d7bb9f23e47f7b8583200e935bc0cb16d1248f06c40501671cdf64bb9f2c29fa

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
Size 942KB
Sample260424-kdsadady2n
SHA256 d7bb9f23e47f7b8583200e935bc0cb16d1248f06c40501671cdf64bb9f2c29fa
MD5 9aab92b6a090f2b2db10ea140ba37dc6
SHA1 9e54eea298c609a17f3e9489e22f33d3307c539f
SHA512 7d657398801938a0475d202ea7d807dfcbb2b6b680b4179314bcce6bc5d7fc3337b485e0eafbb63384994384d799c1df1bd1899530ca3d4978ea17689674fb11
SSDEEP 24576:w4R5CIH/7pS4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/0abH/FPjH+PIj0
TLSH
T1B9250711BA804075F07289756825860DAA267C74CA638D4F73843ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4704	UpdatAuto.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Windows\SysWOW64\UpdatAuto.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	UpdatAuto.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3720	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
4704	UpdatAuto.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 4812	3720	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe	80
PID 3720 wrote to memory of 4704	3720	2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe	82
PID 4704 wrote to memory of 5772	4704	UpdatAuto.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4812
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.5MB
SHA256 5674538933c76a318bd22f774a1dd34e46ffda4c2af603c7fb1abc4ca8787433
MD5 852fbf4fac2996013b0412d57d8fe87e
SHA1 19f94bea5602b8b5bb313a85b21a0ece86e6002f
SHA512 d75e4f50f47fdb8c7fea8fcbc3d5626d53dae6417f78a7521edc007745789e50b6ec3f4c7ab50678f375208183273cb3fac878bccf17955b3b7edd5ee2192591
SSDEEP 24576:w4R5CIH/7dS4R5CIH/7iWDPjHg9PnNUcQjriLo0Le5ji0hmxNrM:wabH/IabH/FPjH+PIjVPji0Aj
TLSH
T1D7651811F6644275E072847988A1964EEA313C61CB338D8B2385BEDDBFF36D29935732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.9MB
SHA256 2dcf77d17c8d90500ddc6f6e50c501d3e3ec6cf2891606e8362a8224b0c23830
MD5 4fde198996850856133bfb11f5bfafef
SHA1 d226e4da74691569ddd7f75daaea383d26fa4c30
SHA512 1b0118dcf64468818a52568de16eafefc8f0759b77612337eb48f6a39b9ce19e8994f952a520668247629e84525db52a05b25df1803b67f381e06ec12ca4b5e1
SSDEEP 49152:wabH/IabH/FPjH+PIjy/ezSC6vUzPvMHjy:Zbb2ezSC6v2XMH
TLSH
T170950811B6748232E0B2C079C4A6A65DFA323C518B328DCB1245AFDD7FB36D29935736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.6MB
SHA256 de24a51853d031f3cacbcef3c987647ce1605f1e47e0a6f8ab3401affb61d5fd
MD5 794ccd40e68378086f877d5fdea515b4
SHA1 d9e465a06dafe775679cb31f2949e1f0128463c0
SHA512 87f31aec7ed528b684b1f6201392900d6bc1e2a1329dbab99f872f5e6b5d53c021c17920e1669a4bbf597746b29d897d67ce27941fbcd8f68556b2fab3f8c387
SSDEEP 24576:w4R5CIH/76S4R5CIH/7iWDPjHg9PnNUcQjriLEVbqPb88hv/l+7:wabH/9abH/FPjH+PIjhVO88hXl+
TLSH
T1F7750721F6A48175E0728475C8A1964DEA323C61CB338D8B22857FDDBFF26D29935732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 956KB
SHA256 61ff3edcf96ccbc01f5f346fbc94a52c2e284832cd2be998d465aec621e64255
MD5 b5b3430e23a3a6cdff42a5b3365855f6
SHA1 fa1f88c3bd69d6ca5e7fc7325eb5e5049587c0b5
SHA512 798f7204169c9597a6b3b28decd3f941796297612225618e51566d838c98d06fc8f7c43dac2916d07f28414e22789f1cbf60ac606ec07789b77a9cfff8027517
SSDEEP 24576:w4R5CIH/73S4R5CIH/7iWDPjHg9PnNUcQjriLqa:wabH/+abH/FPjH+PIj
TLSH
T184250611BA804075F07289756825860DAA267C75CA638D4F73803ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 7.0MB
SHA256 8a7c575fa700f8805ff82c6a717f10ba7eb7f15dfeddd552ed88caadfea5e74a
MD5 ac4ebf880cf8643c69b826f6807b6892
SHA1 b0e69e91ac82fb3f0eb6f9c4c5cb96f39c9708ef
SHA512 e7fad64fdb1baeb68c5f67a63de63c1d6543d63cc5a3fe973e4c37ee2e5bdc3e000df3aa03aa752c6dc60a66011b43a0f04ed5b0ff5eee49c8162537f124b477
SSDEEP 49152:wabH/KabH/FPjH+PIjkj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259D:bbb7QRQyi36YOcP+Lvw2gAf+PN34
TLSH
T19A767D03F3A500B8E05ED974CF3952229B357C5A87B196DF25943AE52BB29D07B38B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 7.0MB
SHA256 94ba7f0a15b29e208f1fbf1e686bb5e0f0a6bf74972ddefbc530577aca96bf97
MD5 282900a6ec9936341b43de41ba3cb6f6
SHA1 487214619a4ce37896e80e272739ce64e05c07e6
SHA512 c851df478672411bb898ef5d3ad87aee75c494542097ae2bddfb36ccc4226a871f8989ec0bd6fe1ea3431ac7b8436c8b53ddd4c006721e6b75074346a264e2d0
SSDEEP 49152:wabH/QabH/FPjH+PIjkj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259D:xbb7QRQyi36YOcP+Lvw2gAf+PN34
TLSH
T17F767D03F3A500B8E05ED974CF3952229B357C5A87B196DF25943AE52BB29D07B38B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.6MB
SHA256 6608055d116cc6e914621f8ae0895ba8a58461daa37a5a8f39e079a7d2bd93d9
MD5 e9fcec0372128047630ade7ecc509825
SHA1 add1e87ce7f1fe8fdb977bc790e144986dc22164
SHA512 5174e9a5e17cffe56c65b7f3ec9f4f9a2188ed7b15888cd2a959fd507f7efffcf25b45b95e93d4edf2ca86bb83fc1b1331486e88ab54032786b9fe6a8b82ba66
SSDEEP 49152:wabH/QabH/FPjH+PIjQ68Qg55nhoeWu7PNU3/Q:xbbKthHRc/Q
TLSH
T1DBD52923B2E200B5D059C5359B16862995D17C71CFA2DFCB52403A8E3FF2AD16A3973B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.4MB
SHA256 ceb2f07dbd7a386d12d81d12f62095e86b24ac50e37722000cadf48eb6a9924b
MD5 9bbcb16af11d9b06162c037cb5b51798
SHA1 93490a4fdc6612d1c4fc3fa7a563d4d202c350e0
SHA512 3b7387eed30d3bf4dd65eadbb29330f91a4a4301172d191be63664db48bd29fa900a85b876d49e9041f38afd71d58b33aadba7560e3aaf4646f855b724e6dc6c
SSDEEP 49152:wabH/KabH/FPjH+PIjI3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgN3Oh6J:bbbly5112gYy5azzVvf69nLKnhZO
TLSH
T159267C13F29800F8D019C5794756822AE971BC568B22AECF06507B993FB7AE16F3D731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.2MB
SHA256 1219e5a5ea20d722aa2047bd767b07afff415a96068dfc373efd3c5ae58f0c1a
MD5 698c5930c34e40fd28a6b224a5f88f56
SHA1 bc33e461e1388dd667aae86bdd3c5d88bbcc52f2
SHA512 3e945f8fbdc5b9938883667b949781d19379de3306421af71d44db79cdc9a98879d37b4ab27f2d2ff70b71c0157ebbdd19b62bfa91045ebbd531f805d0365d3c
SSDEEP 49152:wabH/QabH/FPjH+PIjVB+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:xbbbu6Jm0xd2d3
TLSH
T1D1F57C13F69500F8E06AC4745615912AE921BC558B22AEDF17807BCE3FF3AE16B39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.6MB
SHA256 aa72712323e9f572ab9b8d65d498f7e27faef47bccbe76f6bc2955b55851a743
MD5 1e30bfd2426f93f841c4ac6b769f09a0
SHA1 d8390274082b5de9d6618328a5deb48fb935f584
SHA512 471de2f1a59ce710792dd18ba840238d783626c33b5d77bd69b6bd88db7fe1433e8df8a659836455cd8aebc5adb900e7f24ce5709599b7dd33a61803cd7d2a85
SSDEEP 49152:wabH/KabH/FPjH+PIjN1hpsNoJpF1A6GU44CwH7R4xu:bbbNmifP5R7
TLSH
T17CC55C13B29400F4E066C5745A25912EEA217C658B23AEDF12807EDE7FF3AD15B39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.8MB
SHA256 ba75e86fb96e1dad6a1574543d0b83d822329d317593c4d2614a2f60c69e673a
MD5 bc407ad1b504dd446f50bd329ee2b789
SHA1 4a0bd2813bc2fac2dbffa0ee68cf7a557a6d3842
SHA512 95c7f0f9471c66258d4a8f05097b49d2e26a202a79dedb7e300b48069a115d1c551b4059bfec1e1f2debfd0a9a759ff36e97de8ff1dfa53bb6862a0f10b699d3
SSDEEP 49152:wabH/QabH/FPjH+PIjESuZQIY0Be2K8RVtOnks6NMHq6:xbbW5dKCi616
TLSH
T154D55C13B2D440B4E0BAC5749A65912EEA627C558B329DCF12403ADD7FF3AE05B39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 4.0MB
SHA256 015f33d1538be5e178f5e2999d00e87f5f5cb813e0fa850295addd1bd8bf28be
MD5 999615dba798d905bb8339992f47513f
SHA1 29c34b0a8bc772a2ec85c49b8953e090856f93fe
SHA512 6d6f1a5ceac5225e3a9b94713dabc0a3e42c5ce90871c3384810adb806550cbbf5e8637902859cacb16bef1569ba954316dae2e8458eaa030c0e8ed7a764b54b
SSDEEP 49152:wabH/QabH/FPjH+PIjFyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAE:xbbEm7vj1BDlZG
TLSH
T127167C13F29440F4D069C0748756823AEA227C558B226EDF1790BE9E3FB7AD16B39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.3MB
SHA256 3d5e47e852593c53c04c0ed740d28fdf6e93c382d127f3ab3158da382d9fa4c0
MD5 b7445e58ff894feac0d8d6ae0157dc24
SHA1 ab010dd28ef987866f856f2990e05e5c23c56870
SHA512 ae9b3edefe531420fbd6dfe29844aaa812c583e2b49be0414fb4b2ba98deda0a9892ecfd3588b5c28cef494959a2f7b710586f18b7576e386e488c241dcb05bb
SSDEEP 49152:wabH/KabH/FPjH+PIjGhtSn8EApI0fig1giDn0AP5w2:bbbHX2iwphX
TLSH
T150B55B12B68400F4E066C5759A15852EA9227C25CB239EDF13807EDE7FF3AD16B39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 965KB
SHA256 13cd3f5412f70e3753968f3c555e1499440901d4f12ad1dfef86c719c7fd36ab
MD5 4c7f43c7f565abebe846c34371cff58a
SHA1 aa260ac1505432d79181b52313e1d8c8c4b55500
SHA512 d4be085203bb6eb49800f57b1e9385d0cb609ac8115ae811bad8eb3698d0c42ff03b7470452c329252b9e6e81b442f7e0ec59e801226d8a10c85e518fefbf3bd
SSDEEP 24576:w4R5CIH/7/S4R5CIH/7iWDPjHg9PnNUcQjriLd7:wabH/WabH/FPjH+PIj6
TLSH
T1C7250711BA804075F07289756825820DAA267C75CA638D4F73843ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 965KB
SHA256 12725e4e95bf60d50b4e0fbaf2633d83d3cee5cb936c7f2a6d541d673c673e82
MD5 513f657bbe78a504f356c092e855c3ff
SHA1 4d603e2c3b9abbc009feb6ab5ef868ff014d9153
SHA512 36680a0fe030def7a9e8d103e54024cb576a2d8b2487a96428bd8db9ca6b9322cfab92a15695b2badca01c2d3749e2a7bad529de6006199469e224949c5ccece
SSDEEP 24576:w4R5CIH/7hS4R5CIH/7iWDPjHg9PnNUcQjriLLx:wabH/cabH/FPjH+PIjW
TLSH
T1D1250711BA804075F07289756825820DAA267C75CA638D4F73843ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 965KB
SHA256 e920a68176776e4bfdd4de4359f7d16c1efeeb9af98416c6e2ae5f7433698d95
MD5 51e9de8271338c7345e992f8d28db932
SHA1 379d873fc08b42e95e1896218a5135618114febb
SHA512 c1fabebf9a32a72da7757bcc06b4a9a8ac4b83725b7db562b218b016f55f5e5d234cf472277cd9743ae46d70c982468f276f719141f5ca7269ff4378e5c75bce
SSDEEP 24576:w4R5CIH/7/S4R5CIH/7iWDPjHg9PnNUcQjriLNs:wabH/WabH/FPjH+PIjB
TLSH
T168250711BA804075F07289756825820DAA267C75CA638D4F73843ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 986KB
SHA256 83a7bac1c80dcd10630511effd8fd8424105a66ae3b144bf382e8cf9101deed4
MD5 b7b4885c9ec03a317a245e472ad58c43
SHA1 bdb023335e426af83c3149d17cc29cadaa745bf3
SHA512 b83409b37c56b80a96737eba678839a369c35af1d1c125cccc75d8d3f3720c030e59660101f6b7c1aa2fc09881459edf22c4b628bcde6359ce47c247d8c20810
SSDEEP 24576:w4R5CIH/7RS4R5CIH/7iWDPjHg9PnNUcQjriLz:wabH/sabH/FPjH+PIj0
TLSH
T183250711BA904075F07289756825820DAA267C75CA638D4F73803ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 965KB
SHA256 697d8dd66c8037eca2c851853baad35a199e693a3c0302613a123d939029a9db
MD5 24952cff487e715a546e4d622d198051
SHA1 ed12c421d87b4904383f9b90860c47663e356a54
SHA512 1df0f93de27ed790a546993653ffb74b323f17bf18856604d93979c73869b15680768e38f51aa00470e9451cc1973167f878f02462553bda90f90a613706ff5b
SSDEEP 24576:w4R5CIH/7/S4R5CIH/7iWDPjHg9PnNUcQjriL0Z:wabH/WabH/FPjH+PIjB
TLSH
T15A250711BA804075F07289756825820DAA267C75CA638D4F73843ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.1MB
SHA256 a6976ee1bc60f7fc7488c0710df139dd1e43f4be80328c0aead35923169b4e96
MD5 6b1d3c943d3bff59669156e440e32d36
SHA1 a575506e02beace4a2c315014a903a0240fc59de
SHA512 bcf398716238893903248f1654ed55a2f5f7e2c6a9f1ff910b435d8d96fe22ebd26f5b4eaa84f6bda384974d90ad09e7145233d1b3c8c506ca7d866b50251be4
SSDEEP 24576:w4R5CIH/7dS4R5CIH/7iWDPjHg9PnNUcQjriLtD:wabH/IabH/FPjH+PIje
TLSH
T1A735B411E6404075E06E4935DB25850DB6273C64CAE38D4B22C0FEFEBBF269269E5B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 998KB
SHA256 69f70b0af240f912cb6bf8e883d576a8ef5423b74826fb990741b18988419148
MD5 552eb3ffe9cf2cc60af333e461539f23
SHA1 388ac42fd2200b6d4a1fd9279e8854f1e388c757
SHA512 9bb77b5183fcfccd1351164826d978bc5331e256639f8b68973abc7af2b79fe4226fac58b8061471695640e8ea0eb88a202cdf48f1fcdb7d606e9a8aa75771f3
SSDEEP 24576:w4R5CIH/7/S4R5CIH/7iWDPjHg9PnNUcQjriL5:wabH/WabH/FPjH+PIju
TLSH
T17C251711BA9040B5F07289755825820DAA267C75CA638D4F33843ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 1006KB
SHA256 259c94a2c575a25556880f5beda85b9790721a1204991070b7e9aa1ee366b03c
MD5 5f4fcc99ee07df96fb2f4865a952e65a
SHA1 a48a7f1ad7ebd4ecab3db3dd418daa2d80f1b5a0
SHA512 f81ec55a8337c0e89b1b3daeef08beff377b4c6c9c3ff6a6c1bce360fbdacfc4567a2b96b811646357673767156f790adc6ba508cfe762fa681a57b2a9faa336
SSDEEP 24576:w4R5CIH/7hS4R5CIH/7iWDPjHg9PnNUcQjriLbj:wabH/cabH/FPjH+PIjGj
TLSH
T110250711B68040B5F07289795825860DAA267C75CA638D4F33843ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 1002KB
SHA256 b214f63928eab670302959e8a94e541ce35c2e75b24c5885c5fd60ff95bb0cca
MD5 ba65b5c6219656839af1c9ee6bcd2ba5
SHA1 e0e129f11cb9a803d81b08a95d4784b744f67f63
SHA512 41113ae7afaf6a21f9890300bc6a6419793dc33955f7085eace63ed56b76cb58601c2153055a7e58bbcc3a3e2d1c1b9b6d69476081ab5e6dd1be01d77b17433d
SSDEEP 24576:w4R5CIH/7DS4R5CIH/7iWDPjHg9PnNUcQjriLZjv:wabH/KabH/FPjH+PIjED
TLSH
T101250711B68040B5F07289795825860DAA267C75CA638D4F33843ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 942KB
SHA256 d7bb9f23e47f7b8583200e935bc0cb16d1248f06c40501671cdf64bb9f2c29fa
MD5 9aab92b6a090f2b2db10ea140ba37dc6
SHA1 9e54eea298c609a17f3e9489e22f33d3307c539f
SHA512 7d657398801938a0475d202ea7d807dfcbb2b6b680b4179314bcce6bc5d7fc3337b485e0eafbb63384994384d799c1df1bd1899530ca3d4978ea17689674fb11
SSDEEP 24576:w4R5CIH/7pS4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/0abH/FPjH+PIj0
TLSH
T1B9250711BA804075F07289756825860DAA267C74CA638D4F73843ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 942KB
SHA256 0c834a2bde5498d533ced329ff878bc1c696a71bb93ba5446e7de6f796ffd774
MD5 bc335031f6b171061a62fcbaaf3a7c96
SHA1 b493443d5905e44ef6329955b71844e6e3d2ac7d
SHA512 1defd01be936cbc2cf17c128e2ec20fdd39f01692ea043027e99b5234df0b6ff6f9fdb45ccbd495776e95aeb9e24bd8d9d77e9261a3644b072266ec440bf4324
SSDEEP 24576:w4R5CIH/7RS4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/sabH/FPjH+PIj0
TLSH
T106250711BA804075F07289756825860DAA267C74CA638D4F73843ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 942KB
SHA256 6ec0ec382c0506a28a0a13eee104414346a996c32ef6f472a71a69cc2572d8fa
MD5 f5353cd20bdcb3e8f7f160cd9e8877e2
SHA1 4a79c9ce8b68096e3a7358823a40c2400f96f4f4
SHA512 4e376229f3a11e9458fbb101eb946eb74ac22dc218c9b39f8bf4c28f5b857a3bbf72ff4f32095dc154b626911d5a8cffd90a6084c7073ac4b645b051ecef0a5d
SSDEEP 24576:w4R5CIH/76S4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/9abH/FPjH+PIj0
TLSH
T16E250711BA804075F07289756825860DAA267C74CA638D4F73843ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 942KB
SHA256 d57e94d0e0c978dfbb96f84f9cc7b736634939fe93d6d4a4ac027faf0c69c417
MD5 c75f13d81ac6fce1a64255062aa2baef
SHA1 ac3cd54b115b3b64485281dddebd6814dc578543
SHA512 f1dae3806dc3c07fbcabce5761f905b2124deeb88bc3e1024f8fdb763452b6273bffc52c325ec0a43d5ab90f0a59ea706e45066dd6b4ee1ef760b0bbf220c756
SSDEEP 24576:w4R5CIH/7dS4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/IabH/FPjH+PIj0
TLSH
T13E250711BA804075F07289756825860DAA267C74CA638D4F73843ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 942KB
SHA256 2748809743731f0ab5fa278573fb4cd777253e1002aec153ea29371728fad2fc
MD5 1ee8219cc2bdf54cc4925d66e9bbfb89
SHA1 a502af8601229f3b1ebbcb684a71232e865af443
SHA512 bdac8b27d02f1c0a77debf067d9bb23db37a7a87a3223b5053db7e8e519b9310aac55ab8915beb253c8c73a987ca8b642b9210f577752ae3e80e2e8978cf194a
SSDEEP 24576:w4R5CIH/73S4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/+abH/FPjH+PIj0
TLSH
T1E2250711BA804075F07289756825860DAA267C75CA638D4F73803ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 942KB
SHA256 bfd49f29655c7c6b4d7114a3821b153798da045b58058fc63cb23a3d2c87f351
MD5 36d661bfe2a732c8e04988b0532443ab
SHA1 ac52d99ed43a40c96d36e7037be3b78d72a1cdac
SHA512 58436c81d363bbc8fa4e6160b59fee7a47c2874609927f597da977c03d6663b6287527001542788e3d3cc779417c0a933e36546cfc27c062658ea6047912f000
SSDEEP 24576:w4R5CIH/7dS4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/IabH/FPjH+PIj0
TLSH
T1A5250711BA804075F07289756825860DAA267C74CA638D4F73843ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 942KB
SHA256 c79fef8dd9180cd170a7f1367a6f3c522de1d62a2cc749aad1e5de1e27ed7c93
MD5 3e5fc65bbe5cd27d18283d473d33f035
SHA1 d19ad761503ff5238b61bee5d4519a253083c329
SHA512 0d45885469bcd43e0a439f27ddb8063a898c1ccb25469a977f073386aaf952c1535b22304787c1d20a43cea463692871949e9094a8451f5073193099e56e05ab
SSDEEP 24576:w4R5CIH/7/S4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/WabH/FPjH+PIj0
TLSH
T188250711BA804075F07289756825860DAA267C75CA638D4F73803ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 942KB
SHA256 958c9bf468b07c38653ffdcb10fe0068ee37e5f344a1c465091cffa9ff569254
MD5 dae99d76f2b4f9ad79ee5b79a9dfdb01
SHA1 6c325b53b706f982da77ff31dff4f298f7cece10
SHA512 6494821ee037ba3da5b129d4d93aa549b9dbf30ae070fb8438405c9df130f4247b91c6f3df59ad91bde2ce68f38b7007bb563a365bba36afbe61f4dc64d15a04
SSDEEP 24576:w4R5CIH/7DS4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/KabH/FPjH+PIj0
TLSH
T1A5250711BA804075F07289756825860DAA267C75CA638D4F73803ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 942KB
SHA256 38d1adb10acbb343e385566237319bad305be2ef06c0072b83e01a4c7a6dc5a8
MD5 2336ef4373fdc16bd1450d316c138184
SHA1 871185a64c89b42301a3d37d5bb5dfe510cb556d
SHA512 e3aa290351b03361d99b01662fca13d2ad5e724a968d9d2755b500fc9e75796b7b9e02d1e690631b8d006465029d90d559f7568f47c6f6492992bd192362de24
SSDEEP 24576:w4R5CIH/7hS4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/cabH/FPjH+PIj0
TLSH
T19C250711BA804075F07289756825860DAA267C74CA638D4F73843ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 942KB
SHA256 3cd96e98f66505fd32d7f6017679c7884248c1411f5dea92012add05b28d2166
MD5 8a04a6a980c348b75d54ec06e500ea8f
SHA1 3fa3f6c5dfa7b3442dd60abe7013d40806e4c555
SHA512 51d0b57ff09068bd58eea15228705554710eafbe3b6213a5d0437644e8c5313ae4d57a2a28ac94975f5546f87cbd7c9f6673e6d61116562c4e703324ac707902
SSDEEP 24576:w4R5CIH/71S4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/QabH/FPjH+PIj0
TLSH
T1B0250711BA804075F07289756825860DAA267C74CA638D4F73843ECEFFF26D2A975B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3720-71-0x0000000000990000-0x0000000000A0B000-memory.dmp

Download

memory/4704-86-0x0000000000990000-0x0000000000A0B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads