84b13afdbea2b770625d83a4d97c09e902cb9410830ffab51522962179e6868c

Analysis

max time kernel
150s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
Size 4.4MB
Sample260503-sp4fsab15w
SHA256 84b13afdbea2b770625d83a4d97c09e902cb9410830ffab51522962179e6868c
MD5 6e1f62a9a4d732bc10fc204cf070f330
SHA1 fadc861d54bbe4863bfadca3f78c2982918a03da
SHA512 2ad9a78a4002f48a16992690255ffccf8f471e2d50e53e5b38e09bea2363b9affa4c506a87c36bb24297ec549ad59ea369a61440b651dc0a73ca0ba45c753283
SSDEEP 49152:wabH/pabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6D:SdrZdrM0oAaldmdmnp8Tp9I1H
TLSH
T1E8265A13A24444AAE19AC174DE56C232EB217C6907F1A9EF33807BD53E73AD17B39706
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
3856	UpdatAuto.exe
2516	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re~4.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5096	sc.exe
3952	sc.exe
1896	sc.exe
2776	sc.exe
2120	sc.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re~4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1456	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
3856	UpdatAuto.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 2304	1456	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	80
PID 1456 wrote to memory of 3856	1456	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	82
PID 3856 wrote to memory of 4328	3856	UpdatAuto.exe	83
PID 1456 wrote to memory of 2516	1456	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	85
PID 1456 wrote to memory of 2472	1456	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	86
PID 1456 wrote to memory of 5004	1456	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	87
PID 1456 wrote to memory of 4504	1456	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	88
PID 1456 wrote to memory of 3088	1456	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	89
PID 1456 wrote to memory of 5084	1456	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	90
PID 1456 wrote to memory of 2480	1456	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	91
PID 1456 wrote to memory of 2312	1456	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	93
PID 1456 wrote to memory of 1896	1456	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	94
PID 1456 wrote to memory of 3952	1456	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	95
PID 1456 wrote to memory of 5096	1456	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	96
PID 1456 wrote to memory of 2120	1456	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	98
PID 1456 wrote to memory of 2776	1456	2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	99
PID 5004 wrote to memory of 1088	5004	cmd.exe	110
PID 5084 wrote to memory of 1608	5084	cmd.exe	111
PID 2312 wrote to memory of 3556	2312	cmd.exe	112
PID 3088 wrote to memory of 3100	3088	cmd.exe	113
PID 1088 wrote to memory of 1920	1088	net.exe	114
PID 3556 wrote to memory of 3060	3556	net.exe	115
PID 3100 wrote to memory of 1956	3100	net.exe	116
PID 1608 wrote to memory of 2640	1608	net.exe	117
PID 4504 wrote to memory of 1788	4504	cmd.exe	118
PID 2480 wrote to memory of 1440	2480	cmd.exe	119
PID 2472 wrote to memory of 3692	2472	cmd.exe	120
PID 1788 wrote to memory of 4728	1788	net.exe	121
PID 1440 wrote to memory of 4568	1440	net.exe	122
PID 3692 wrote to memory of 4816	3692	net.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2304
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4328
- C:\Users\Admin\AppData\Local\Temp\2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re~4.exe
  2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re~4.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3692
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:4816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:1920
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:1956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:2640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:4568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3556
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:3060
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1896
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3952
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5096
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2120
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 4.8MB
SHA256 139d6a1ad9f5a8cda9562424d3a6514efdc2334c1b456613a0aa3b798386ffcf
MD5 28d5928256473cf4e47aca568db8c867
SHA1 112d9d1f2fdabeb9702d58e91ca9ca619cc2ece0
SHA512 f2ba2c2e85a19d672e547bf2eda7f67cfedec6e354c792ce0fdbad20c1d7eccf41fb57634e4271e9c455b77ce809601ad50886e318725a5e71fc6b361854798a
SSDEEP 49152:wabH/FabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6q:GdrZdrM0oAaldmdmnp8Tpejo
TLSH
T14D364813F25444AAD05AC078DE568226EB317C5907F1A9EF3380BAD93E33AD17B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 5.2MB
SHA256 44a9c30405255c2f074085aa876c2b25a2495b2ea4258699b1793a486a2a601f
MD5 8bd222148a9749e7b0e330fb057cc102
SHA1 79119cd5e504977fbf837fa9c912bc2ec76aea35
SHA512 0d1d70d254e00e5ba62ee7864d69819edbdba501bcaf03a826b7764044de543ff4bfd1366e3ddbecb76619014ce25dded734e4ea6ca551daf2a740c930dbd7dd
SSDEEP 98304:GdrZdrM0oAaldmdmnp8TpDezSC6v2XMH:urTrpKmd0KTpQ
TLSH
T125464913B26445AAD0A6C074CE969226EB313C5907F1A5EF3380B7D93E33AD17B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 4.9MB
SHA256 9149255366f48aecac961b940319c807863e2455976dd4eeba2bb8b3645b6149
MD5 47f5e502d8443a0807a70f6abc108fed
SHA1 a331e838f08dfe341ea593c88b70d2a91f7ce65b
SHA512 b9e416148c7a5e96d925dee3cc4694c26cc6d42276957eee271eae0cab0765af1fac28fe39163a0d4f0111ee7a80f4f30f4d731daf33f932bd5b0e0a96d600e0
SSDEEP 49152:wabH/IabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy69:FdrZdrM0oAaldmdmnp8Tpb/h1+
TLSH
T186364913F25444A9D066C078DE568226EB327C5907F1A9EF3380BBD92E33AD17B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 4.3MB
SHA256 4c59a8cb082b855f7ed2a2979708083717be32d2b555246adaa10619b0319b51
MD5 d0f1053adf8d6e234c077feaecc36f4a
SHA1 223f099745a02aadd9ddeb3f2d42ecbe7371cb39
SHA512 731b9450c8eb674ed9cced3a7c881865c946f612593cb2ab9b5839baed62c858aa0adb1ff3b91e01c81ff67e72708b549c6062ece8afd59221428b436e73d0c7
SSDEEP 49152:wabH/wabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6W:ddrZdrM0oAaldmdmnp8Tp
TLSH
T118264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 10.3MB
SHA256 2b35546fffcd5df45d252d9674ad0d9ebca23db3a0a166f2a6db34e4c1941982
MD5 aa9c9105a8af3f66fe41ca3bf7880f25
SHA1 0f34b4204dbdc2b9da415b4ae7ff57202b4f66c7
SHA512 0987d7650bab7b57e77483d39a4e0aae8677b94a84dd8dd6ce46646b01a470897cb6403b4ba2fb46cea1c5c23d9d15a11028877c6dbb907e3ac46729c0dcff5f
SSDEEP 98304:udrZdrM0oAaldmdmnp8TpSQRQyi36YOcP+Lvw2gAf+PN34:GrTrpKmd0KTpJQyiKaUX+PNo
TLSH
T117B67D13F2A540E9E05EC574DF2992329B317C5A47F1A2EF368436E52E72AD07B38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 10.3MB
SHA256 9382beda4c49d4828263c8eb1fb68825eb6259b1e665c9e3b7e8f420ae774c52
MD5 d256b65ec02fa1efbe9f444d1ba4acfb
SHA1 d661812c2f1c3802cb8eb53c12970baff22b88f2
SHA512 9366aba4e5772c762b39a0fde98b0c431c0344c31f241bea3f7702b9692a00ea6acd4d988a2b484a57a952ed63d7c59d542ae0646cef8fdc9a7f6d73c02b77cb
SSDEEP 98304:VdrZdrM0oAaldmdmnp8TpSQRQyi36YOcP+Lvw2gAf+PN34:/rTrpKmd0KTpJQyiKaUX+PNo
TLSH
T1F0B67D13F2A540E9E05EC574DF2992329B317C5A47F1A2EF368436E52E72AD07B38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 6.0MB
SHA256 e9291e7f099cd2073c867e73eec9bf324ba63eceeb7d95e35043621b5a38d76d
MD5 9fceaf9ff84906aa3451754dae373feb
SHA1 0924d02fb7391bf0a8370ae3c9348e06ba94aa5a
SHA512 933263e4789f5e57d3abc7a81c7a58c784601742ae27e4bc0db35f8a88913447950a26c25fbed9ff9742dc6a09c73ccfe634d2967cd1c94658eb21a761941861
SSDEEP 49152:wabH/tabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6k:udrZdrM0oAaldmdmnp8TpdthHRc/Q
TLSH
T1E5566B23B29504E9D04AC075DF468232E7A17C694BF1A6EF628077D52F73AD07B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 7.7MB
SHA256 d547079b30cfc5024444fbd05d20f435ece390fabd357d7f3220759889da6581
MD5 37b624ace4f9941015eb51ef0c6e0ce5
SHA1 7f244ac14efd1a600a7f6bc8c0bd083b39a6b491
SHA512 6cf47048c619c8f4ca0529927c4b7b213565314e2fd0159ff9c3a1a2e4edbae832581ebb60dcd9d2848adfbddf7f8016455cfb50622ef65b5221e528bc7b6e1d
SSDEEP 98304:udrZdrM0oAaldmdmnp8TpMy5112gYy5azzVvf69nLKnhZO:GrTrpKmd0KTpNLIHuWhs
TLSH
T16F867C13F29900E9D05AC178DB468232EA71BC5A0BB1A5EF278077D52E77AE07B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 6.5MB
SHA256 e0290f12f06d54b61acd33a199b90c1beca03cf583f032c62a9bc3668c402bce
MD5 de3aa39e5009bdf7a193558774110d4c
SHA1 8ee397bad590ba72088d93e26ea597e3125336dc
SHA512 610e862efbbf3dd802a4cb28fed8011373d57e736b54b5fd36e1ca8009949107e3c7241932b5364045f5639978430a1ec3b8fa6a20d5af0b4f3b4d43deaf23dc
SSDEEP 49152:wabH/oabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6Q:VdrZdrM0oAaldmdmnp8TpWu6Jm0xd2d3
TLSH
T179666A13F29940E9D05AC078DF468232EA22BC590BF1A5EF278077D52E77AE07B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 5.9MB
SHA256 06f0cfa163065b2930c798c82a05fd4dd9045fcb8e81a9eb4c4d9ac935085d2e
MD5 8842000bdf4a2b4f1b2b91609aebea3c
SHA1 1138aaaeeb615ddeb05a767bd1f8b511aad676ad
SHA512 e518207a5c4e9fbb6bb547b6c3f4555fcbb8016594b1c65407e6eebbc0272b6ef083d0ef52696fa3bb2d85d155302aa2e82ef8bc10cf3a23ae6af6788da11270
SSDEEP 49152:wabH/tabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy63:udrZdrM0oAaldmdmnp8Tp+mifP5R7
TLSH
T1C7566A13F29844E9D05AC078DE568232EB217C590BF1A5EF33807AD52E77AE07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 6.1MB
SHA256 de4e5e84a7bf6ab1511949753e630b53f0fb70b5f1e3fa42890e03268413bbb0
MD5 60d8fd011d9c46db04f0b3ceb87f9cc8
SHA1 319088d691bc5815bc2e95d7ff5d1abe5fc5858b
SHA512 75c28f524a61d262b1dedf941f752b884b57df36ba532b341bc05ad080a15b61cc7fc81c6b98cbe4486406c98bd96c41846e1bd2d61bf9909ad02ba84c9d5cab
SSDEEP 49152:wabH/oabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6L:VdrZdrM0oAaldmdmnp8Tpd5dKCi616
TLSH
T145567B13F29844E9E09AC174DE568132EB227C590BF1A5EF338076D52E37AE07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 7.3MB
SHA256 1a0f370c9a8373ac130464fa8fada77979c35be81ffb5ca27b76e7e6c82ff3cc
MD5 24ded9e1d68914f254e74a6f671bc981
SHA1 105889b77fb4568caf6921e8b951897a47693fe0
SHA512 3292433b573e4c1de0d89cf33101694c4908fd3cd1f7b6accdc3ed685599a74167f69cc87ba4df2a2506a8f69a6ec073940af25a61ac763982ec12cdee60bf8e
SSDEEP 49152:wabH/tabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy66:udrZdrM0oAaldmdmnp8TpPm7vj1BDlZG
TLSH
T156767B13F29940E9D05AC074DB56C232EA227C5907F1A5EF2780BBD62E77AE03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 5.7MB
SHA256 db2dc70a8036c37462a4d06bc69dd177b8f051ffd5c939fba1d177f99d1ec337
MD5 216a73ff5a68d4e583ba95b71b49de6b
SHA1 8c841aecb5c01c0bb935b4dd57981f59fe02e34c
SHA512 f7f532e2e491a70d13d3daa51124996f75736ce89e41464c0892262a87753c048ae4e5d1df756d63be435a87f52c61a5fb4b0c28407f446a8e5e5a7c5c2351d8
SSDEEP 49152:wabH/oabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6I:VdrZdrM0oAaldmdmnp8TpIX2iwphX
TLSH
T145565A13B29444E9D05AC074DE568232EB227C590BF1A5EF33807AD62E77BE07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 4.3MB
SHA256 0ad80d562d65df4e6cc6d1363fe886f3e4d0a2d3921f8904a2c7171c4d8d4635
MD5 6cc6190473a1aee50e9be87135c1335c
SHA1 7cca5f01f284bd2d9bef44a6c6508058e3b09a42
SHA512 1983dedcddeca2e691bcb0074909e0e2d04937cdc8968c0e994821012a004b59cf81eb4ae106861625a7a4b95147a3188fcb76383b1d3d0eb8e9c8cf82d8daf8
SSDEEP 49152:wabH/BabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6Y:qdrZdrM0oAaldmdmnp8TpZ
TLSH
T1A6264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 4.3MB
SHA256 757ce73ffd4167e2cda5f62998c4b29b261100bc1409c2bf336a9ced2a1c8d39
MD5 df4f8a03699cf9d78fcea141fce3e170
SHA1 ff459be20f118b8b8cf15ce76363af2b670e4e8b
SHA512 d32a663e519736eeeeffe9d7b3e49312e13c10857321395652d70712bc57c85530591baf154f446212595a5ddd8d7496361f0d3c89cfc674569e794252ea49ac
SSDEEP 49152:wabH/oabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6A:VdrZdrM0oAaldmdmnp8Tpd
TLSH
T1B6264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 4.3MB
SHA256 fe8afc4fd1c387a73322ddd29d7c881aa366e08eedc9a0df3f3efdda1cd0a596
MD5 5d5748c8148f759bcf191e50bbd096a1
SHA1 b8322b0b42ec1c8f5998952e6b3afc31bbf42980
SHA512 034037e19bfb5a4d70d62da6814e5eceae83f75b32f122795deea8e19eca294a87588de975b3b6256c4ec015a80b97adada7d6ff0f6287d75dba7930bfd30bd8
SSDEEP 49152:wabH/BabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6r:qdrZdrM0oAaldmdmnp8Tpe
TLSH
T170264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 4.3MB
SHA256 348ca1c033db740cd397449f46fb2fc689ab12283b657b179468598b3235f7c7
MD5 e9b0c5a0758e5336fb87ade5cc09d7e0
SHA1 3b5595cecfea685bbb7acfda784ece2d73820996
SHA512 e81e2eb76d912dbad7b79d2fd5b4aa9e1c52c5d5a109bbb02d73bf5afa7b07f7c876c04d9403f7f0c02a577c4cf153c2224b02b2155a1b520527e5a043a6070d
SSDEEP 49152:wabH/YabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6S:ldrZdrM0oAaldmdmnp8Tpb
TLSH
T139264913A25448EAE09AC174DE56C232EB217C6907F1A5EF33807AD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 4.3MB
SHA256 1931386466eafd9eb4b2671fd31c0f97d9abc435cf9c0c9cd0fa45d2ef0b13b7
MD5 1888dcc94a771ec260506220ca4c42b7
SHA1 ba56c69e036dda94cfee988c14967248f2c0d357
SHA512 018f7d029a77f18580a958e7595213c61a4f4767598914bcfad13706ed65b593e258dec4906d1e01d847dc337c0dd8798dc9da576d56b2d95cfd7b52bbfcc5f3
SSDEEP 49152:wabH/oabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6v:VdrZdrM0oAaldmdmnp8Tp+
TLSH
T1B6264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 4.4MB
SHA256 949753b263a3b75982f2a20990b67d72fe0df1824dfe1656c5da4179f46ce7ee
MD5 8e3c1c3b82dd5ea00cdd8353ab02d7d6
SHA1 43ad35694a8239a1c11f4472439a2f5a531a2960
SHA512 5f23ffd3407122cf461f2c71a4d5531c9d50fa3d49fa6893caaffc913d28c72217302ac4b75c54c86a79b69bae29af5e9b8442bfb300244ef457b0bc2d070dac
SSDEEP 49152:wabH/FabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6E:GdrZdrM0oAaldmdmnp8Tpl
TLSH
T17D263913E25444A9D05AC174DF568122EB227C6907F1A5EF33C0BAE92F73AD07BB9706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 4.3MB
SHA256 30c6d9d817bd5894ce70b06b16a4069906a3aac9ee56a62acc226e8e4ed673ab
MD5 52ecd2bffc5e03355d2409f73eef5985
SHA1 285b3775fdbfa22e654d237d7774c9273472ab95
SHA512 5d4a098dead481080a8425278a7354ebe3a1643954fd8ace3684376e83b3d0f02f104614285eb7dea281dca3d6a7a5e87572735c5696fda92b59217cff478b25
SSDEEP 49152:wabH/BabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy60:qdrZdrM0oAaldmdmnp8TpR
TLSH
T1B3264913A25448EAE09AC174DE56C232EB217C6907F1A5EF33807AD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 4.3MB
SHA256 44ae0b39163ae52b7e31cec9c365e20c2a8c8abd09ad70992b04ae1d7623185c
MD5 4bf2b77fb096a7ae1a4d7e7226b8cde0
SHA1 1223e9641340d6008370b517923d08e851575b0e
SHA512 5a2118cbd2f76fbaaa7e7fc6b4a47a8596a681c1f4cb4e5e842bfc4ab0a3d0791ca796704299c8e3695b5c3cbea88cd2f91e4ba248460746eee0728c1beccd99
SSDEEP 49152:wabH/oabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6K:VdrZdrM0oAaldmdmnp8Tpzj
TLSH
T1A4264913A25444EAE09AC174DE56C232EB217C6907F1A9EF33807AD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 4.3MB
SHA256 712e7da6744b40d018d83c4a6fa273752c453d35e5369720a4b8b7a56165adc3
MD5 d2926b14a013c0e803c9355477b00754
SHA1 f710d8d16bdb022eccb035fcd1d9305016b8f5cb
SHA512 cd8adc4448286adaac1a998fc6842817dbed9df65dee825e0ca4031e6d6bb2ce9652895c5b498aeeca46068d05e377ce523a6731268c8a48120ccdb8f9b12bef
SSDEEP 49152:wabH/tabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6U:udrZdrM0oAaldmdmnp8TphD
TLSH
T1EB264913A25448EAE09AC174DE56C232EB217C6907F1A5EF33807AD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re~4.exe
Size 147KB
SHA256 820f7b8fcba857f6c99736db09bf996d8cfa34d4da23f79700f7c0ebd0f4c74b
MD5 d510cc09df19774296c2568689b99964
SHA1 d237f118f8c1fae1ea6a565fe9d4308ed298d7dd
SHA512 f61057ca01bcf8fe88f308359b885ce9eec4b43e981a485245e44849123623ee45babaa2031244e751dc96fa55289c875414d25456bed5b9933d222f099662e7
SSDEEP 1536:lFs+dOG00IZv56vAaLDdw5Mg0mplXjHtIe46U+GuSawW8MDimCA9XgGQSMKNli7S:sUu5AV9IzF4R+iA9aI6Ks2pyaho2
TLSH
T129E36C2616D4E032E3D312348A68E2F36A7D763549C5DA0BAB9443293D713D3E7B970B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 4.3MB
SHA256 7bf335d17508dfa8d6933aeeaebbf9958ab80ade144b5ae2e4abe77160e7d4cc
MD5 abf8ccc8a14a9287f7aaa458e236921a
SHA1 f29cc66fe8d2fdf8a74d48277873f1c4e8f51be1
SHA512 f186c089e0334509c026b7135e357cff096c32429ed1f11ec9d0707f1f091a51eed5135b322813578e9f3a21b34a9bdbac43784589120fa593836e0898906882
SSDEEP 49152:wabH/pabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:SdrZdrM0oAaldmdmnp8Tp1
TLSH
T1F6264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.3MB
SHA256 9f07f793d05071be668a6442aa477105a24434474b4aeccecdbccca7ab9c852a
MD5 60fba5013df622d1af69e38a79d1d640
SHA1 daa3fff67b6a04999edddc9cc3383d60b3fe563b
SHA512 41f31bb646828f80a6a173e672c885f69b854d357597c4b5fbc0f8008251244686e1a3057d2df83b9149f91fbe3c2217f1192c36c15c908a607ecdc30d8e3fbd
SSDEEP 49152:wabH/oabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:VdrZdrM0oAaldmdmnp8Tp1
TLSH
T155264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.3MB
SHA256 4ca3f6be8474c205f8e0004489da9d4d26c841fb09a3da706e54e6809f7a9706
MD5 fc7164848fe8b69fbb6edf16f70640e4
SHA1 3fbdb4a42239b64a9fc036ec6827142178759523
SHA512 91fea6da70a13f9fbe95da70dcbfa8b531bb72da2f1c75fe9791ddd35e804cb1d7704dbf47c261ca5b2149417436975b700ebb9803a94f398e62064ea375755e
SSDEEP 49152:wabH/YabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:ldrZdrM0oAaldmdmnp8Tp1
TLSH
T12A264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.3MB
SHA256 5c3570a4ae6112a96b13dc8bb5e730e390fd668a594d981d279a832fd11ceb57
MD5 059731dbc710f0ae16cbd93421b99785
SHA1 05eede45f3e10d501f35450da045918e20251d1c
SHA512 a05d473de58e1c4eb52e018d2784aac0ed51a55d28209fa45d2e2619fdd464b6c58ad61dc13010aa5d2b95ddee7e24357ee19ffc0547a3d32ada5c92670fbbc5
SSDEEP 49152:wabH/IabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:FdrZdrM0oAaldmdmnp8Tp1
TLSH
T198264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.3MB
SHA256 b1e609fa9e6cd6442fe5b600138fc75249b1cfd0f673dedc40d9b99854b2ea1f
MD5 7e9833369a4e86b8b51d3bd2c8583232
SHA1 c601692333d5a1595c7648175936a05a1c31417c
SHA512 d570a4fc3f64efa50a70000831d5dc5926a0e54091f992f3dc763a50b70450bc6fe405a9a8c6ca516b5f77a52029eb38c7ae00b559f57b3b63eea22049103890
SSDEEP 49152:wabH/wabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:ddrZdrM0oAaldmdmnp8Tp1
TLSH
T197264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.3MB
SHA256 c30bbed4dcfec2ca54ac3b37652e722c074972d1ac1a2028bdb4715ea0da34e4
MD5 2ae60beb5839c8df5ff2a9f91b8a555b
SHA1 95fb34535431d943f8184d34acc8b17d83728c65
SHA512 beb319ae75bcc0ffb95a1cb9912ce76c79004f69a070209b09f91c550832728036c44fd930c96cb636a7ad788479182d27385819588f780af002c80cd34791c6
SSDEEP 49152:wabH/FabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:GdrZdrM0oAaldmdmnp8Tp1
TLSH
T155264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.3MB
SHA256 9be951945e014dbb33be52a6af653dcfe45f60853bf701d029503b47c2b405fc
MD5 f943d38198632a07c5c6d6f7f081e372
SHA1 c01d61d05f59a5b3a3ac02265f84e28f058dc35d
SHA512 791d661a91b4d230d243ad5ab18aeb3122eadd50bd621488d5d3d78639d6eb67b946d9092ccb4cbb0abc87031b6692eb28f91370c10100fb7c02eb1ff9abb3f8
SSDEEP 49152:wabH/FabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:GdrZdrM0oAaldmdmnp8Tp1
TLSH
T19B264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.3MB
SHA256 4792a777a9785ebbe39d7433a43679a87edd784b2dec6dba033e25db40ea0302
MD5 83bd435ba1e7790ec409cf60c90d32b3
SHA1 f93c649cc8e69a4fda257202e445bb86a297c940
SHA512 c1974ffebd4c371a869dd959260d4d9b0b38a8294d98926df8285c78e7ed8f088e45269c5110342db2eb38a459224f5418d2845eddc00dce4a1d8c3cec7a1ad3
SSDEEP 49152:wabH/tabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:udrZdrM0oAaldmdmnp8Tp1
TLSH
T1E8264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.3MB
SHA256 906b5496342ef827b453166794a9993b246c913254fc562bc8bfc90d5ba40045
MD5 d93aee04b483becccb002fe3ca40807a
SHA1 b9553e70c1b2fbd90d86a4a5e6d56278e97e2340
SHA512 9eba49267e35eba940f827f02b8b1da8223f52eabc506c9b18c9daa89dec5f2c39f657963cbf6a255303adfc06cd5cbe0ffd22e77647d5315516f3bce2541bdb
SSDEEP 49152:wabH/BabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:qdrZdrM0oAaldmdmnp8Tp1
TLSH
T139264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.3MB
SHA256 7da34d7047479a754f9de6105cf2e4e84f6eb1fa39b08710ea179a32ad869f7d
MD5 a5a16ab7f4c6b003007b8f3e22eabaa5
SHA1 cd2114f9efeb474669e4aca4624d7363baf2ea27
SHA512 983331b165aa165b3048853b5db8145f3af802c5fa52ec7e1b777e5ab567c479c7a2e8164a7d5998154fcebcbeef14a5b28dec1250392df5df7b538fa022d891
SSDEEP 49152:wabH/tabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6G:udrZdrM0oAaldmdmnp8Tp1
TLSH
T1A5264913A25448AAE09AC174DE56C232EB217C6907F1A5EF33807BD53E73AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1456-69-0x0000000002A20000-0x0000000002AFA000-memory.dmp

Download

memory/3856-79-0x0000000002A20000-0x0000000002AFA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads