2659009bbdff7e63bb93e28a200da60976cbf050d057cff4c2179368b91b3ecf

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 975KB
Sample260502-yaz3psew91
SHA256 2659009bbdff7e63bb93e28a200da60976cbf050d057cff4c2179368b91b3ecf
MD5 6c69d98f8bba875f688152fd7d16b80b
SHA1 71732a873a76a68d8dc5d2ea7db926e8c03ba783
SHA512 16b3014fea12c5282e154eaf7ea1b9771d0092f16a1a81451431de87904f502d7f2a7d1bc6fb1c0ba1620754530bbea585cfce36cc7b1c0f7206ba2071ef3786
SSDEEP 24576:w4R5CIH/7zzzd5b20GU20Gom3NCdBTNsk:wabH//zhBNw3NCLT7
TLSH
T183256C52B39408E9E873C53999618516EA727C650B60DECF6380770A1F337E2AE38F57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
1160	UpdatAuto.exe
5228	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5632	sc.exe
3064	sc.exe
5124	sc.exe
5524	sc.exe
3952	sc.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2556	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
1160	UpdatAuto.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2516	2556	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	79
PID 2556 wrote to memory of 1160	2556	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	81
PID 1160 wrote to memory of 1728	1160	UpdatAuto.exe	82
PID 2556 wrote to memory of 5228	2556	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	84
PID 2556 wrote to memory of 2148	2556	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	86
PID 2556 wrote to memory of 2200	2556	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	87
PID 2556 wrote to memory of 1960	2556	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	88
PID 2556 wrote to memory of 3516	2556	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 2556 wrote to memory of 812	2556	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	90
PID 2556 wrote to memory of 5772	2556	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	91
PID 2556 wrote to memory of 5000	2556	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	92
PID 2556 wrote to memory of 3064	2556	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	93
PID 2556 wrote to memory of 5632	2556	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 2556 wrote to memory of 3952	2556	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	95
PID 2556 wrote to memory of 5524	2556	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	96
PID 2556 wrote to memory of 5124	2556	2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	97
PID 3516 wrote to memory of 6024	3516	cmd.exe	110
PID 2148 wrote to memory of 3324	2148	cmd.exe	111
PID 2200 wrote to memory of 5280	2200	cmd.exe	112
PID 1960 wrote to memory of 3880	1960	cmd.exe	113
PID 812 wrote to memory of 4188	812	cmd.exe	114
PID 3324 wrote to memory of 1084	3324	net.exe	116
PID 4188 wrote to memory of 2192	4188	net.exe	117
PID 3880 wrote to memory of 2296	3880	net.exe	118
PID 5772 wrote to memory of 2936	5772	cmd.exe	115
PID 6024 wrote to memory of 1820	6024	net.exe	119
PID 5280 wrote to memory of 5264	5280	net.exe	122
PID 2936 wrote to memory of 348	2936	net.exe	120
PID 5000 wrote to memory of 5704	5000	cmd.exe	121
PID 5704 wrote to memory of 4224	5704	net.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2516
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1728
- C:\Users\Admin\AppData\Local\Temp\2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  PID:5228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:1084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5280
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:5264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6024
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:1820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4188
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:2192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:4224
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3064
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5632
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3952
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5524
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.2MB
SHA256 3a6c3a1900f6265c1e66b35be65a70174c93686e7ee57f7c99c23c2a8834f00c
MD5 22371f75d8c5a54c4972c8fa9af877e5
SHA1 0bc1a70d548499d41724b6583d85ff88fee682f9
SHA512 a1c517f9e0a186c814ea2ea2c56a7def5edfb8f2698b9f45b044afb4181217e46a75da8f3830d8806de5b46264849ef20e3ca3bb25c0b851821a469a91b72b6e
SSDEEP 24576:w4R5CIH/7Vzzd5b20GU20Gp0Le5ji0hmxNrM:wabH/5zhBNaPji0Aj
TLSH
T1A5553B12F6A44675E073C179C5E2964AEA313C510B30DECF5385A72D2E37BE29A35B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.6MB
SHA256 c8f13bcf67dae91ffe94ac78aea2722b14aec65824684fb29204f5c2d1a13d71
MD5 51dacf3cad105bd9810e3fa95798f3d5
SHA1 7afbf2a765f2e86579beb9aa9eb67ca021b6bfbf
SHA512 18b432f9520ea4a391b4e389a21e90280b497173a3a02fac59a20af61585a332921f3697eef23367005309da08b22a00f0bc90899ba2dd39b76788a54e381c9b
SSDEEP 24576:w4R5CIH/7Vzzd5b20GU20G7a7/ezSC6vUyD/aqgrvWx6q8wyu:wabH/5zhBNd/ezSC6vUzPvMHjy
TLSH
T130850A15F6788327D0B3D0B9C5D6A659FE3238460B3089CB5346A71C2E377E19A35B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.4MB
SHA256 fb3de2e455242db130d1362add94289729c5429616b157bb797e4a2ebcd6eb59
MD5 0009790bfcfc885f12b0ff690f1d345f
SHA1 c80c8c587a478a9b58c51bd5998f37706f7ae9ac
SHA512 d88132b8c466e62cd76e320ee615182effbd84d9b7e7c00b4a8239af6e73107436f15c78c3e1105b10297a809ee56cff2d3e118341d80f9949353a833e229868
SSDEEP 24576:w4R5CIH/7gzzd5b20GU20GdVbqPb88hv/l+7:wabH/czhBNSVO88hXl+
TLSH
T171652A52F6A48265E073C179C5E2965AEA323C410B30CECF5385A71D2E77BD2DA35B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 718KB
SHA256 52f1a8857c2447d802560d79dd2c642c64fcf68b3f56c5810023890e001514f7
MD5 75bb3f17c8668744c211742873cd87a5
SHA1 7a24ad9fc9a66237bb6c0b18e0b091a0f238215b
SHA512 9f660f5ffbc2ae2117b5bdb6dda571feefb826f3db76f229cfaa032cacee23f348123c6eee4089bf2a82834fc8a4f174ed8d68081cc20a0472637a5d582f86f1
SSDEEP 12288:w4Ryed8I7r/7mpBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUja:w4R5CIH/72zzd5b20GU20Gja
TLSH
T12FF45C12A39404A9F477C57569718116EA36BC610B20EEDF63C0770A1E36BE2BE74F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.7MB
SHA256 c92c3302837b60c72b1c24261aaddcb8be51ff056ea59aad4ceaa52573c4eacd
MD5 c13c303a936de1164cc0e8dcf2953685
SHA1 17bd69f86a8205e603a1fc1998799784cd5dcc35
SHA512 2f191bfee689c26ebc502ec1a2b3246cd91f2c6f92a052d2fe791894302516950773bcf6c9fbc8223a284aa696be61f3fff8119e8a9b4c3e06b36905a4411d32
SSDEEP 49152:wabH/RzhBNZj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMb:XyQRQyi36YOcP+Lvw2gAf+PN34
TLSH
T174666C13F3A501E8E05ED974CF3952229B357C4A8BB093EF259436E51A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.7MB
SHA256 4a776e67f61c180f7c29f3563d4afba099c9a6e864f7d607ab16b2a14d82039a
MD5 b1763bfd6b3174e807db5e1bac319210
SHA1 3e2f51657a6ae649d9634a4554ad0c84335cd03c
SHA512 7b489d47d6c61028ed4f4dfac4658534857faec1b601cd160bd324acea1ddb1527736e76fb8362f68d78c35c80be7cbdbb1e60ccb85d4b089afc02419b8c0089
SSDEEP 49152:wabH/KzhBNZj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMb:cyQRQyi36YOcP+Lvw2gAf+PN34
TLSH
T1DE666C13F3A501E8E05ED974CF3952229B357C4A8BB093EF259436E51A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.4MB
SHA256 99da6d4ed415fddb4904af96e57da0050503887c4611190ecfe98cfe3c54c295
MD5 6235e3f379d07ae57bbcd656135a93ee
SHA1 8ae2be2b0ecfeb3cc5d5f885aad72e0e554a656d
SHA512 b44d5a23f85560fce929639401afa7f706220ef825b96cfc45307946e76d1c7b699b7f6d345b04bbbc2593358cb7c6386efff918b2e5c35c21defda490601bb2
SSDEEP 24576:w4R5CIH/7tzzd5b20GU20GSwvLof6SRQ+rn/fDboqxN1nnh6z7DaHGTNHu7PNU34:wabH/RzhBNN68Qg55nhoeWu7PNU3/Q
TLSH
T1B0C53933B2E200A9D45ED1769F56872196E17C718FA0E7DB8241730A1F72AD07B39B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.1MB
SHA256 afc4be98cabbc1e980add3ec0efbc0eb60eb3791c7c5e690d4a126421070deb7
MD5 25961d7430cb81419c3bbe8dda24a727
SHA1 07048c7481afe0fe6c828b1a2fa889d17fe9bd60
SHA512 5397650d684dbb43371c1bee5c488a9963e18eb08b947bda9272142a90af293a3a002421e7ab99c6b8f9e7cd5eb6894b496ebf55e0e0f569b39146489a370b90
SSDEEP 49152:wabH/RzhBNj3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgN3Oh6tznm2FQ/i:Xsy5112gYy5azzVvf69nLKnhZO
TLSH
T173167B13F29900E8D05AD179975A8232EA72BC524B31B6DF0A5077162F7BEE46F3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.0MB
SHA256 fe477baaa5299f2e76f35ffcc938fdff1a3c5ff74a6f24a12fc54154524c6f52
MD5 71ce824b49988aeea87a0da706021c6c
SHA1 fd9ed21b2d2072b2a66cbeafe482b486317b80a3
SHA512 61e63117eea2581aaacf7428c962bb4820692447c75b44d2d0027a029d80ee3e24e069766feb0bb0c03f1dafa0a766ddcf8467ecec982072e86e484bc5385b6a
SSDEEP 49152:wabH/KzhBNuB+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:c2u6Jm0xd2d3
TLSH
T1BCE57C13F2D900E8D06AC57897569132EA72BC590B30BADF079073562E77EE4AB3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.3MB
SHA256 370d8e74f08e81a497c53504c0e33972249e908ed37dac2dbbf968eded6e8bd7
MD5 333db885085eb2847f409b07db94d534
SHA1 4df587d06495de7abbac0e8c1ab048951a696249
SHA512 21edf52766455db50220c84ff849ffc972655a10d1bf80488832cc3910cf01b9008ab0b30232477bd254d9fd7cde8897b88a422fb7c8c000cc3c0aede3eb1889
SSDEEP 49152:wabH/RzhBNQ1hpsNoJpF1A6GU44CwH7R4xu:XemifP5R7
TLSH
T147B57C13F2D800E9D06AC5799B568222EA72BC550B30AADF0790775A1F77BE06F3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.5MB
SHA256 c8841c9ac3532c1e42e7f50658071a1857f3f81e836c0c0b80f6f27c359dcb5e
MD5 b12c6837dd203ef8c6b8730850d9dd3d
SHA1 f9057f9c677a16797ecd44fc414f81a746224660
SHA512 3539a4e38f1d81576af2b6c2bc21b7b4a7b9d88924ff29e8dc9518193552aeefb394152630e26409068333f7a8104bcadb3b4b04bb9a04ded85f1486dd8bf3b9
SSDEEP 49152:wabH/KzhBNtSuZQIY0Be2K8RVtOnks6NMHq6:c95dKCi616
TLSH
T1D5C57D13B2E940E8E0BBD57497658126EA72BC550B30AADF078072591E77FE06F3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.8MB
SHA256 4b19a30ecf8ee7212d8dd71f4586e0f02aa3a077075a26f6ebb8ffebd345d38c
MD5 c5e63ee73173fafd743a75aaa260d0e3
SHA1 26ea12414169c378c1963b48bf7456df7d5e80c8
SHA512 9dffd8014b3f9b5e6f5b2451de2a85055803e21789007316422cd22c7b84569fcd02f3fdcd3d3ef90e9081c11a2bbb1ca417d6e89d2bf8b5cb354662c63d3d9e
SSDEEP 49152:wabH/RzhBNyyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AX:Xvm7vj1BDlZG
TLSH
T18F068D13F2D940D9D06AC07897568232EA72BC554B30AADF0790BB562F77BE06B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.1MB
SHA256 d3b32c6b83e8ab8ba82acc2e1ca589c5b262d49c3f2e8ce751f9b451e3f206a2
MD5 1ed5bf5bf01f8310810954b1043c0060
SHA1 eb632e85e0a7af05943d0f144a559702f219e538
SHA512 c2e6096a80b76c0325e461ec5adfb2f57657011e8de2db2897ebc72881dab684c9e99334e8562634c04fcfabfdb628078acee5a418238dd7ad0d2a8732cc2051
SSDEEP 49152:wabH/KzhBNrhtSn8EApI0fig1giDn0AP5w2:coX2iwphX
TLSH
T1F6A57C13F2D800E9E06AC579DB568522EA72BC150B34AADF079077161F77BE06F39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 728KB
SHA256 90607fbfc1b5b04e56be3b52eeea75926341d04f497417569a6ae5006e59ae17
MD5 2f494e6ad2fdd4f8cd35f2f315297879
SHA1 85aac22fabde24bc2df4cc7b0b226e1d8cd77d8b
SHA512 e8bb392622cd106713e647589844e1ab02c04a596cd8fd2befa4a72b286a803fb919f4fa68b24c5591b22857e0a459391f5e249a0ad859494d7fb6aef675dd0d
SSDEEP 12288:w4Ryed8I7r/7meJBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUw7:w4R5CIH/7Bzzd5b20GU20Gw7
TLSH
T1ACF45C13A39404A9F473C57569618116EA367D610B20EEDF63C0770A1E36BE2BE78F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 728KB
SHA256 0d9e968be907a0e009c832fa1323825dc3ea05791af0f1b145e4921e9f54d718
MD5 52f33dd80fbfc63c9395ad6df326ff41
SHA1 8472745dc1a039e63d6992445e2308b0e59efb84
SHA512 34dd6fa528d8ff59b31a59059e68c1023a2141bae5e1b5eae9a987cdda0b778b323768438c16c92a816ed62acc56efdbdb6694aa7a162c767cbfc179a78434d4
SSDEEP 12288:w4Ryed8I7r/7mxBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZU+x:w4R5CIH/7+zzd5b20GU20G+x
TLSH
T1F0F46C13A39404A9F473C57569618116EA367D610B20EEDF63C0770A1E36BE2BE78F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 728KB
SHA256 01a36d404233b9318694837651cbf160b90a6cac77fba0cb1127b24350019d40
MD5 3a7c340b43ecc673bd978eab395227e6
SHA1 862013d833a570da6d20a73580cb9abc51dd8417
SHA512 528c50affab1e50335eb188fc9fdd2d68021b63b673bae82178e4c6b21e102a5662a2ed507102ca3e047fcaff18a0e6b74881855d458cf131939834e7ceaad59
SSDEEP 12288:w4Ryed8I7r/7meJBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUss:w4R5CIH/7Bzzd5b20GU20Gss
TLSH
T1F1F45C12A39404A9F473C57569618116EE367C610B60EEDF63C0770A1E36BE2BE78F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 748KB
SHA256 a53aed27776504ab17eaebb44bf8d6c27b7da6d6e119331c0fba51d06a3903c7
MD5 1bbffa5ee4aafdb9033d0a428fca5864
SHA1 d65884d1fa39ab6c86e8d2f65994a28d3e31c4a4
SHA512 aff3ce2ab0d8f4099eaab5362417023d082926374754a274f11e11bd5f31de6429745ef5e87a0e9743457ae96a3fd0db6e916be0dbc3e38e1cd2229b60e3dadb
SSDEEP 12288:w4Ryed8I7r/7mBBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUxVc:w4R5CIH/7uzzd5b20GU20GY
TLSH
T10CF45C12A39404A9F477C675A9718116EA36BC610B20EEDF63C0770A1E36BE1BE74F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 728KB
SHA256 6e885871bcdfee925cac1a821f12874627e3d5d7735e2875d95cdf15c8c348bc
MD5 ecc45a34f7c0950596d173f4763bce76
SHA1 b50c4719e51cd911dfdff2aa0a75d3d13f46918d
SHA512 8a26ffd72005d1bd7f1b124a04a8c278055623a839809290684038a33425cff5f7f895e8ec6c2a00746d7f10040827238d7ec04dea7030de0a601d7cc695c17e
SSDEEP 12288:w4Ryed8I7r/7meJBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZU7Z:w4R5CIH/7Bzzd5b20GU20G7Z
TLSH
T116F45C13A39404A9F473C57569618116EA367D610B20EEDF63C0770A1E36BE2BE78F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 848KB
SHA256 a4de1e7a9b9924f49d7cb26f3cf15b57de4cd3491f8c33fa200e17a1d51cb50d
MD5 d6b689867b5b7af4c9696396bc7909d8
SHA1 5ecdf0ee6e5268fe5aeeeda47aa342f45223eb34
SHA512 498d25c33aac1b8855c44baa5dda572f6e46177fb083ae66aa325f681a42e50aeec1f8d7d4a4018369c22697748d373c034b5c7cb833fe943a4d1d4de35d5d41
SSDEEP 12288:w4Ryed8I7r/7myJBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZULXsf3z:w4R5CIH/7Vzzd5b20GU20GqD
TLSH
T15405F712E29404A9E46E8575DB618111BA377C6107E0EACF63C0F63E1F36AD1AEF4B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 760KB
SHA256 809bea3f6c788857ac57ba03bb758db07f4504610f5d84f6737f53384039357a
MD5 fd9410953aa7c722526d5137bcba18c2
SHA1 e27bea5816f7f00d0e706e8e4be182db00c738aa
SHA512 3646a227a24acee725c586d3bc53bb989fcd9e522c7b455ba0f9d5c42ee3d09bbcb7ec1b9e66148c270a95931396aae58ffd76c67f0ddcf23894d14e808a101d
SSDEEP 12288:w4Ryed8I7r/7meJBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZU4r:w4R5CIH/7Bzzd5b20GU20GC
TLSH
T145F46C12A39404A9F477C575A9618116EE36BD610B20EECF63C0770A1E36BE1BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 768KB
SHA256 20546bafcf001a9576afeffbdbfb22119dc6f4faf4c70b93d6c09537234f354b
MD5 855f8e1bb1a89e5cace1d7915b9be13d
SHA1 76e83d7a396e5bec198eddfd5af7beb0326ed7eb
SHA512 89e6d7fdc8c098a759a3a5e5d314e67ac96ac88cb1a089fbf3748b6905cbbdf891c750f4d4004ad2461ec860925c6b8e35c903e0e0239758af8cedf0775f10e0
SSDEEP 12288:w4Ryed8I7r/7mxBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUSqnkraG:w4R5CIH/7+zzd5b20GU20GSj
TLSH
T16CF46D12A39404A9F477C675A9718116EA36BC210B60EEDF63C0770A1E36BD1BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 764KB
SHA256 02bd72e8cad328757d213c9a14dbc4d8ad0a64fb391a3137bfe3a16e85d617d0
MD5 627eb3aec74fd9b664284bc1be9ce3b4
SHA1 ff27111c409a2476bce7a13ba3943d314baec491
SHA512 be7fd5dff9ff4425c7fe470859cf196de6b92a69ebe5897f4a03bb598c99e074e1328a46eb37b97002fb3cca8f054e4cf7c5ddb898a8ed8734286cbc22fabeda
SSDEEP 12288:w4Ryed8I7r/7mqJBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUIpIyvJd:w4R5CIH/7tzzd5b20GU20GIjv
TLSH
T150F46C12639404A9F477C575A9618116EA36BC610B60EEDF63C0770A1E33BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-02_6c69d98f8bba875f688152fd7d16b80b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Size 270KB
SHA256 f6db5b9217d190c6d8f16a95b67d2f26f1bff4ec79d95f00d3755f182cc8e5ca
MD5 4e61919354a60148cb77981ff58f5ef3
SHA1 74dc9d4189c09ee8079375d579b3a7ba6d561488
SHA512 852d5726b8f0df036ce75ef5b0a81981526b80a313b968a66aa615fd234be54ceed89f0e7d746e94549254afe988cb854374f5cdfb83516aed7ad849a930c626
SSDEEP 3072:NMZcwhYciHmqo3v7ro/2szqJ71rISTQt8UPDSzXZc22Pb2pEx39TBf/uyfWIEICI:uZcweFm37cxzmRHUPD65Mb289TBnXvks
TLSH
T14D449DA1B3A04CF4EDB7813EC8518916D6B27C5A06B0C74F13A836665F733611D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 704KB
SHA256 af79474f320d81de6cf217be46301c974ad77bd1b2ab9a93fb6e0ee3fe6c211d
MD5 ce073e5e96374bc03fff4c28da8eb455
SHA1 ac0cd7e224f1c976f241eb6e4655a6fb12430cb5
SHA512 32f3a53326aacf56e71e2a25dabdf90c6faa64a441fa1c31317069bf171116c1e7e015c8420d9619f0825d69be378ac0d2a394aeb6d3fb50b1d726eb153af033
SSDEEP 12288:w4Ryed8I7r/7m4JBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/7zzzd5b20GU20Gg
TLSH
T13AE45C12A39404A9F473C57569718116EA36BD610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 ade3f8c4579d07d644943cb1152685dc0ea1cb13e8dac3827aa3a49cd1246aae
MD5 fa5202b4b47607101955b36b79837047
SHA1 f56f23bdc30e745e837f5d4880114295d57910d3
SHA512 0ee2ebc14534da6f3f51ae33fa7f12be8c946a95d2fc35bd65deab03232a2133584a84ed23ef0215edbacf400db7976168eefaeb3f8e09d0f2aab45d02272cda
SSDEEP 12288:w4Ryed8I7r/7mqJBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/7tzzd5b20GU20Gg
TLSH
T10DE45C12A39404A9F473C57569718116EA36BD610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 21cbb51ebf21eadccb1e938faaadc9658b3be3ab787f681a6c5cb032c553b8aa
MD5 3199d526d3de678f2afae675b0ef4b2f
SHA1 6579b8939aa5ac0546cedf3a003071512cb718a5
SHA512 cdbf493ed0cd8d9eff55538301457dd7ae56e0aa3e4ae1db3c6124b3c5dc98373516da8c4d8d1f56afa09a1bd105118f86353d33017961d32e0eee41162d1974
SSDEEP 12288:w4Ryed8I7r/7mxBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/7+zzd5b20GU20Gg
TLSH
T187E45C12A39404A9F477C57569718116EA36BC610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 cabae950e4303b2a91dc79f85681705439c00ad6da4af79b9f039c93d0c65a5b
MD5 adbda414646d175cb81f82315762e1bf
SHA1 c439ae17b51eb86a822a562ac44b29a742e3f336
SHA512 20655a4e9d02b138e78dc93bc60888fd6f77b01dace124d39918c6791c124e20291993ce02236f6e129ca1d03401b45e4c4305a9f2b47300c27401c0744d9151
SSDEEP 12288:w4Ryed8I7r/7meJBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/7Bzzd5b20GU20Gg
TLSH
T12CE45C12A39404A9F473C57569718116EA36BD610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 01a26d3ed24d41a3ecbd414416d1404649520fbef8402d7c8984744e14f7bb30
MD5 2038e4855e0a56bdc2d3e9c68a677b9e
SHA1 daebb62085732193374de9a3c74d60c7a57a3305
SHA512 c0fbc370adcbf1eff194161681c663afb98d387bae95a7de1318daf9f40b13e9aa88bde386c345a09bc518f64150e5e68875afa271585db3b45f5d73c0a91078
SSDEEP 12288:w4Ryed8I7r/7mBBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/7uzzd5b20GU20Gg
TLSH
T10FE45C12A39404A9F477C57569718116EA36BC610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 5454b1cadb029a154a7ef5b187a6107ff5fd82da475c61da217231da161116aa
MD5 b7c6842b6cb5f2b79c289b1cc6a99c0d
SHA1 3a3fed28c713ad0504eceff1b6669e8cda6d1b61
SHA512 5b92da8d333eafaaf364c0dfe4688890bfc268d0727d06ab8958b4970a8d10048d179c06c3b7cf8adf81a88b6e08834cbdb5394de5536d3beec2c99c0dc2077e
SSDEEP 12288:w4Ryed8I7r/7myJBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/7Vzzd5b20GU20Gg
TLSH
T1BBE45C12A39404A9F473C57569718116EA36BD610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 267cb51b94790596bb191e506a92583799694cf395efad2892cd6b089c7a03a3
MD5 1465e15a3244e75020bfddca7cd4c513
SHA1 206e02b025d99d3001a913d45ef97beab05089fa
SHA512 62392a5abd3e6e111178ffc195ca85ce8c44cf28904e0628cfea12dbedd61525ab3b99bd0128b221ba181e896c9efc2b85165183cfc808bf5253336edeb6eda0
SSDEEP 12288:w4Ryed8I7r/7mpBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/72zzd5b20GU20Gg
TLSH
T1BAE45C12A39404A9F477C57569718116EA36BC610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 2bb4343ac3a49ae941d987a08886495a090d22904fc129f8551f6ea780cee1b2
MD5 19d0e3339df93c487883cb2d46f06d1a
SHA1 500a6d0876860cc6108df13d1bec24a3096c0071
SHA512 f7f9d52b610903c5898bf6d92522a8e071d9d98c284e9ec2e624b1517d9c4043e54bd328362e7118873b0e38bb5a1c2a509778dc75d6de55a23527417eea5a95
SSDEEP 12288:w4Ryed8I7r/7myJBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/7Vzzd5b20GU20Gg
TLSH
T154E45C12A39404A9F473C57569718116EA36BD610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 faa654346cc7212995bdafa1e411381a514df87aa2460650a14011183d6e5944
MD5 fc63f63bc75c87d13245024264afa5a4
SHA1 da19d3cb04d7be2ee8e9786ea71ff284f899e5d2
SHA512 82d03db2c66fb552e9346fb57bc66a1b056c1b0746f096d143c38fa12bb7aa614bb8beaac0d7cf630b30c4da5af3cfd513694e34c94b704d178950a4d1fa1be7
SSDEEP 12288:w4Ryed8I7r/7m1JBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/7gzzd5b20GU20Gg
TLSH
T1D9E45C12A39404A9F473C57569718116EA36BD610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 704KB
SHA256 b01d75e3281a1b04f0baf11d2eaa9df2214c0ddb18c35da66cb52f50bf5d1f47
MD5 7ebac8859e0e2bc7629d5c52b916dfb4
SHA1 6237fb77f9fd5c56fd91dd0b08c2d9e9c66f345d
SHA512 57179ac0942620a3f9300305379a640714e60e4439da528a1f6dcf40f0960c871124a9ca0b6114946051fe11db00da44b52e0a6f8de4962cb70df920813a9757
SSDEEP 12288:w4Ryed8I7r/7mqJBUcnhzd5PL1fh7NhO0ZUgL1fh7NhO0ZUg:w4R5CIH/7tzzd5b20GU20Gg
TLSH
T182E45C12A39404A9F473C57569718116EA36BD610B20EEDF63C0770A1E36BE2BE78F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1160-107-0x0000000002020000-0x0000000002084000-memory.dmp

Download

memory/2556-97-0x0000000002140000-0x00000000021A4000-memory.dmp

Download

memory/5228-33-0x000001F8C4E00000-0x000001F8C5070000-memory.dmp

Download

memory/5228-43-0x000001F8C37C0000-0x000001F8C37C1000-memory.dmp

Download

memory/5228-45-0x000001F8C4E00000-0x000001F8C5070000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads