	5084	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	91
PID 5084 wrote to memory of 4064	5084	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	92
PID 5084 wrote to memory of 1072	5084	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	93
PID 5084 wrote to memory of 5628	5084	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	94
PID 5084 wrote to memory of 3920	5084	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	95
PID 5084 wrote to memory of 1752	5084	2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe	96
PID 1800 wrote to memory of 2140	1800	cmd.exe	109
PID 5508 wrote to memory of 5748	5508	cmd.exe	110
PID 2140 wrote to memory of 2136	2140	net.exe	111
PID 1980 wrote to memory of 2484	1980	cmd.exe	112
PID 2544 wrote to memory of 5500	2544	cmd.exe	113
PID 5748 wrote to memory of 4164	5748	net.exe	114
PID 2484 wrote to memory of 2180	2484	net.exe	115
PID 4388 wrote to memory of 3340	4388	cmd.exe	116
PID 5500 wrote to memory of 2104	5500	net.exe	117
PID 3896 wrote to memory of 3788	3896	cmd.exe	118
PID 3612 wrote to memory of 2876	3612	cmd.exe	119
PID 3340 wrote to memory of 5792	3340	net.exe	120
PID 3788 wrote to memory of 3648	3788	net.exe	121
PID 2876 wrote to memory of 1000	2876	net.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5116
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4740
- C:\Users\Admin\AppData\Local\Temp\2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar~4.exe
  2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:3648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:5792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5508
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5748
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4164
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:1000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:2136
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:2180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5500
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:2104
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4064
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1072
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5628
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3920
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.0MB
SHA256 b384007a7ecf13c24603a4c82355e8ff06f5a10ecf95a5a737b10cba26c09435
MD5 28d59caf66470969913d64e2343cda86
SHA1 b95515aa15d9f3011f741f8070f1b64289372cfa
SHA512 bb09af2ef9f3482716e52424d58b9bc8be8f0804c1d36448772454521519e2dca1bce3062c7a226261230bfa31b29e44cc09fc7cf090d019256945ad6baa1dc3
SSDEEP 24576:w4R5CIH/7JGObda9dsTcQ7IwZB0Le5ji0hmxNrM:wabH/tW9dsTh7IwDPji0Aj
TLSH
T1E8356B26F6648335D073C0B9C9D2965AFA713C91073099CB5385E7683F37AE2963A336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.4MB
SHA256 089c6d1a9d30e2046ac9f5accb64969dc0929c4c5604f0b4321dc3f54b87838c
MD5 49b772e105a5fd35f9b7899b3c63c005
SHA1 4358d06df6f0bb948cd6d45345401c32eb975a1c
SHA512 3c081f00bcaa24083687e9ac6ff12e817626007e0a6e6d042177b9336dedd6d590629ba4fedf2ab768e8ab9388047b17ffbfd0adb6cd7c421ffee46d13817a0f
SSDEEP 24576:w4R5CIH/7JGObda9dsTcQ7IwZTa7/ezSC6vUyD/aqgrvWx6q8wyu:wabH/tW9dsTh7Iww/ezSC6vUzPvMHjy
TLSH
T181652C26F5788323D0B2C0B9C5D6A65AFE723842073089CB5346A76C3E377E6953573A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e6bf9014bda71902582d2045ee974af3031005db40ba159ca93c0be7d3518518
MD5 13a3643481a8703db5c5233757d5f917
SHA1 bf4d8ab32d21933455afa2abfa04dd32633b7fc6
SHA512 2c2ccd658cd30d03beb3da173d60fbc4e2a5ae8f2b102431fb219e64c25a883ffac484d6834ce4a69eb160fa3508999c0392e4f5c2365cd5e51a2d723d903725
SSDEEP 24576:w4R5CIH/7aGObda9dsTcQ7IwZ1VbqPb88hv/l+7:wabH/mW9dsTh7IwDVO88hXl+
TLSH
T14C454B26F6648235D073C0B9C5D2965AEA323C5107308ACB5385A76C3F37BE6E636736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 504KB
SHA256 6fa29b26a1ce021fe9bb6bb3d000fbb72388b306f1a6a60d6047220d410ab216
MD5 3f389af056c491a1a38e6a67aef04d72
SHA1 7605a80378f0a040e5366a739c95d0e969b754c4
SHA512 f2245937fcc85d46ab193af5e75ef77611064504559232e3da0cc7420456d9168f024c9d2fa1e2150741f26b18060864b6d35e9ec7d3302455df4f0df347e75a
SSDEEP 12288:w4Ryed8I7r/7m1GObdaFjdsTcFyn/7Iw9Dra:w4R5CIH/7AGObda9dsTcQ7IwZra
TLSH
T192B48D23EB8040AAD466C1747AA98617FA713D710360A9DBB3C07B553B33AD276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.5MB
SHA256 2a57c799f0b26f463ce1cc6551cb6ccdb1ae8d1badcdd099d9ab711daa7d376e
MD5 0cb26ac365d42f13fec92e6d870fabd6
SHA1 b1a9b6d70f219df33ae3d08383a3b8bf95ce96c5
SHA512 1b2285491730b0171a47c2b214d3c07094d8b5495739e6021356d65e9ea931df93d6475fe3adb422722fd22a0bf81d9e674b40816f9cd7189a3a5fd261de0545
SSDEEP 49152:wabH/4W9dsTh7IwOj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMr:o7Iw9QRQyi36YOcP+Lvw2gAf+PN34
TLSH
T14B666C13F3A501E8E05ED974CF3956229B357C4A8BB092EF25D436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 cf4279b3d79e1e4ec5d4a478b4c11acddec11c36e55da3ab9b94c2677e06af73
MD5 a5f98aa3b8ad7b6d7d8e57f275e016c7
SHA1 986ff7bc8570b1134fe7f008d9d860cb101defb1
SHA512 5b7db7e15138fb96f2e9b2e09633fe495ca746e4f199678e93e909098fde01402b2a845b8e1f521894ac2ef3cc657b50b5e8ac43d4d472ab441b793cc4ee8836
SSDEEP 49152:wabH/FW9dsTh7IwG68Qg55nhoeWu7PNU3/Q:F7IwkthHRc/Q
TLSH
T19EB52833B2E200A9C45DD1769F568722A6E17C718FE0E7DB824173161BB2AD07B3971B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.9MB
SHA256 8d968c08d3e42aac3f8d510a79aa83a4736beea0de1ae21aef7f3e8da993a2a5
MD5 b129f0cb77778b7e6eeb7aaf9d74e697
SHA1 5e4bebbbbe6da7331f654686c769727ea5042726
SHA512 7fdfb505b00836659587165e92db63092e3761b04c7656e4064ce84e3f189e03c2740ac7fc82fd7d2ecc34871b420b8b9a2cc024b8b1bb4ee180b2d7b7f5946d
SSDEEP 49152:wabH/4W9dsTh7Iwq3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgN3Oh6tznT:o7Iw7y5112gYy5azzVvf69nLKnhZO
TLSH
T1DD166B13F29900E8D05DD179974A8232EA72BC564B31B6DF0A9077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.7MB
SHA256 dc47df3a741ef3725d07d1c9d118bb7de8412fd58628091c710952049d300799
MD5 31379ee6361e23a16f5c747ecbfe497e
SHA1 7397b921a98e826c20aa8cc851e0c36218ce7e4b
SHA512 c526775487f8c583a2e35b928f90758918ff538c369c2101ab8af7b37d8e2853b62d7af5e172558353f42c80464f40aca643345779a14c2fe29025c99d76d7fb
SSDEEP 49152:wabH/4W9dsTh7IwjB+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:o7IwVu6Jm0xd2d3
TLSH
T1C2D57B13F6D901E8D06AC078974A9233EA62BC590B30B6DF0B9077562B77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.1MB
SHA256 059178e3f805099f6d7045430779184a6b9d5b4d7a1e2bc83cb32d6bc60832a9
MD5 4f14212792711467d1849842d082e65a
SHA1 d93a731d5b952e126cbc0d9e97bd957309a0da49
SHA512 79cbba85102ad3809ba251d45a89ef95727c90fb2ec14bb08de5ffb544be6a5be9b3f80ffc50ae26e636945708abd41ffd1ac286873c98004ee46ed4cd986585
SSDEEP 49152:wabH/4W9dsTh7Iwb1hpsNoJpF1A6GU44CwH7R4xu:o7IwbmifP5R7
TLSH
T153A58D13F29800E9D06AC1789B569632EA72BC550B30B6DF0780B7962F77BE06B3D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.3MB
SHA256 54ed4fab4cc7bc8bf94c45ef035a4f818755f522ce187c819c88bac024d064b1
MD5 e9ed4d08da79a3efeda46272ea36d873
SHA1 d7f47f0ef0b09f1a7742bcc56f9915692a276ccc
SHA512 87b8e2e9057b9ccdd921e90e25b8b6455db26178cb5326c1cb5edad68a1e35b25bd3d8b538948ae115f93d46506bdb6eedffb883941977655b466223e9e4210c
SSDEEP 49152:wabH/4W9dsTh7IwmSuZQIY0Be2K8RVtOnks6NMHq6:o7Iwo5dKCi616
TLSH
T1F6B58D13F2E940E8E0BED5749B659226EA72BC550B34A6DF078072551F37EE06B3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.5MB
SHA256 ea153900a8557c6318b8e6ecc84ffb536e02fcf388ec85b9f049ecf99290083c
MD5 49012a6dc9b98aa745462835d8a8a87c
SHA1 34e017a5810203bfd4824155d408d172371dfc38
SHA512 4037c7c19acdb31dda082be9fd6c9448bfffafb2393822fe9f183c37784bda472c3274b853f9814191978d005d773896657d2182776137fccd66fa38544ddfb6
SSDEEP 49152:wabH/FW9dsTh7IwDyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTH:F7IwKm7vj1BDlZG
TLSH
T1DB069C13F29940D9D05AC078974A8232EA72BC594B30A6DF0790BB563F77BE06B3D725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.9MB
SHA256 5902f1b2d19da7cd509b6bf65a1a3888760cac5a3902d77eeb667de6dddbfe71
MD5 19c26ced70ced8d60cb3ea935e8b7b56
SHA1 94b7a1cadb17f3cedb56a7f3bfc861b8b882c491
SHA512 68d7c13a1551fe5cd7f9db6b07dd5060dd47af2813e81ad29ced0c3b9d05f49158566168217e380654e4b753638fdbdafa4e5d06db8cafe28946843012af514a
SSDEEP 49152:wabH/4W9dsTh7IwUhtSn8EApI0fig1giDn0AP5w2:o7Iw1X2iwphX
TLSH
T14D958D13F69500E9D06AC174DB568632EA72BC610B34AADF0790B7562F37BE06B3D316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 514KB
SHA256 ccd1f36ba2b59e0dc8fcda00b66016c1382a734a037453f8bba8f74691e209fb
MD5 72d89239cfe6826b3dfa04db44bfcf55
SHA1 f90df14eb7b7757a0db65e710ffe0fbe3ea0fa54
SHA512 c10ce8230f863eedced0da5e711fd772eceb06c218bb834af9b858af66b1bb27b728a0f230db49a72264ad90802d52d310444c3d202e3167ceb6e824bdd36022
SSDEEP 12288:w4Ryed8I7r/7mdGObdaFjdsTcFyn/7Iw9D47:w4R5CIH/7oGObda9dsTcQ7IwZ47
TLSH
T13FB48D23EB80406AD466C1B47AA58617FA753D710360A9CBB3C47B153B33AD276B439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 514KB
SHA256 39861159ce0d52d2452f45a10330ccf7a79ab6d60f330560079b1954b729c50d
MD5 32dde8662a0d2514869f5268c06a5823
SHA1 e3f4820f44520c8b50632f49c00450651e250afe
SHA512 6aa92f948b40a7d164125e3a56439e17b92adcbf0eb463b3b8b868ce0926d211e722282b292ceead9e71cd342112c6d711ca8af81e75adc058526e772576c7fb
SSDEEP 12288:w4Ryed8I7r/7mdGObdaFjdsTcFyn/7Iw9DWx:w4R5CIH/7oGObda9dsTcQ7IwZWx
TLSH
T1ADB48D23EB80406AD466C1B47AA58617FA753D710360A9CBB3C47B153B33AD276B439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 514KB
SHA256 aa1c1d652dbbcc473590179c1ff094348d506437ee2caa46e3619afdf81a88bd
MD5 70e701c9ca3062138b9582a3be26c2f2
SHA1 534a43ea7c9f56f3d310589a47f100b193236401
SHA512 e512185e8df9bf0b118bc7c39b8eede6dd1c7a071af18900832dee639508a68e6502ad1ad3222824f30067283e0a9eab5dcfe27958ec154cdcacc6d0384bef3a
SSDEEP 12288:w4Ryed8I7r/7mdGObdaFjdsTcFyn/7Iw9DUs:w4R5CIH/7oGObda9dsTcQ7IwZUs
TLSH
T17BB48D23EB80406AD466C1B47AA58617FA713D710360A9CBB3C47B153B33AD276B439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 534KB
SHA256 b997ac8f20e6a9746c155331d23d6313098b845adf940d739aa34fa39e5a8c44
MD5 3edcadf473677ff2690d5fe180fc1218
SHA1 3c4d4992acc3089ef4e2fb6ceb6e92b12c714bff
SHA512 5ebc92beeb30f078ebaf7c1ecd51829a95f9b103c64125df69bef2b1017b8f6be294b70678b5187cd27be9c06f8f6bd9c01916faf5a28edcf2894338a12c7ecd
SSDEEP 12288:w4Ryed8I7r/7mtGObdaFjdsTcFyn/7Iw9D5Vc:w4R5CIH/7YGObda9dsTcQ7IwZg
TLSH
T177C48D23EB8040AAD466C174AAA58627FA753D710360A9DFB3C07B153B33AD2767435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartInstall.exe

Path C:\Program Files\StartInstall.exe
Size 1.2MB
SHA256 d4155de7aa8a0ae488137fe4dda258e8e6fe7e98adcf9e231e5aba68e6aa3778
MD5 76a7bcc72c43dffd7461d54855295e03
SHA1 55e4330389985aa8d5a72e801a8d654d40d9d69e
SHA512 b5b4804ae8cb61f0773f23ad604d2174748be35e75cacf69831ab2fe95dc18d65273a55ea3153f6212fa60beb21d8b7cd20309c803c87a0f05bb216625609bcc
SSDEEP 24576:w4R5CIH/71GObda9dsTcQ7IwZJfTujohQtRN8sGQqt18Cu9oEvrQk:wabH/RW9dsTh7IwPqMqWjtSvkk
TLSH
T18145F123E741406AD066C1756EA68627F9713D7103A0A9DBB3C07B153B33AE276B439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 634KB
SHA256 7402a7cdd19d07e9351f66fda8d35e9beacaf2c0f2c5e15ef9c961362ce5253f
MD5 5efc12c2ff394d5d8016f3cb37f1f856
SHA1 54648e8c919b6d851eae0af3e2784e54a6a750fd
SHA512 2e18d8febac8df7670a391806e37b53254804f5b18cbd6d6da2da6462725d59901adca358a3fcd464f59dead15fb3db6d731cac77dfb809e635ee215f1d40ae1
SSDEEP 12288:w4Ryed8I7r/7msGObdaFjdsTcFyn/7Iw9DTXsf3z:w4R5CIH/7JGObda9dsTcQ7IwZCD
TLSH
T150D43A22E64040A9D46E8174EB558616F6773D7103E0AACBA3C0F63D2B336D17AF875B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 546KB
SHA256 1647be5b1a065f6c2427e9213b4e4cd974cd500f9c0312ca508a130b015c5aae
MD5 eead7d0f5fac23df44dc3160fb6e17ba
SHA1 14f4510046c9f6a68db2fac35ba1b807fa1f49f3
SHA512 9c89202cffa65b9ed7599e7cf3f1c1d38738c9f4827c733c2972e95521679a6b311f65d71126b8d4fcde1aed0e148aee9f5152c7e60e42be306ed331d41587a3
SSDEEP 12288:w4Ryed8I7r/7mdGObdaFjdsTcFyn/7Iw9DAr:w4R5CIH/7oGObda9dsTcQ7IwZa
TLSH
T163C48D23E78040AAD466C1B4AAA58617FA753D710360A9CFA3C47B153F33AD2767835F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 554KB
SHA256 d5458b49107a189bdfed4bb041c7691d513ebcec3ac08e7e700b91fbd656b48e
MD5 f80b947f483655345d4ae7124234bafd
SHA1 59a4bcdcd3b6d2eca277653d3845870507dd5311
SHA512 48e2734981c85849e0d9ae4ee855741e39bc41708d4006b4eb30a471ccba5e587b26b27ba81d42a20617b987efc3d9ca7797b4737acad6da856e18758e50faf4
SSDEEP 12288:w4Ryed8I7r/7mgGObdaFjdsTcFyn/7Iw9DqqnkraG:w4R5CIH/71GObda9dsTcQ7IwZqj
TLSH
T17AC49E23E78040AAD066C1B4AA668617FA713D710360A9DFA3C47B153F33AD2767835F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 550KB
SHA256 ef3af6a660a0aee08cd4e457715dd39e82a1f7cc0d8874da5dc27f20cf421605
MD5 8ef785da53a866b322f366bc2af7919e
SHA1 aca2c1c710f1e34bdc7ab17d8fd7cdc555e292fb
SHA512 ecae7a396d3c5effec35ab29bca3a32829a5a78fca0e5cedccc5d4f5409d225f3c7f752ac648f8eab4e004e7bd041fef63af8fb43c3c0117e34390f885b5847c
SSDEEP 12288:w4Ryed8I7r/7mBGObdaFjdsTcFyn/7Iw9DQpIyvJd:w4R5CIH/7EGObda9dsTcQ7IwZQjv
TLSH
T12BC48D23E78040AAD466C1B46AA68617FA713D710360A9DFA3C47B153F33AD2767835F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-15_9fc60453ab876098b0b4c133d30b11a0_cobalt-strike_elex_icedid_njrat_vidar~4.exe
Size 270KB
SHA256 f6db5b9217d190c6d8f16a95b67d2f26f1bff4ec79d95f00d3755f182cc8e5ca
MD5 4e61919354a60148cb77981ff58f5ef3
SHA1 74dc9d4189c09ee8079375d579b3a7ba6d561488
SHA512 852d5726b8f0df036ce75ef5b0a81981526b80a313b968a66aa615fd234be54ceed89f0e7d746e94549254afe988cb854374f5cdfb83516aed7ad849a930c626
SSDEEP 3072:NMZcwhYciHmqo3v7ro/2szqJ71rISTQt8UPDSzXZc22Pb2pEx39TBf/uyfWIEICI:uZcweFm37cxzmRHUPD65Mb289TBnXvks
TLSH
T14D449DA1B3A04CF4EDB7813EC8518916D6B27C5A06B0C74F13A836665F733611D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 490KB
SHA256 462a58e972d8ffc94989441a545de86504da4df0f17703fdc718afd9643d2aee
MD5 ac9783c524fde6df434bf171e9451044
SHA1 794bca260b41aeb2a0bb6ec754cfdd1bb1946cd3
SHA512 0130869d8cd3ec326976bfe156b4e3c821c94ab2bd5925515237b448c2ca5b72aa180b167ac73e66eafc702b9b6d517c3917f273e16ac722af1dfe56852faf76
SSDEEP 12288:w4Ryed8I7r/7mWGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7zGObda9dsTcQ7IwZY
TLSH
T1EEB48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 db01dcf3d024b467a43711f5d9a8d4119bd2a9de0f4e24c06dfefe0765ae902e
MD5 8b9f9fbbfe21bdf2d45f6803087dcb6b
SHA1 3012d159ae9ca85c2c1821a049d59a69ab6ab3c5
SHA512 4e7e343de264791d117c57e3400f5e57b60f6a87f60f5f9a8ec20850cdd4034bf3493b36fc77d9996ada98cee35e04e78c0f036338326000d27607c0906478fe
SSDEEP 12288:w4Ryed8I7r/7mdGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7oGObda9dsTcQ7IwZY
TLSH
T1A9B48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 d0a82263b7a88627332ab989a473dd72a5e6cee20b1f1682e223f88be9e399b6
MD5 6ac995096fa55748b35e869f84aad524
SHA1 8e2bbb6591b7ea4d15566e85e17abfc9d8d6dfba
SHA512 395922fb66278da02c8b43feae40335a553bd9dd4aaf58b55ee9272012a265050b112b36ce296bf3c95056799efce557e84c0ed73f5b3941bb2fe60b9b1b434c
SSDEEP 12288:w4Ryed8I7r/7mEGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7BGObda9dsTcQ7IwZY
TLSH
T1C5B48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 04f8105760c9f26cbbb8347058f4459356060d6e2d9fa16b5272a09e3f118915
MD5 99ef5d23015d1cd4e29b2079e3bea63c
SHA1 3ad5b69b9bbf12b191a01f09ffb69bdd19bfa6a3
SHA512 6722aefa01e0224b9ea32c620749c333cef8917e3ea9a7d6deee4bb506e8ac2f1fca085e4319927656b7ff2e1957f874b0bcbdcc68b590d325e4da8cc8cf781c
SSDEEP 12288:w4Ryed8I7r/7mBGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7EGObda9dsTcQ7IwZY
TLSH
T1D8B48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 959a59cea2f46fc5d84c0388e252e20daf6d57d068f5b7e1f17f1c9f418441c3
MD5 518c909674a731985fd3f22d79447898
SHA1 b1100f2ebd9fd678026e24a3a082c54b120670c4
SHA512 471ce309d4b0330dab99cb26525d36bfc177dec8eca88e7752e6bda0e9b3129b90c4e4efe0a04d197621de5e63fba18ed87f5fef19d3dae50de90052aa8ac44b
SSDEEP 12288:w4Ryed8I7r/7mtGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7YGObda9dsTcQ7IwZY
TLSH
T1F8B48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 f7bc153c95def683df97be98374b0b6c3e66d16655a2363b7401bd4f738d86a2
MD5 d74da7e69378774a94e9a08e24463363
SHA1 1aabf7014f4d82f1c824ba50a0e8706dd73849cc
SHA512 9297614c05ed9a55d6b6b4246d9e8aeb8c0b7c8dff9d842761c1f4f911424560ec1872f0edf2cc98d3b530af5a6bfca959116c1a6e600048596264b5577bc4a5
SSDEEP 12288:w4Ryed8I7r/7mgGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/71GObda9dsTcQ7IwZY
TLSH
T147B48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 ad971b8688aa83ba6070c7bf4af3424c6d2ed8238851bdce2a6597deb9e10921
MD5 18faa385eb243ef15913feecf1228cc5
SHA1 dd99cdec9bac0fafb6476f9be2c90c790576c2a6
SHA512 bb726c7d4a72f8db388c97b42818d6361e40fd8ae76386971736a8eebf6e8ba72d92c38ed6d435489a752bf54e617311f0d0045cac4e98795c7c25f9c004fba2
SSDEEP 12288:w4Ryed8I7r/7msGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7JGObda9dsTcQ7IwZY
TLSH
T172B48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 0920817ce7541ec32d88a5a309f373a37cf2e612dee651c18b7d9cd11da67f4a
MD5 c5f533aab1e286ce5a2052194c4dc47d
SHA1 cbd2dde5d1a9d2fcac51b4e195d3a19c72f78a87
SHA512 a6574a33e41d446c8d27e8578a619dd0a981ef81c2753a1f3e52dad40f0fd4f015190d31b4c6751b177437611cbbc4ef96ab09df3cc7d6add905a62a87b8f4a7
SSDEEP 12288:w4Ryed8I7r/7mfGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7aGObda9dsTcQ7IwZY
TLSH
T1ADB48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 658e5d3a3c58341f99e0fa494aeb89717c62c8617e5e713541c3e9a21e13f7eb
MD5 c28cbc82213d9c700aeda37a52102ee1
SHA1 016e631948ed6b6a2e62ab6a26f4a8117157e4ea
SHA512 7122aecdec26e1dac9c45d25904f337c89cfb0b79a40b3bc8c3939d049a7c0311f950f99368f082f3a54ee8c3763e4c62a2b0e43853196692fd8f1655bfb4865
SSDEEP 12288:w4Ryed8I7r/7m1GObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7AGObda9dsTcQ7IwZY
TLSH
T166B48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 39465baf6a0dc9ecb2ac42dc3b5e08160bf8872ce653806881c936bd010a09f1
MD5 7bb90f143c450905b001b816e71d5228
SHA1 75124b502d94db383e4fee2805f8cd7f6a858d88
SHA512 ddc38f866f0153d12c7a54a5e0511754f4e63325c2e557960805eb091394bb28f26b6d2229b956a80ccdc3dc01d716276afd8cbed374a648ef8aa14f8b4487b1
SSDEEP 12288:w4Ryed8I7r/7msGObdaFjdsTcFyn/7Iw9DY:w4R5CIH/7JGObda9dsTcQ7IwZY
TLSH
T159B48D33EB80406AD466C1B46A658627FA753D710360A9DBB3C07B153B33AE276B435F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/904-33-0x000001BEAFE60000-0x000001BEB00D0000-memory.dmp

Download

memory/904-43-0x000001BEAFE40000-0x000001BEAFE41000-memory.dmp

Download

memory/904-45-0x000001BEAFE60000-0x000001BEB00D0000-memory.dmp

Download

memory/3524-102-0x00000000009B0000-0x0000000000A2B000-memory.dmp

Download

memory/5084-93-0x0000000000980000-0x00000000009FB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads