84b13afdbea2b770625d83a4d97c09e902cb9410830ffab51522962179e6868c

Analysis

max time kernel
150s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
Size 4.4MB
Sample260503-sp4fsab15w
SHA256 84b13afdbea2b770625d83a4d97c09e902cb9410830ffab51522962179e6868c
MD5 6e1f62a9a4d732bc10fc204cf070f330
SHA1 fadc861d54bbe4863bfadca3f78c2982918a03da
SHA512 2ad9a78a4002f48a16992690255ffccf8f471e2d50e53e5b38e09bea2363b9affa4c506a87c36bb24297ec549ad59ea369a61440b651dc0a73ca0ba45c753283
SSDEEP 49152:wabH/pabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6D:SdrZdrM0oAaldmdmnp8Tp9I1H
TLSH
T1E8265A13A24444AAE19AC174DE56C232EB217C6907F1A9EF33807BD53E73AD17B39706
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
3884	UpdatAuto.exe
1724	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re~4.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3516	sc.exe
4720	sc.exe
3480	sc.exe
2864	sc.exe
2480	sc.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re~4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2428	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
3884	UpdatAuto.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 1792	2428	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	86
PID 2428 wrote to memory of 3884	2428	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	88
PID 3884 wrote to memory of 4728	3884	UpdatAuto.exe	89
PID 2428 wrote to memory of 1724	2428	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	92
PID 2428 wrote to memory of 1784	2428	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	93
PID 2428 wrote to memory of 4400	2428	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	94
PID 2428 wrote to memory of 3016	2428	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	95
PID 2428 wrote to memory of 2696	2428	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	96
PID 2428 wrote to memory of 756	2428	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	97
PID 2428 wrote to memory of 1736	2428	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	98
PID 2428 wrote to memory of 2888	2428	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	99
PID 2428 wrote to memory of 2480	2428	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	100
PID 2428 wrote to memory of 3516	2428	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	101
PID 2428 wrote to memory of 2864	2428	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	103
PID 2428 wrote to memory of 3480	2428	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	104
PID 2428 wrote to memory of 4720	2428	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	105
PID 1784 wrote to memory of 4068	1784	cmd.exe	117
PID 3016 wrote to memory of 4512	3016	cmd.exe	119
PID 4068 wrote to memory of 2396	4068	net.exe	118
PID 4512 wrote to memory of 2112	4512	net.exe	120
PID 2696 wrote to memory of 224	2696	cmd.exe	121
PID 224 wrote to memory of 2412	224	net.exe	122
PID 756 wrote to memory of 4448	756	cmd.exe	123
PID 1736 wrote to memory of 520	1736	cmd.exe	124
PID 4448 wrote to memory of 4908	4448	net.exe	125
PID 520 wrote to memory of 4932	520	net.exe	126
PID 4400 wrote to memory of 1944	4400	cmd.exe	127
PID 2888 wrote to memory of 1140	2888	cmd.exe	128
PID 1944 wrote to memory of 3932	1944	net.exe	129
PID 1140 wrote to memory of 2024	1140	net.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1792
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4728
- C:\Users\Admin\AppData\Local\Temp\2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re~4.exe
  2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re~4.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1724
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4068
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:2396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:3932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:2412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:4908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:520
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:4932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:2024
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2480
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3516
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2864
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3480
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 4.8MB
SHA256 139d6a1ad9f5a8cda9562424d3a6514efdc2334c1b456613a0aa3b798386ffcf
MD5 28d5928256473cf4e47aca568db8c867
SHA1 112d9d1f2fdabeb9702d58e91ca9ca619cc2ece0
SHA512 f2ba2c2e85a19d672e547bf2eda7f67cfedec6e354c792ce0fdbad20c1d7eccf41fb57634e4271e9c455b77ce809601ad50886e318725a5e71fc6b361854798a
SSDEEP 49152:wabH/FabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6q:GdrZdrM0oAaldmdmnp8Tpejo
TLSH
T14D364813F25444AAD05AC078DE568226EB317C5907F1A9EF3380BAD93E33AD17B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 5.2MB
SHA256 44a9c30405255c2f074085aa876c2b25a2495b2ea4258699b1793a486a2a601f
MD5 8bd222148a9749e7b0e330fb057cc102
SHA1 79119cd5e504977fbf837fa9c912bc2ec76aea35
SHA512 0d1d70d254e00e5ba62ee7864d69819edbdba501bcaf03a826b7764044de543ff4bfd1366e3ddbecb76619014ce25dded734e4ea6ca551daf2a740c930dbd7dd
SSDEEP 98304:GdrZdrM0oAaldmdmnp8TpDezSC6v2XMH:urTrpKmd0KTpQ
TLSH
T125464913B26445AAD0A6C074CE969226EB313C5907F1A5EF3380B7D93E33AD17B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 4.9MB
SHA256 9149255366f48aecac961b940319c807863e2455976dd4eeba2bb8b3645b6149
MD5 47f5e502d8443a0807a70f6abc108fed
SHA1 a331e838f08dfe341ea593c88b70d2a91f7ce65b
SHA512 b9e416148c7a5e96d925dee3cc4694c26cc6d42276957eee271eae0cab0765af1fac28fe39163a0d4f0111ee7a80f4f30f4d731daf33f932bd5b0e0a96d600e0
SSDEEP 49152:wabH/IabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy69:FdrZdrM0oAaldmdmnp8Tpb/h1+
TLSH
T186364913F25444A9D066C078DE568226EB327C5907F1A9EF3380BBD92E33AD17B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 4.3MB
SHA256 4c59a8cb082b855f7ed2a2979708083717be32d2b555246adaa10619b0319b51
MD5 d0f1053adf8d6e234c077feaecc36f4a
SHA1 223f099745a02aadd9ddeb3f2d42ecbe7371cb39
SHA512 731b9450c8eb674ed9cced3a7c881865c946f612593cb2ab9b5839baed62c858aa0adb1ff3b91e01c81ff67e72708b549c6062ece8afd59221428b436e73d0c7
SSDEEP 49152:wabH/wabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6W:ddrZdrM0oAaldmdmnp8Tp
TLSH
T118264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 10.3MB
SHA256 2b35546fffcd5df45d252d9674ad0d9ebca23db3a0a166f2a6db34e4c1941982
MD5 aa9c9105a8af3f66fe41ca3bf7880f25
SHA1 0f34b4204dbdc2b9da415b4ae7ff57202b4f66c7
SHA512 0987d7650bab7b57e77483d39a4e0aae8677b94a84dd8dd6ce46646b01a470897cb6403b4ba2fb46cea1c5c23d9d15a11028877c6dbb907e3ac46729c0dcff5f
SSDEEP 98304:udrZdrM0oAaldmdmnp8TpSQRQyi36YOcP+Lvw2gAf+PN34:GrTrpKmd0KTpJQyiKaUX+PNo
TLSH
T117B67D13F2A540E9E05EC574DF2992329B317C5A47F1A2EF368436E52E72AD07B38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 6.0MB
SHA256 e9291e7f099cd2073c867e73eec9bf324ba63eceeb7d95e35043621b5a38d76d
MD5 9fceaf9ff84906aa3451754dae373feb
SHA1 0924d02fb7391bf0a8370ae3c9348e06ba94aa5a
SHA512 933263e4789f5e57d3abc7a81c7a58c784601742ae27e4bc0db35f8a88913447950a26c25fbed9ff9742dc6a09c73ccfe634d2967cd1c94658eb21a761941861
SSDEEP 49152:wabH/tabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6k:udrZdrM0oAaldmdmnp8TpdthHRc/Q
TLSH
T1E5566B23B29504E9D04AC075DF468232E7A17C694BF1A6EF628077D52F73AD07B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 7.7MB
SHA256 25f62a4e31057ba1df459420952d9c7f3d2467407ee0a9a2d40bcfcdf1ba9f3c
MD5 c66c6aadb9d995ff683d388447633c2c
SHA1 fc268bbe46360e05008d629b791ccc5caf6305ab
SHA512 d272c8bc3a390b0501c05791be2d1214255d4ec6093cc49eaabf091bdd72023f9674e7a335d9919ae70371850ce75f7d02a37e01475f73eb07f325d2a7350f4c
SSDEEP 98304:udrZdrM0oAaldmdmnp8TpMy5112gYy5azzVvf69nLKnhZO:GrTrpKmd0KTpNLIHuWhs
TLSH
T1D2867C13F29900E9D05AC178DB468232EA71BC5A0BB1A5EF278077D52E77AE07B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 6.5MB
SHA256 4df3b8807b5cb5fff72b00e0ec06585337cd5ddc41a88a19bd52d65f81df808d
MD5 4628ceaa2c59089cd62f7430f6389470
SHA1 fd3d714c7f40823ac0d236124da10152d788f0fc
SHA512 f8390d34fd1f208743173e91e92e4d9f4bf079fc277927dc0a7973fa56c0fc9ae5ab8808a6f42ca5c0b279b1becd33b8ac134ad92a44daaa8e5e129a4816f6bb
SSDEEP 49152:wabH/tabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6Q:udrZdrM0oAaldmdmnp8TpWu6Jm0xd2d3
TLSH
T1EA666A13F29940E9D05AC078DF468232EA22BC590BF1A5EF278077D52E77AE07B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 6.1MB
SHA256 b0abb56f21e1437bf07e26a5b81705d4f98fdf1c93c375863abf69ff6cbe98bb
MD5 c334cbd26166d0dea418a13dab9935f0
SHA1 f1251e921394e8f8128bce7da25fdb43243923c9
SHA512 c81c73d38344fba29be95dddbb5137d4974076637e53a7644ced969ff3d17867f3fcecad7c7d0f242fbb354788d8a695cd0b7f7aede7fcbe0527a1a790e982ac
SSDEEP 49152:wabH/tabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6L:udrZdrM0oAaldmdmnp8Tpd5dKCi616
TLSH
T1B8567B13F29844E9E09AC174DE568132EB227C590BF1A5EF338076D52E37AE07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 7.3MB
SHA256 1a0f370c9a8373ac130464fa8fada77979c35be81ffb5ca27b76e7e6c82ff3cc
MD5 24ded9e1d68914f254e74a6f671bc981
SHA1 105889b77fb4568caf6921e8b951897a47693fe0
SHA512 3292433b573e4c1de0d89cf33101694c4908fd3cd1f7b6accdc3ed685599a74167f69cc87ba4df2a2506a8f69a6ec073940af25a61ac763982ec12cdee60bf8e
SSDEEP 49152:wabH/tabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy66:udrZdrM0oAaldmdmnp8TpPm7vj1BDlZG
TLSH
T156767B13F29940E9D05AC074DB56C232EA227C5907F1A5EF2780BBD62E77AE03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 5.7MB
SHA256 0799c00eaf5d84c626fdb2b0d7eb86d1eed5da5144146751f47560af7dc305b9
MD5 00e0060717ee085af4b65a2964e379c8
SHA1 7703509fc47b43d3c262988d5564cb7ed41958ac
SHA512 5ab8a1c04fcb80a67c10d8483955546f55464628f24cd7627c300075ae9d84f6a7040c14900db470c93b2c3a77e3f418dd40f00b743ca1a83b5ec37bd20048dc
SSDEEP 49152:wabH/tabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6I:udrZdrM0oAaldmdmnp8TpIX2iwphX
TLSH
T119565A13B29444E9D05AC074DE568232EB227C590BF1A5EF33807AD62E77BE07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 4.3MB
SHA256 0ad80d562d65df4e6cc6d1363fe886f3e4d0a2d3921f8904a2c7171c4d8d4635
MD5 6cc6190473a1aee50e9be87135c1335c
SHA1 7cca5f01f284bd2d9bef44a6c6508058e3b09a42
SHA512 1983dedcddeca2e691bcb0074909e0e2d04937cdc8968c0e994821012a004b59cf81eb4ae106861625a7a4b95147a3188fcb76383b1d3d0eb8e9c8cf82d8daf8
SSDEEP 49152:wabH/BabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6Y:qdrZdrM0oAaldmdmnp8TpZ
TLSH
T1A6264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 4.3MB
SHA256 3cc1accf559b3d9e0d7ca505a19bce46d888587163a52755fec8dc7f728a36b2
MD5 1e964299505a71dbce75d5f2093bfbf4
SHA1 21467a65c535d5ca4a754557e42ef8cd37725cec
SHA512 1589fa8b1fe969109de4bb55b461c1d33716df52ea378e1a89b3e1435c5853538789a826119ab14729f2774ef87cc608bdd6c7a2bc28869fd7af501f4ef4e243
SSDEEP 49152:wabH/BabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6A:qdrZdrM0oAaldmdmnp8Tpd
TLSH
T128264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 4.3MB
SHA256 fe8afc4fd1c387a73322ddd29d7c881aa366e08eedc9a0df3f3efdda1cd0a596
MD5 5d5748c8148f759bcf191e50bbd096a1
SHA1 b8322b0b42ec1c8f5998952e6b3afc31bbf42980
SHA512 034037e19bfb5a4d70d62da6814e5eceae83f75b32f122795deea8e19eca294a87588de975b3b6256c4ec015a80b97adada7d6ff0f6287d75dba7930bfd30bd8
SSDEEP 49152:wabH/BabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6r:qdrZdrM0oAaldmdmnp8Tpe
TLSH
T170264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 4.3MB
SHA256 cd17120eec7657fb94870e52d63bb979b3b4690ae4956c42edc4cc2e255bf9bb
MD5 51e0e74859bf76186f666024f5af9148
SHA1 2af7e8353a7b09abe680f5d218a8ffe39db74281
SHA512 57fb2ad0efa4cc7124bdf68d61ecb09baaac61dd602d0f166d68970d42756f25ba2c155e411b8cc4ba34abf848f348f2dc699ec7a0e41bf96f5402a687c60d04
SSDEEP 49152:wabH/xabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6S:6drZdrM0oAaldmdmnp8Tpb
TLSH
T173264913A25448EAE09AC174DE56C232EB217C6907F1A5EF33807AD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 4.3MB
SHA256 040558f850d2be1ba985bab12073f9ec16c0157a070cc97ce6f099b954f75dd6
MD5 0c8fd62464f7bff1d389b584ee2cc2fa
SHA1 87503b2d8f7caf43cabf9fd7b48b11df1b52fd42
SHA512 e2a16cb3a733f94032cb8622b188f96d7bae44e65f10edfce67d624af1314814394cadd4be9af297ecfb2f2ffd0733739c584eaf4538e6c7c71968675f1590aa
SSDEEP 49152:wabH/BabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6v:qdrZdrM0oAaldmdmnp8Tp+
TLSH
T148264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 4.3MB
SHA256 614279e7bb39ca877887109cdcbab5d53b93b17105b8e093944a4cc75ba36507
MD5 3905dab84ee2382d6845e40568d5ea0e
SHA1 9f3e781bec588f56b481f93962423d2737abf432
SHA512 6edd51961a25d8a59399f8fb59f4ee7521a628f4d210fe7175772601cc94c0252e9056a5780c1b90cefbcbda746fdceb07c6de3b056fefd880dc8cdb3d29c9cf
SSDEEP 49152:wabH/BabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6g:qdrZdrM0oAaldmdmnp8TpZ
TLSH
T165264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 4.4MB
SHA256 949753b263a3b75982f2a20990b67d72fe0df1824dfe1656c5da4179f46ce7ee
MD5 8e3c1c3b82dd5ea00cdd8353ab02d7d6
SHA1 43ad35694a8239a1c11f4472439a2f5a531a2960
SHA512 5f23ffd3407122cf461f2c71a4d5531c9d50fa3d49fa6893caaffc913d28c72217302ac4b75c54c86a79b69bae29af5e9b8442bfb300244ef457b0bc2d070dac
SSDEEP 49152:wabH/FabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6E:GdrZdrM0oAaldmdmnp8Tpl
TLSH
T17D263913E25444A9D05AC174DF568122EB227C6907F1A5EF33C0BAE92F73AD07BB9706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 4.3MB
SHA256 30c6d9d817bd5894ce70b06b16a4069906a3aac9ee56a62acc226e8e4ed673ab
MD5 52ecd2bffc5e03355d2409f73eef5985
SHA1 285b3775fdbfa22e654d237d7774c9273472ab95
SHA512 5d4a098dead481080a8425278a7354ebe3a1643954fd8ace3684376e83b3d0f02f104614285eb7dea281dca3d6a7a5e87572735c5696fda92b59217cff478b25
SSDEEP 49152:wabH/BabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy60:qdrZdrM0oAaldmdmnp8TpR
TLSH
T1B3264913A25448EAE09AC174DE56C232EB217C6907F1A5EF33807AD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 4.3MB
SHA256 69ca3f81d03147b682f9fff25fe9ec89b786b348696d261e9855090f65144b1b
MD5 dbf4dcd261aa6316635eb1f569703c04
SHA1 9ec06fbd8cb4ae078e91cc68d452ed00c83e3102
SHA512 5d89d250f2047dcedb7a0c6dfa40802736aa50f2921976b5b10f96a85a0c1ea977fa06798f11936b2b5f96f946140d9b083eedf8328ce622b6eb9eabf83b9b03
SSDEEP 49152:wabH/BabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6K:qdrZdrM0oAaldmdmnp8Tpzj
TLSH
T1AA264913A25444EAE09AC174DE56C232EB217C6907F1A9EF33807AD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 4.3MB
SHA256 712e7da6744b40d018d83c4a6fa273752c453d35e5369720a4b8b7a56165adc3
MD5 d2926b14a013c0e803c9355477b00754
SHA1 f710d8d16bdb022eccb035fcd1d9305016b8f5cb
SHA512 cd8adc4448286adaac1a998fc6842817dbed9df65dee825e0ca4031e6d6bb2ce9652895c5b498aeeca46068d05e377ce523a6731268c8a48120ccdb8f9b12bef
SSDEEP 49152:wabH/tabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6U:udrZdrM0oAaldmdmnp8TphD
TLSH
T1EB264913A25448EAE09AC174DE56C232EB217C6907F1A5EF33807AD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re~4.exe
Size 147KB
SHA256 820f7b8fcba857f6c99736db09bf996d8cfa34d4da23f79700f7c0ebd0f4c74b
MD5 d510cc09df19774296c2568689b99964
SHA1 d237f118f8c1fae1ea6a565fe9d4308ed298d7dd
SHA512 f61057ca01bcf8fe88f308359b885ce9eec4b43e981a485245e44849123623ee45babaa2031244e751dc96fa55289c875414d25456bed5b9933d222f099662e7
SSDEEP 1536:lFs+dOG00IZv56vAaLDdw5Mg0mplXjHtIe46U+GuSawW8MDimCA9XgGQSMKNli7S:sUu5AV9IzF4R+iA9aI6Ks2pyaho2
TLSH
T129E36C2616D4E032E3D312348A68E2F36A7D763549C5DA0BAB9443293D713D3E7B970B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 4.3MB
SHA256 7bf335d17508dfa8d6933aeeaebbf9958ab80ade144b5ae2e4abe77160e7d4cc
MD5 abf8ccc8a14a9287f7aaa458e236921a
SHA1 f29cc66fe8d2fdf8a74d48277873f1c4e8f51be1
SHA512 f186c089e0334509c026b7135e357cff096c32429ed1f11ec9d0707f1f091a51eed5135b322813578e9f3a21b34a9bdbac43784589120fa593836e0898906882
SSDEEP 49152:wabH/pabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:SdrZdrM0oAaldmdmnp8Tp1
TLSH
T1F6264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.3MB
SHA256 2140bfea8092985d1d4476aa54ab541e1549e62a8b87821509d5f70e05ab1fa3
MD5 189651dab9339306a00044afc2da7fc2
SHA1 43e5cab10730cd02eb9d90006334cd5d87b05ad8
SHA512 e83c5a9daf3413009f227413d209f379f7f57d6223cd46c9a8c54818c988b74d59900d9e0e6784e0ccc31b770164d88813eae7b2b358e24f2ca6e7460327c698
SSDEEP 49152:wabH/xabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:6drZdrM0oAaldmdmnp8Tp1
TLSH
T160264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.3MB
SHA256 c30bbed4dcfec2ca54ac3b37652e722c074972d1ac1a2028bdb4715ea0da34e4
MD5 2ae60beb5839c8df5ff2a9f91b8a555b
SHA1 95fb34535431d943f8184d34acc8b17d83728c65
SHA512 beb319ae75bcc0ffb95a1cb9912ce76c79004f69a070209b09f91c550832728036c44fd930c96cb636a7ad788479182d27385819588f780af002c80cd34791c6
SSDEEP 49152:wabH/FabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:GdrZdrM0oAaldmdmnp8Tp1
TLSH
T155264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.3MB
SHA256 5c3570a4ae6112a96b13dc8bb5e730e390fd668a594d981d279a832fd11ceb57
MD5 059731dbc710f0ae16cbd93421b99785
SHA1 05eede45f3e10d501f35450da045918e20251d1c
SHA512 a05d473de58e1c4eb52e018d2784aac0ed51a55d28209fa45d2e2619fdd464b6c58ad61dc13010aa5d2b95ddee7e24357ee19ffc0547a3d32ada5c92670fbbc5
SSDEEP 49152:wabH/IabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:FdrZdrM0oAaldmdmnp8Tp1
TLSH
T198264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.3MB
SHA256 b1e609fa9e6cd6442fe5b600138fc75249b1cfd0f673dedc40d9b99854b2ea1f
MD5 7e9833369a4e86b8b51d3bd2c8583232
SHA1 c601692333d5a1595c7648175936a05a1c31417c
SHA512 d570a4fc3f64efa50a70000831d5dc5926a0e54091f992f3dc763a50b70450bc6fe405a9a8c6ca516b5f77a52029eb38c7ae00b559f57b3b63eea22049103890
SSDEEP 49152:wabH/wabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:ddrZdrM0oAaldmdmnp8Tp1
TLSH
T197264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.3MB
SHA256 906b5496342ef827b453166794a9993b246c913254fc562bc8bfc90d5ba40045
MD5 d93aee04b483becccb002fe3ca40807a
SHA1 b9553e70c1b2fbd90d86a4a5e6d56278e97e2340
SHA512 9eba49267e35eba940f827f02b8b1da8223f52eabc506c9b18c9daa89dec5f2c39f657963cbf6a255303adfc06cd5cbe0ffd22e77647d5315516f3bce2541bdb
SSDEEP 49152:wabH/BabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:qdrZdrM0oAaldmdmnp8Tp1
TLSH
T139264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.3MB
SHA256 4792a777a9785ebbe39d7433a43679a87edd784b2dec6dba033e25db40ea0302
MD5 83bd435ba1e7790ec409cf60c90d32b3
SHA1 f93c649cc8e69a4fda257202e445bb86a297c940
SHA512 c1974ffebd4c371a869dd959260d4d9b0b38a8294d98926df8285c78e7ed8f088e45269c5110342db2eb38a459224f5418d2845eddc00dce4a1d8c3cec7a1ad3
SSDEEP 49152:wabH/tabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:udrZdrM0oAaldmdmnp8Tp1
TLSH
T1E8264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.3MB
SHA256 7da34d7047479a754f9de6105cf2e4e84f6eb1fa39b08710ea179a32ad869f7d
MD5 a5a16ab7f4c6b003007b8f3e22eabaa5
SHA1 cd2114f9efeb474669e4aca4624d7363baf2ea27
SHA512 983331b165aa165b3048853b5db8145f3af802c5fa52ec7e1b777e5ab567c479c7a2e8164a7d5998154fcebcbeef14a5b28dec1250392df5df7b538fa022d891
SSDEEP 49152:wabH/tabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:udrZdrM0oAaldmdmnp8Tp1
TLSH
T1A5264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2428-74-0x0000000000940000-0x00000000009D6000-memory.dmp

Download

memory/3884-89-0x0000000000520000-0x00000000005B6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads