Analysis
- max time kernel
118s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/05/2026, 16:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 2.0MB
- Sample260506-txw74set9y
- SHA256 453747dd29ae548eb40fec369f1fafb681ac5980f203aca990a07c2aedc177a4
- MD5 6235dd79917d4732d27f84c3f2a50f3b
- SHA1 38e65c3f65342ab702b57277cdeb13854eae82f6
- SHA512 40deeb598bacef7f5729e0bde6cf1328e2866bd1eab6bdd846cc7f32c85234c8e63d71c1bd7416bf556f676e450ce696f33cfe777a116a2f76f7eeca993b06b2
- SSDEEP 12288:EZ41TtTuRWny8d+roTfREZW9Ax3K8CbEcieT6O48OwgIk55bCu/8huoMTJ/8rov/:ftTuRWFsronbEqa6+GG8yKrO4c
- TLSH T103A58E1BB79400E8D42AC175CB654236E672BC560B30AADF06D0B3692F77AF46F3A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DetailsList\DetailsHeader.base.js 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCache.scale-125.png 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f3\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\d3d11\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x64__8wekyb3d8bbwe\AppxMetadata\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\edge_feedback\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.tmp 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\wlibim.tmp 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-sl\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2021.2101.27.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OARTODF.tmp 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ar-ae\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.tmp 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\SKY.INF 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\ThankYou\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsPowerShell\Configuration\Registration\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\9BB1FE05-B059-441D-A805-F3CD7E47FEC8\root\vfs\Windows\assembly\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\GameBarWidgetUI\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_~_8wekyb3d8bbwe\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.tmp 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\tr-TR\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SnipSketchAppList.targetsize-32.png 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\FileAssociation.targetsize-256.png 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\Product-onecore__Multimedia-RestrictedCodecsCore-WCOSHeadless-Package~31bf3856ad364e35~amd64~~10.0.22000.493.tmp 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Data.Services.Resources\3.5.0.0_es_b77a5c561934e089\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ja-JP\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..rofessional-license_31bf3856ad364e35_10.0.22000.348_none_7744f0e97b18358e\f\Professional-Volume-CSVLK-5-pl-rtm.xrm-ms 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Branding\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Linq.Expressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\Microsoft-Windows-Client-Desktop-Required-Package0112~31bf3856ad364e35~amd64~sk-SK~10.0.22000.469.mum 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f9a5e83#\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Boot\EFI\el-GR\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Security.aspx.es.rtmp 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_0f681b8c9b834caa\f\PinningConfirmationDialog.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.contmp 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.Entity.Resources\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Core.Presentation\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\Microsoft-Windows-DirectoryServices-DomainController-Tools-Client-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.434.mum 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\INF\ServiceModelService 3.0.0.0\0C0A\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\it-IT\helppane.exe.mui 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\EventViewer.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.FileSystem.DriveInfo\v4.0_4.0.0.0__b03f5f7f11d50a3a\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\v4.0_1.0.0.0_fr_31bf3856ad364e35\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\MiguiControls.Resources\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.SecureString\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.xml.resources\v4.0_4.0.0.0_de_b77a5c561934e089\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\IIEHost\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\microsoft.isam.esent.interop\v4.0_10.0.0.0__31bf3856ad364e35\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.EventBasedAsync\v4.0_4.0.0.0__b03f5f7f11d50a3a\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe.contmp 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.contmp 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\v4.0_10.0.0.0__31bf3856ad364e35\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.tmp 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\diagnostics\system\Networking\fr-FR\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\v4.0_3.0.0.0_it_31bf3856ad364e35\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..component.resources_31bf3856ad364e35_10.0.22000.120_sv-se_61fc8a388702693e\f\setup.exe.tmp 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mff1be75b#\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\v4.0_1.0.0.0_fr_31bf3856ad364e35\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity.resources\v4.0_4.0.0.0_de_b77a5c561934e089\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\System.Management.Automation\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Security.aspx.es.resx 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMDiagnostics.Resources\3.0.0.0_it_b77a5c561934e089\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe.maniftmp 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0000\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\v4.0_10.0.0.0__b03f5f7f11d50a3a\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Tools\v4.0_4.0.0.0__b03f5f7f11d50a3a\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WindowsBase.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..glelanguage-license_31bf3856ad364e35_10.0.22000.348_none_30cddf197099fd6a\f\DefaultPpd-CoreSingleLanguage-ppdlic.xrm-ms 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\c79ccbcb416c7910b28254a822d133f6\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\diagnostics\system\WindowsMediaPlayerConfiguration\fr-FR\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Instrumentation.resources\v4.0_4.0.0.0_it_b77a5c561934e089\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\GAC\ja\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_it_31bf3856ad364e35\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Data.Entity.Resources\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\INF\mdmvv.inf 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4320 2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4320
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.ecle
- Size 32KB
- SHA256 ce5306fc9740622a5dd06f751051edbf61bb9ec3cacd38fa006a9b3271d3390e
- MD5 74f1d60711d6a4b9a09115809f3f4c07
- SHA1 c87ba2163ff37ceed7bd708e3cf903f57eb96ded
- SHA512 b512d4ebece673a91ff57a7ae40da9c649afa25cdf9e776b4a39a9d66bb8015f15443338627713f8f4de99c115df1e62e6167ebcabd082936015ce3eb5e3e56d
- SSDEEP 384:OidyDBQVcNEbmCXaQ4x/VC0TSz0gCaNwKdtpFIdUXJ/nCyEUGh6JD004R+i7:LdytQ7bzb0vgCa2Kdtp2dUXFCvEpQIm
- TLSH T1B8E26322F54C847AF214C6F219A9969674263D310A90CD1BB789BF6D2EB40D3B8F071F
- MD5 SHA1 SHA512 SSDEEP TLSH