14793d4fbfd6b747fb9480bc82b35d4c066408b7b3a808280ebbd3be52976d96

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Size 1.1MB
Sample260416-jcb2bsdv2y
SHA256 14793d4fbfd6b747fb9480bc82b35d4c066408b7b3a808280ebbd3be52976d96
MD5 8ad1dae917914e106f6489ea4a3ef318
SHA1 8c0abdb86790b09ac3a3b553faaa89b289c094d4
SHA512 5a47c593cf7d31afb465481988d5a35c47db2d3cc07bac5509f6e68dc47a8bbdea26ce766f6791be56bba87c24a522abbd666adefb31abc8bfa856941794a8f3
SSDEEP 24576:EK2eTEe+3lRaYFKrDA+ouZ/K0tbKMLpzyl:d2od+3lRaYSDA+ouZ/K0tDpy
TLSH
T132359D17F68510F8D05ED1788786A632EA72B8660B34B9DF079086662F77BE06F3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
956	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.tmp
844	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.mm
4708	YZH.exe
4408	YZH.exe
4088	YZH.sys

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.mm
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.mm
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	YZH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	YZH.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3352-0-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/files/0x001b00000002b24f-10.dat	upx
behavioral2/memory/844-12-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/844-11-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-19-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-18-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/844-21-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4408-52-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4088-54-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4088-58-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3352-99-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-100-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-101-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3352-102-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-104-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-107-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-110-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-113-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-116-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-119-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-122-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-125-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-128-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-131-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-134-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-137-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-140-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4708-143-0x0000000000400000-0x000000000043F000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\WaitUnregister.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\YZH.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.mm
File opened for modification	C:\Windows\YZH.exe	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.mm
File created	C:\Windows\YZH.exe	YZH.exe
File created	C:\Windows\YZH.sys	YZH.exe
File opened for modification	C:\Windows\YZH.sys	YZH.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YZH.sys
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.mm
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YZH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YZH.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3352	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
3352	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4408	YZH.exe
4408	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe
4708	YZH.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4708	YZH.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 956	3352	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe	80
PID 3352 wrote to memory of 844	3352	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe	82
PID 956 wrote to memory of 1068	956	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.tmp	83
PID 844 wrote to memory of 4708	844	2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.mm	84
PID 4408 wrote to memory of 4088	4408	YZH.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Temp\2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.tmp
  C:\Users\Admin\AppData\Local\Temp\2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.tmp
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Program Files\Java\jdk-1.8\bin\java.exe
    "C:\Program Files\Java\jdk-1.8\bin\java.exe" -Xmx256M "-Djavafx.home=C:\Users\Admin\AppData\Local\Temp" -classpath "C:\Users\Admin\AppData\Local\Temp\..\lib\ant-javafx.jar;" com.sun.javafx.tools.packager.Main
    3⤵
    PID:1068
- C:\Users\Admin\AppData\Local\Temp\2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.mm
  C:\Users\Admin\AppData\Local\Temp\2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.mm /zhj
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\YZH.exe
    C:\Windows\YZH.exe /zhj
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4708

C:\Windows\YZH.exe
C:\Windows\YZH.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\YZH.sys
  C:\Windows\YZH.sys /zhj
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.mm

Path C:\Users\Admin\AppData\Local\Temp\2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.mm
Size 960KB
SHA256 f6ecc710d92c06dc61cfab6e2f051e47cd1adac8a41d21b614fd13871158356e
MD5 0911b208f5de2990dda22142b381cbeb
SHA1 222ba720605507e8e1af230d85022dfafa974bac
SHA512 88b1444572dd072374b454aedbe0b038c17c3c182a44e1b772735b9dd680272b4021d572e1d77f6336f6a137c67720ad9d378ab26196f5266ccdd03e0daf6900
SSDEEP 12288:mDb22DShTEe+yuyX0WF6TZBrRQGKYaYFKrDUZnj+ouZ/K0tNDdKVgVPLVA:EK2eTEe+3lRaYFKrDA+ouZ/K0tbKML6
TLSH
T117259E17F68500E8D05ED179878AA232E972B85A0B35B9DF0790C6662F77FE06B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.tmp

Path C:\Users\Admin\AppData\Local\Temp\2026-04-16_8ad1dae917914e106f6489ea4a3ef318_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.tmp
Size 161KB
SHA256 e978beebc1b0043bb78f8ad12590784881bf3760bca33bc316c8eb4fec7e28d8
MD5 d97049464ece8888ebda7f0c9cb18927
SHA1 c3bf880e673229e1715d0ae4157f9f6358fade78
SHA512 6021ba70df3e0ac207e71a7beede9c90c17210e7e13d1a7976fde7bdebfe7ba966dda1a19107b63633906d41b8d6faecac264946b5ad2e41f0ceec320db9f1b6
SSDEEP 3072:5TAR4kYzywJLiR1vxf5quxk+nTL1V78VFVqostAY+B6GxkF:5c+D/0vxBzkiLz9u8
TLSH
T131F35C5777A130F9D1779238C8A21A02F772B83647608AAF136447762F237D19E3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/844-21-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/844-12-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/844-11-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/956-60-0x00007FF629660000-0x00007FF62968C000-memory.dmp

Download

memory/1068-24-0x000002372FD90000-0x0000023730000000-memory.dmp

Download

memory/1068-59-0x000002372FD90000-0x0000023730000000-memory.dmp

Download

memory/1068-55-0x000002372E530000-0x000002372E531000-memory.dmp

Download

memory/3352-103-0x0000000002540000-0x0000000002601000-memory.dmp

Download

memory/3352-0-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3352-102-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3352-1-0x000000000043E000-0x000000000043F000-memory.dmp

Download

memory/3352-99-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4088-54-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4088-58-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4408-52-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4408-56-0x00000000008B0000-0x0000000000971000-memory.dmp

Download

memory/4708-100-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4708-101-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4708-18-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4708-19-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4708-104-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4708-107-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4708-110-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4708-113-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4708-116-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4708-119-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4708-122-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4708-125-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4708-128-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4708-131-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4708-134-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4708-137-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4708-140-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4708-143-0x0000000000400000-0x000000000043F000-memory.dmp

Download