Analysis
- max time kernel
150s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
21/04/2026, 05:54
Behavioral task
behavioral1
Sample
2026-04-21_21145d3cad74ca4eaf11e3c365b7b47d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-04-21_21145d3cad74ca4eaf11e3c365b7b47d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_njrat_vidar.exe
- Size 6.1MB
- Sample260421-gl9mvact8y
- SHA256 21e92fc3c126d10c7b268a0b186415e2906f364eed1c6def3b73ba4fbe2813c0
- MD5 21145d3cad74ca4eaf11e3c365b7b47d
- SHA1 2bd37506b7b02c409e0459b2abd3dca9eabbb40d
- SHA512 21c7b0cd495fa40569aa691f46cb921809a151d3b954934a9f71fccb8e44f7c231ebbe0b597fc9f0621d3ce17ef4cb1818fe7e537616d27bd473340b97654d13
- SSDEEP 49152:xtawSN2jtawSN26HYHbluHKYcMnPji0AjqgjI45TMwwapIgTcPji0Aj:xtaww2jtaww2Hl55UjosLapIHjo
- TLSH T164562901F2B34127DD666070CA5A6764E3A07E744FF1C2DB650A72E96EF26C0793236E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Soulclose 3 IoCs
resource yara_rule behavioral2/memory/1360-0-0x0000000000400000-0x0000000000419000-memory.dmp family_soulclose behavioral2/files/0x001b00000002b3a1-10.dat family_soulclose behavioral2/files/0x001b00000002ae2b-15.dat family_soulclose - UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/files/0x001b00000002b3a1-10.dat UPX behavioral2/files/0x001b00000002ae2b-15.dat UPX - Executes dropped EXE 1 IoCs
pid Process 3968 CCTV.exe - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf CCTV.exe File created C:\autorun.inf CCTV.exe File opened for modification F:\autorun.inf CCTV.exe File created F:\autorun.inf CCTV.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe CCTV.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe CCTV.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe CCTV.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe CCTV.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe CCTV.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe CCTV.exe File opened for modification C:\Program Files\RevokeSubmit.exe CCTV.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe CCTV.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe CCTV.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\CCTV.exe 2026-04-21_21145d3cad74ca4eaf11e3c365b7b47d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\CCTV.exe 2026-04-21_21145d3cad74ca4eaf11e3c365b7b47d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\CCTV.exe CCTV.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-21_21145d3cad74ca4eaf11e3c365b7b47d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1360 2026-04-21_21145d3cad74ca4eaf11e3c365b7b47d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_njrat_vidar.exe 3968 CCTV.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1360 wrote to memory of 5032 1360 2026-04-21_21145d3cad74ca4eaf11e3c365b7b47d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_njrat_vidar.exe 80 PID 1360 wrote to memory of 3968 1360 2026-04-21_21145d3cad74ca4eaf11e3c365b7b47d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_njrat_vidar.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_21145d3cad74ca4eaf11e3c365b7b47d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_21145d3cad74ca4eaf11e3c365b7b47d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\2026-04-21_21145d3cad74ca4eaf11e3c365b7b47d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_njrat_vidarkill.bat2⤵
- System Location Discovery: System Language Discovery
PID:5032
-
-
C:\Windows\CCTV.exeC:\Windows\CCTV.exe2⤵
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3968
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\ConnectDismount.exe
- Size 6.6MB
- SHA256 859eadf635d148811ecd9675fa70fed77457dc36ae90ee4b53d7cf950e4ce553
- MD5 b12c38253f75d423074cf7187bc06e80
- SHA1 6120f9255cea4b443dc9473a83fcc712a680a873
- SHA512 cba3563761cf4aded84bcfa630ea4780ece3237ab0998c2d299923ff0be9fb6ce5326bb6c83f740218db1b416259ea64abaa63ce282ea518efc821fc13761bd7
- SSDEEP 98304:xtaww2jtaww2Hl55UjosLapIHjo/nd2z29:x8V2j8V2Hl5UoscIDoPL
- TLSH T1B3663A01F2B34127DD666070CA5A6764E3A07E744FF1C2DB650A72E96EF26C0793236E
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-04-21_21145d3cad74ca4eaf11e3c365b7b47d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_njrat_vidarkill.bat
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-21_21145d3cad74ca4eaf11e3c365b7b47d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_njrat_vidarkill.bat
- Size 346B
- SHA256 6ccfd3d3c377aac2daa166f977d32d7fb82f55afe63412375a6bf6a50030fb08
- MD5 99b3105880f11f88f8dd8c3d09c8b9cc
- SHA1 cd3643075ee0432440b572c2bcd978d86e05de52
- SHA512 ac60a14c9a886fec9bc7ab8658fbfae76e21669f82dfb623770be077669845e2862652511577222fa4c5992d2a8d32ea3d36558949fd59d410823db6b7bd8ac8
- TLSH T136E02600CAF6DBF898E0312243E5A96DC4293A191B5A3213BF69C04E11D0888FA67B86
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\CCTV.exe
- Size 6.1MB
- SHA256 21e92fc3c126d10c7b268a0b186415e2906f364eed1c6def3b73ba4fbe2813c0
- MD5 21145d3cad74ca4eaf11e3c365b7b47d
- SHA1 2bd37506b7b02c409e0459b2abd3dca9eabbb40d
- SHA512 21c7b0cd495fa40569aa691f46cb921809a151d3b954934a9f71fccb8e44f7c231ebbe0b597fc9f0621d3ce17ef4cb1818fe7e537616d27bd473340b97654d13
- SSDEEP 49152:xtawSN2jtawSN26HYHbluHKYcMnPji0AjqgjI45TMwwapIgTcPji0Aj:xtaww2jtaww2Hl55UjosLapIHjo
- TLSH T164562901F2B34127DD666070CA5A6764E3A07E744FF1C2DB650A72E96EF26C0793236E
- MD5 SHA1 SHA512 SSDEEP TLSH