Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/05/2026, 02:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 1.3MB
- Sample260507-cmnpjsdy2w
- SHA256 e168a1ef8d1ff59c9d638cd97c67e64eea2a2e04351ec47a4733a65e4fbcf471
- MD5 80a5a61ed8ca1a62294a7af735f18ffd
- SHA1 7a1b5dc458a5d23df03c1ee289a62e67bcf13091
- SHA512 60f876e876ac8b6c4e490c4404b80acad0933ff1d7aa893a753ede038ba9815cd044137585c8d9792b516aa5484ecab56e792b05163c0ac2a0574e173aa70f94
- SSDEEP 12288:rCYNXb/7t0iUk2E+UiOS/osQbCP+V/7h0L6unnOPl4jK7en3mawkfd8PzH4qLiao:u8/7t0ib+UiF7ACE/UmafSLi4euLHa
- TLSH T119556B17B69C73E8D0EED1788A4DB275ED727C510B34AADF0690B2191E37AE05B3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (256) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe - Executes dropped EXE 3 IoCs
pid Process 4996 Logo1_.exe 4384 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4664 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\RCXB51D.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe.Exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE.Exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83296\java.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCXB34A.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXB5CE.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCXC11A.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe.Exe Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe Logo1_.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Logo1_.exe 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe 4996 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4220 wrote to memory of 4352 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 84 PID 4352 wrote to memory of 4484 4352 net.exe 86 PID 4220 wrote to memory of 3484 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 87 PID 4220 wrote to memory of 4996 4220 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 88 PID 4996 wrote to memory of 3696 4996 Logo1_.exe 90 PID 3484 wrote to memory of 4384 3484 cmd.exe 92 PID 3696 wrote to memory of 4448 3696 net.exe 93 PID 4996 wrote to memory of 1152 4996 Logo1_.exe 96 PID 1152 wrote to memory of 3960 1152 net.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:4484
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a248A.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"3⤵
- Executes dropped EXE
PID:4384
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4448
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3960
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4664
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe
- Size 1.2MB
- SHA256 e6b86cbe7dfb3a1c24d8584cea610f62f42fa432b32924a4b93cc33e88a2639f
- MD5 783512c08aabb651063411d04a9223db
- SHA1 559ec3a67a505452490d924ad7c1654d9edb073c
- SHA512 3ce6f3ff75caf3fc2fad73e2a048c55c8a7399bce272d0259c6902b42f2ce132acf8d7106e7fe72d13e5beae632f29587fcc731824e7fb4f33dbd8d10541686d
- SSDEEP 24576:W6Sgouvz0ZRHkFfenxyQZXS7gZnQh2NIq:W6SgouvAeFfenxyQZXS7uQ0NIq
- TLSH T1D155C40267FD7329F1F37B71EABDB2645E767C61AE39C50E5284025E09B0A909A31733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXC044.tmp
- Size 103KB
- SHA256 58f0fceccd2b180e9f1e78fee4f9b8691f740e9fc5af2c12d4355f6845fd297c
- MD5 d644c902a97f295193ff6cdedc082e56
- SHA1 ccb6716b9bea90c428a729da2044f4e4a0f9e28c
- SHA512 cf5b1ce29a72d4ab3c25adddfd7c688e39cb1dfd4ad755756408b5f4eaa80cf23f069f50dc66ceacac0f4f4b599a4d5921f5d6ff742ff2271b8f94dfb7ee3b12
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxp8m3G5QGPMLM1XkSPsULMHicNQ:YCSjGoLpWM6VbBgjxpxi3MAdtPlLqJu
- TLSH T152A37B1AB28DB376C0F299BC8E0DF2E4BD397D201F19186BB29D1F0D9A775C2590C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXC0F7.tmp
- Size 91KB
- SHA256 391d0ac21de97adc0f4bc834ad3900a2f3e9ff51f8e14b7979f56b16490a6cb3
- MD5 cf0159750884addb82b7eadfce3eef42
- SHA1 f0fcfe4c4c5b2af3bc497ff398b25ece6d028ba9
- SHA512 38b43e440a06923c0588754ab03c2ce82f456ded1c5a7ae3b19eb76e159a2053298368985123d5f4965fb74bcbf5d5e28ea53915d7922348ac5c597001d14249
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxz8m3G5QGPMLVNT:ACSjGoLpWM6VbBgjxzxi3Mx5
- TLSH T1D7934B5AB28DB376C0E299B88E0DF2E5BD797E301E29086FB19D1F0DDA771C1590C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXBF26.tmp
- Size 118KB
- SHA256 1258060dc2832a856233f3a6d07eb1c12befaf2a29fab42a43a99896d452ba0b
- MD5 fb2e88b644a7883896214e16a585f8e2
- SHA1 184b2265fbc1f7aded227e77daa6263d5a249e2b
- SHA512 84aec6e9e5e54e97c47ca4efd95d52124ef4f53b3e451fdc2754386ab20e0a7441aeb0fa2279a208367245e531772f13cced6b25c6d308062c50e27de39eecb7
- SSDEEP 1536:M7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxz8m3G5QGPMLx4GZjzQwK5WW7VCG:FCSjGoLpWM6VbBgjxzxi3Mje5BV0eH
- TLSH T1A0C3AE5AB28CB377C0E199B88E0DF2E5BD697E301F29085FB5992F0DCA7B5C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 c4205f5ff711ccb1034b30e2dc42138708b48809f140fa12523c06666811bc3a
- MD5 1045111c58fb89f8bd86fa3c327dd188
- SHA1 a52bc4cdabb1b49717932cab727d012663d1bb94
- SHA512 45b91ce0fb0e454a785cc36ae66811c30feb42f5ab5423ecc4228f31652f7774c8529dc80e28e3fadaf10cd5d5a7a59bf5c440e45f8c3d51210a88e6b65fd890
- SSDEEP 12288:rCPXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:uB0Le5ji0hmxNrM
- TLSH T101E4F715F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286876C6E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCXB1E8.tmp
- Size 91KB
- SHA256 86203aa17e0d0c597a4e352a04d72970c7312a1acfb39939f94cb7a82719560b
- MD5 9fc80b96d4a479884b617f8ce7251409
- SHA1 3d8a91da161f89884d30b70f63a98bb381cfa47b
- SHA512 b6dfb19874e55d5502e3e2ecee09ab10cd436c6ca301be65dd36879445ea1f1a8e67b1aff5cc6d2466921bfe03d1c29826865398ca0594ee167d2b7f783449d2
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxo8m3G5QGPMLxNb:oCSjGoLpWM6VbBgjxoxi3M9B
- TLSH T14E935B5AB28DB376D0E199B88E0DF2E5BD793E301F19086FB1AD2F0D9A771C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXB2D9.tmp
- Size 92KB
- SHA256 5c91e0e6ccda57e069417422c5156634a5ff5bf4d513651e363c4c3cd0cbfa84
- MD5 036ac411861117d8188fb9865d454270
- SHA1 a4ffd97b41d4a1afc90a70920bdf8fdba2877254
- SHA512 b3c6c16556cc73ea1a8f13be084d148a8c3c522fd4cb722dcd199e0868854a3b1ec045cf84d39ff5ea2c6089cb59ef19032df62c6e76671a96f77b4dc8ce0d72
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxQ8m3G5QGPML8NL:wCSjGoLpWM6VbBgjxQxi3Mgx
- TLSH T1FC934C56B29CB376C0F199B88E0DF2E5BD797E301E19086BB1AE3F0D9A771C1590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe
- Size 4.3MB
- SHA256 f1307a0d5e5db68997d137af1c5ce9cce1e5c8a021620759a891c325f151fa71
- MD5 7bec74c6d9b330c1d32d87155c104d10
- SHA1 4a85e50585283434ca11d654e89e013b82dfab11
- SHA512 c0ff5e6b1e126dfeeeeae2e09abe3a2781fcbefd57d5d6eabac852bb42e9cdd7a69cc4b28dc7c5ec6dcb54db98376bea939e1da7ef22196aede579004ea7a57e
- SSDEEP 49152:ItQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3Tf:sQvGAdlCEL8c/bRNw5CO
- TLSH T106263A656BEC91F5E0E7D134897A95B2FB7A7C020D32EB4B0151CA2F2F336904D29729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.Exe
- Size 554KB
- SHA256 2d28110e25fa95e1982ba3b8682a00a9b945bfc08be477b710cf4ceb7ef011b6
- MD5 7c1a2e3bf2a36c42e134f81b245e8bb5
- SHA1 6b080ce4ec0ded8eca60e0d6a3b37ae59650df9c
- SHA512 2c9cdc4a8d8df25a5820b5ec2baa477800f16eec8d40bf3fe6977fa34f5b3310f6c11beb3710ce39a5ed7f0706a8538432a30580929716db245d7713e17d7eff
- SSDEEP 6144:GXq1gwi3fzyiL7nVDcmdCI6BHAlSpFG/+Ls3ze30xLs+br0YzirzhafYmf7Pvm7t:bCbDnVDcmd/6JAB/6N30xQ+hpvm7Mgj
- TLSH T19CC4292132EDB318C8FB1B70DC3DB6812E767EA56D81C6AE29543B6D4D723428311B97
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\RCXB5CE.tmp
- Size 100KB
- SHA256 2f67b2e20f4860f4e1166281e1727a491b54eed9487a9e6a458cf4b728f767c0
- MD5 fcea787de4e5ab709862279c79d2c72d
- SHA1 94521f49f0989adde51310d6002f31ec47a014f1
- SHA512 226827833143a74b8279037e34f1690d227c111e66c0ae741a58fc4103da32a68ba9589bcb0945829c2ef7326c792dcd96382a9886dd60d18e6a8b7cb54e2d2d
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxO8m3G5QGPMLeqkSZZZ3tNj:4CSjGoLpWM6VbBgjxOxi3M0UtJ
- TLSH T132A35B16B68CB3B6D0F189789E0DF3E5BD357D301E69186BB2AD3F0D9A77182190C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCXC5EA.tmp
- Size 92KB
- SHA256 bbadef99a65f202778c81f9796149beaf495df7202c9c7aec55e4dbddd445f32
- MD5 366a9e9a80877d071b0eecbfc93cdd90
- SHA1 6df06411a5fdaaf295cacdcacb953bab414de35a
- SHA512 209823d9574899f86974b2916f14759f1b964ed66a6b809152b593169d82fad418c66e4bd97e5cf5e0ff34b110f8f5ff7f683ac443fb36ce4b3274d240ba97e7
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxO8m3G5QGPML0Nr:YCSjGoLpWM6VbBgjxOxi3MYR
- TLSH T1BE935C6AB28CB376C0F199B88E0DF2E4BD797E301E29186BB29D1F0D9E771C1590C195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a248A.bat
- Size 902B
- SHA256 11b998e59679abe8d8769b62cedfd256eacf4519be04f1b41b312d1a95f22fc4
- MD5 0379a36e704cdd72a2f468ccecaf7cf7
- SHA1 16834a433d28a5bbe58f1cb465d60f9a301864b1
- SHA512 2b4dbca3cf74cc6b730415866523db8432458c8a0aaae922188d88519012f5d682094c24c79817334376d3f60f5f2d62625ca13c756d51ac7d835691384b913d
- TLSH T1F211EC36DEA5DAFB843AB01317919D8EC55B271C2B193311570EC80D50E1C8DBAB731A
- MD5 SHA1 SHA512 TLSH
2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Size 1.2MB
- SHA256 9f7f04ce2bae3e76e41ddc706f9c1cc35405a1d21c488fe4f81eb89fdff51907
- MD5 044cafeb287abc6a500c821b547d32f0
- SHA1 595fb18d1e5c64f60737cbc1061285cc2374dc88
- SHA512 683475098a9dc2b072427ce3a240ebf45c1201ca0ebbc8933bfcd74a5875716b82f201c1b0751c559313d00ca4990c323fa22974ddd7528654290ff36814b84f
- SSDEEP 12288:4NXb/7t0iUk2E+UiOS/osQbCP+V/7h0L6unnOPl4jK7en3mawkfd8PzH4qLiaveZ:c/7t0ib+UiF7ACE/UmafSLi4euLHa
- TLSH T1F4458D17B79941E8D02ED178C7458236EA72BC520B74BADF0690B3592E37AE46F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 791b8416bc35cd704ed0d7450e3c8534ab0c50a7d946632614285e6302761e99
- MD5 ee64d93cc510c937a8e73fa6b15e2141
- SHA1 636dba105cbe6243406015702451d224a2e9fd44
- SHA512 0836e35679a580faf2dccf52d643f1b12b78cf01f8d7dd61edebf9d9941de44325e86d8d048dab4d71aee07b88328f93afdedd44381515f0d23eb9b34bfcff38
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxw8m3G5QGPML3Na:4CSjGoLpWM6VbBgjxwxi3Mz4
- TLSH T107933B65B28CB376C0EE99BC8E0DF2E4BD697E300F29085B759D2F0D9A7A1C1590C18D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH