Analysis
- max time kernel
149s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/05/2026, 07:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 330KB
- Sample260505-h6s19sat3x
- SHA256 99dcfd49ad0170fc0fc4c098462eb38b53a621935a73219c25bae4af506d2de2
- MD5 9e8e796a87fc5a77a4e3571fc686d722
- SHA1 ba3a7d9f02fc28ba94faceac67f64e08947f22a8
- SHA512 9b4589b725b58c748f9eb7bcab8183dfb7c6b7d920775ceba025f3db380580db1b0ac9bd1b633ec39d18e603f1c4055a0e99a316d8bfafcf28aa8be3173a5a16
- SSDEEP 6144:ZXmRmjzAVQiI+WjFDfoY9+6s6Be/ODsTnJyQlnutM:gScQiHmNJLB9unmM
- TLSH T10C744969A39C3BF5DCE6817CCDAEB112ED317C110B64D6DB23A44A291F232D06A3E751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 3 IoCs
pid Process 2424 Logo1_.exe 1440 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4052 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX471.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\RCX8E8.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCX99E.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\RCXF96E.tmp Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXFD33.tmp Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe.Exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX939.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\RCX99F.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.Exe Logo1_.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\uninstall\rundl132.exe 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Logo1_.exe 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe 2424 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4544 wrote to memory of 4828 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 84 PID 4828 wrote to memory of 2880 4828 net.exe 86 PID 4544 wrote to memory of 1124 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 87 PID 4544 wrote to memory of 2424 4544 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 89 PID 2424 wrote to memory of 4804 2424 Logo1_.exe 90 PID 1124 wrote to memory of 1440 1124 cmd.exe 92 PID 4804 wrote to memory of 4520 4804 net.exe 93 PID 2424 wrote to memory of 3832 2424 Logo1_.exe 96 PID 3832 wrote to memory of 2264 3832 net.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:2880
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C13.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"3⤵
- Executes dropped EXE
PID:1440
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4520
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2264
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4052
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX471.tmp
- Size 139KB
- SHA256 decf10871afed84f0ab312cb62b031154e5d158b0c08edc09a4f9a67da2195ef
- MD5 84c1e431a556353fbfe67ab9ce34ee7c
- SHA1 0b96691aae4a11b32903d4050444a296cd50bede
- SHA512 6cff4d8b04e4a541af14afeded055c536b9320d9c8f19228754abbe7d27fa90acbbf10a7bda02522cbf1e677af9f2f93a387a0572b73c7c7a4935dce0b188edb
- SSDEEP 1536:v7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx3:+CSjGoLpWM6bblmjx3
- TLSH T10FD35E6DB18FB3F2C3E199BC8D1CF2D5ED28FE20DE19285A75993B0E967A0C34508195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe
- Size 1.2MB
- SHA256 17d5db4929d7c751a703f742127b0d330c1a948173ac4d46f7bb0af36a9eae5d
- MD5 e60bc1075ae1e844b942ed98843b3523
- SHA1 25cfc72c36b80bd6dea71e19f330115375a062f9
- SHA512 0340ce22ecf1fe6de389ffdb177bfbf0174f3ade4ae3d5751524d2353e5fbd032a1377d78baaa86f2474e42126ce1d1a21b759164cd01febea438179193f4e1c
- SSDEEP 12288:w13Sgouvz0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1AnQ6i12NI+f:6Sgouvz0ZRHkFfenxyQZXS7gZnQh2NIq
- TLSH T14245C40267FD7329F1F37B71EABDB2645E767C61AE39C50E5284025E09B0A909A31733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\RCX71A.tmp
- Size 74KB
- SHA256 13aed7b0b812c039b414ea8e3c4ec13a33400cdfefff6c1454cb929bb345822d
- MD5 3f50541a3ed46d3ed72b7a6d5a5fb32e
- SHA1 9de06eaf94564c560b334b4ceb87fcaf74c7db74
- SHA512 b302f02c19eb8a67aed66a6d00e467c201123c5083479de9f583dfc8ead4e179c9775dd25c9c81f8c23d44c065861baf9962a266a0782e6de9d3c44c4d042c86
- SSDEEP 1536:m7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxX:3CSjGoLpWM6bblmjxX
- TLSH T13B732B65B28DB372D0F299B89E0DF1E5BC687E301E19186FB69E2F0DDA771C2190C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX928.tmp
- Size 86KB
- SHA256 ab02528c1f7a9bcd7b8211d6bbb65aedcc3f10dd15d3ba7fa032cc0f28fa09b8
- MD5 0f84875352a74d9813ecefe5868a7075
- SHA1 e1669d69e2bf30d7dea7a4c837377202186d0cb8
- SHA512 6929464a8afe897fd2effcf6e7ebbd3f6a98924077bdf2cdd3853514a0958bd07424e04b33810cb6085749666944b1fdfc38ad9e9036f1a01d4fa6a9494e8dd2
- SSDEEP 1536:67qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxS1XkSPsULMHi7:zCSjGoLpWM6bblmjxSdtPlLq6
- TLSH T13B834A69B28DF372D0F299BC8E0DF2D5BC287D301E19186FB69E1F0D9A765C2190C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe
- Size 4.0MB
- SHA256 0440889a65d9f32774fc7ab04400141dfd914a5dcdb32aac0e068ad4972aba21
- MD5 336ce1e22e1ae2c7ebeac4e495ca60c6
- SHA1 e4d19a4125c64d7317a54f1f4e5264193e8b81c3
- SHA512 9edc48f1879c07b0d9de5bd744413000abf75d28e9075586aef486d74cec840ded4a4006f56be7b11531590ebf4e15f63f3c4aa6eab02896aea8591379919bf5
- SSDEEP 49152:JudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:bijnUdYd+RaAj
- TLSH T125164903B29D62D4D089C074CE5AA232AF617C8947F161EF3690B7DA2A73AD47B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXA45.tmp
- Size 83KB
- SHA256 980a814c422376242245e8d04a62fd4d6455e2bbf413b85fcd594168d1c80796
- MD5 01da875c496db303ce6a45f6ee58f048
- SHA1 3cfb95b4d471af2cabd5c54a269ce4a6ebdf2dd2
- SHA512 99cde8abee2377abe46e91d32ffe6d71b39a565a468584dcc8fdf8bd752dd1cd84a61de7726de322e89a80b1745299cdbfa61d1e06b36621c953c265949d746e
- SSDEEP 1536:u7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx5qkSZZZ3v:/CSjGoLpWM6bblmjx7Uv
- TLSH T10D832955B68DB3B2D0F189B89E0CF3E5BD257E301E59186FB69E3F0E9A77082150C189
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCXF97F.tmp
- Size 74KB
- SHA256 15450d5419f137910e8eaf1f6d90d0b683840b84c7135c52496fe4d8e8767cc9
- MD5 bbf7ee5e547774a68d0440beef05e7f5
- SHA1 e4ef081bd6080a2ce92702d7700aadc64fb1a384
- SHA512 f6f0b21c0f48695bad7200c780fb20f43d944527473a8f50992927a890c4a1ae633c1564f577e24abbc81f2ec0fe263e24a186d0fadc1fd023e28d5b5d7cf95b
- SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxJ:DCSjGoLpWM6bblmjxJ
- TLSH T163730969B28DB376D0F299B88E0CF1E5BC687E301E19186FB69E2F0DDA761C2150C195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\HideUninstall.exe.Exe
- Size 362KB
- SHA256 8975c46f96a1023026cefd35a232716cf8d3367dc9fbd4a2ce86c99f09087a64
- MD5 b352efe502c7ee9795f3c35fa273164c
- SHA1 120492d1b78f0af25bff20fb9e7e5385575463d7
- SHA512 065578f71a86d59a4b8cab2bdbdab1cb368489d692c5c3880cf8e889b2e038230f753b627fe7a75e5375fe283dc24ead3a5753e3c96dc9787a83cbd223989e08
- SSDEEP 6144:ZXmRm8kQDoYOsbgx2czpeYk2Ahn0SCnHRKJPOPo8l4NwzZiYyS:gSQNLczpxbAYHsP9NwL
- TLSH T1BA7401A6B09EB3B2D0E299BC8D1DF1E0EC363D301F0555EB759A1B1ECBB25C1153918A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXFABF.tmp
- Size 75KB
- SHA256 61f0ba9bc0184172f82313f06f5778dcb642872371bca71d4c7dcecaacc183f9
- MD5 c0b80b18f779ca73eec8e499ef3b2027
- SHA1 7e23e85d1d4ee8ade8c43e119db70305c95c0956
- SHA512 10da6232e137cdb09e857473d7d576940a2808723506eb208fb44b69f0ca70d9f572a60b77a63f8968cbe10981be200e1bd341d2ace63d6262fd1fe4dfd11c25
- SSDEEP 1536:O7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx+:fCSjGoLpWM6bblmjx+
- TLSH T124731A55B28DB372C0F699B89E0DF1E5BC257E301E19186BB5AE3F0DDA7B1C2190C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCXE6C.tmp
- Size 75KB
- SHA256 994d6d1cebbda2d58efff3abc77336ef40b52a14467e75bae819a8ad15762757
- MD5 622c075cf780f8a4c8f799b50dcff575
- SHA1 eb562bc84c04e1118c28b128af85bb2c239c9b2f
- SHA512 694eaea6a3b28bd83cf0dae865b811e7abab2abde9390a717ae5795b78b0b86d8cb0c7bd652d81b882160eac270386f42361d9fbab397f61ecafaf5b79ce2926
- SSDEEP 1536:O7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxe:fCSjGoLpWM6bblmjxe
- TLSH T1DF732A65B28DB776D0F299B88E0DF1E5BC287E301E19186FB69E2F0DDA770C2550C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXEAC.tmp
- Size 75KB
- SHA256 f559154c3f178db561ec82a271c9c1c0160ce71afe6afb2234c7d9c9a596e778
- MD5 dc288c5c8a0ee4dec8b8a775e13a20a2
- SHA1 be4d79bd34ce2d8106b40681c61f58fa616d02ef
- SHA512 e12f62c995c3c3e4be9ec7e8632bd5ceedeab01c26319105efcca7745b981129ddc15189c9b11c55a3802087bb26e940c1f49bbaaff10496cb58bfe9430a651c
- SSDEEP 1536:W7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxH+:HCSjGoLpWM6bblmjxH+
- TLSH T1F4732A65F28CB776C0F299B88E0DF2E5BC247E305E29186BB59E2F0DDA7B1C2550C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a6C13.bat
- Size 902B
- SHA256 099baa236de8192410f67f0e5c8245ab09491f34fcf1e08cc990597488acfab4
- MD5 fc15aa6a585e5488adddf29467549b9c
- SHA1 3227c49e2b94a90b120183b45966fb1f07bf7cd2
- SHA512 727eaeb0c83d476928d647a13a6bb9adcfa99294dbabc68633340cf873c769f90b58ee2a56ee58d2db88d5d7f05ccc38c16015530a084ba7064f86ebca01259b
- TLSH T1F0110C22C3B6D79E4421E06A0666EDD9C802224C3F4D3332A71EC00F21F5C2CF65275B
- MD5 SHA1 SHA512 TLSH
2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Size 241KB
- SHA256 66adbdbd251a5b9c37bc1448952e56e99c3b4ab7893aebdac0662ed987f24781
- MD5 3052548c3fba7473d5a4eecf2c59c3ec
- SHA1 eaefaeb0b0b24f7ea2c706a06cbf081aafad7c72
- SHA512 570e9186096568b85fc94194264f874d9dc55249f6ef6c00031eec8924bd8977549cef57d8657b9d84c01fbec9335608f14c9c6677573c11e9d33deb8bb8b545
- SSDEEP 6144:fzAVQiI+WjFDfoY9+6s6Be/ODsTnJyQlnutM:fcQiHmNJLB9unmM
- TLSH T139346B7DB39409F9EC6B813CCDA28516E67278560360E6DF13A486261F733D06E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 89KB
- SHA256 f8b17fbe57fdb1da07e505ddcf47ed404664ca9ed1a3539b8507c12999564840
- MD5 7c586fea078d90b482ee1c6cd2adeadc
- SHA1 9cb6ebda61399a52ee8846f66eb01d4050567b95
- SHA512 19dc3be88e4a40961665d4b8bb9bf2bf080ae213648b27c3170da94b2cfea13d9c8ae0a35d7ee2b7916db5a7e02920d1c9ba68edd259d33682f9082c086282f0
- SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxfWt8Nj:DCSjGoLpWM6bblmjxrNj
- TLSH T1B693286AB28CB3B2D0E295BC8E0EF1E1ED353D201F1558DB72AA1F1D9A775C2153C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH