Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
07/05/2026, 02:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 1.3MB
- Sample260507-cmnpjsdy2w
- SHA256 e168a1ef8d1ff59c9d638cd97c67e64eea2a2e04351ec47a4733a65e4fbcf471
- MD5 80a5a61ed8ca1a62294a7af735f18ffd
- SHA1 7a1b5dc458a5d23df03c1ee289a62e67bcf13091
- SHA512 60f876e876ac8b6c4e490c4404b80acad0933ff1d7aa893a753ede038ba9815cd044137585c8d9792b516aa5484ecab56e792b05163c0ac2a0574e173aa70f94
- SSDEEP 12288:rCYNXb/7t0iUk2E+UiOS/osQbCP+V/7h0L6unnOPl4jK7en3mawkfd8PzH4qLiao:u8/7t0ib+UiF7ACE/UmafSLi4euLHa
- TLSH T119556B17B69C73E8D0EED1788A4DB275ED727C510B34AADF0690B2191E37AE05B3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 3 IoCs
pid Process 1548 Logo1_.exe 1916 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 3132 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\RCX9177.tmp Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX9026.tmp Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxAccounts.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX998F.tmp Logo1_.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCX9EC1.tmp Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\dotnet.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe.Exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxTsr.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\WeatherStub.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX9BA8.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCX9E7B.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe.Exe Logo1_.exe File created C:\Program Files\CompressExit.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCX9EC0.tmp Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX8EA3.tmp Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe File created C:\Windows\uninstall\rundl132.exe 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe 1548 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2572 wrote to memory of 5072 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 78 PID 5072 wrote to memory of 4584 5072 net.exe 80 PID 2572 wrote to memory of 6012 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 81 PID 2572 wrote to memory of 1548 2572 2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 82 PID 1548 wrote to memory of 2132 1548 Logo1_.exe 84 PID 2132 wrote to memory of 3996 2132 net.exe 86 PID 6012 wrote to memory of 1916 6012 cmd.exe 87 PID 1548 wrote to memory of 1832 1548 Logo1_.exe 90 PID 1832 wrote to memory of 5212 1832 net.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:4584
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"3⤵
- Executes dropped EXE
PID:1916
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3996
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5212
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3132
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX99DF.tmp
- Size 156KB
- SHA256 5f8e54efec937711b90eaf881c41fe778eeac85d1fbd24275895b2c8a2e07865
- MD5 d762e15c65938f303bfb76e3f19bec90
- SHA1 24902b75fb50a598c6f99eb2a9ae7d6f520140b4
- SHA512 212012601dd7aab067bd2c290797748865dd3ca888ad498e85c8839d813768d3bff2cabebc409105b3e9b0386be7879da324f0c0cea95909e573a4abe343762d
- SSDEEP 1536:E7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxT8m3G5QGPML1Nz:dCSjGoLpWM6VbBgjxTxi3MpZ
- TLSH T13FF3C32EB18FB3F6C3E1597C8D1DF294ED29FE20CE19285B75993B0E9A7A1C34508191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX9BA8.tmp
- Size 94KB
- SHA256 b186ba7e865604ef0433614800e654bc57e8ed8a1050d1309ba6f7dd005443c1
- MD5 6bf23aadbe70189bcf06e5ce8c135e0f
- SHA1 5d1cce53678f9b3f86d6a7cd1b8b3472f7e7e697
- SHA512 7cea34daf008f4c4170d2f43bcf826ec3fe03801afa0c3102bc57b089cd9f5b0b0281dff1ea669cb9903ef48ae2fd6c79f0be6747476c988bdf009f862bf8807
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxw8m3G5QGPMLOND:ACSjGoLpWM6VbBgjxwxi3Map
- TLSH T190933A56B28CB3B6C0E199BC8E0FF6E5BD657E201E2D089FB1992F0DDE7A1C1590C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX9E2A.tmp
- Size 103KB
- SHA256 58f0fceccd2b180e9f1e78fee4f9b8691f740e9fc5af2c12d4355f6845fd297c
- MD5 d644c902a97f295193ff6cdedc082e56
- SHA1 ccb6716b9bea90c428a729da2044f4e4a0f9e28c
- SHA512 cf5b1ce29a72d4ab3c25adddfd7c688e39cb1dfd4ad755756408b5f4eaa80cf23f069f50dc66ceacac0f4f4b599a4d5921f5d6ff742ff2271b8f94dfb7ee3b12
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxp8m3G5QGPMLM1XkSPsULMHicNQ:YCSjGoLpWM6VbBgjxpxi3MAdtPlLqJu
- TLSH T152A37B1AB28DB376C0F299BC8E0DF2E4BD397D201F19186BB29D1F0D9A775C2590C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCX9E7B.tmp
- Size 91KB
- SHA256 391d0ac21de97adc0f4bc834ad3900a2f3e9ff51f8e14b7979f56b16490a6cb3
- MD5 cf0159750884addb82b7eadfce3eef42
- SHA1 f0fcfe4c4c5b2af3bc497ff398b25ece6d028ba9
- SHA512 38b43e440a06923c0588754ab03c2ce82f456ded1c5a7ae3b19eb76e159a2053298368985123d5f4965fb74bcbf5d5e28ea53915d7922348ac5c597001d14249
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxz8m3G5QGPMLVNT:ACSjGoLpWM6VbBgjxzxi3Mx5
- TLSH T1D7934B5AB28DB376C0E299B88E0DF2E5BD797E301E29086FB19D1F0DDA771C1590C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9CFA.tmp
- Size 118KB
- SHA256 1258060dc2832a856233f3a6d07eb1c12befaf2a29fab42a43a99896d452ba0b
- MD5 fb2e88b644a7883896214e16a585f8e2
- SHA1 184b2265fbc1f7aded227e77daa6263d5a249e2b
- SHA512 84aec6e9e5e54e97c47ca4efd95d52124ef4f53b3e451fdc2754386ab20e0a7441aeb0fa2279a208367245e531772f13cced6b25c6d308062c50e27de39eecb7
- SSDEEP 1536:M7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxz8m3G5QGPMLx4GZjzQwK5WW7VCG:FCSjGoLpWM6VbBgjxzxi3Mje5BV0eH
- TLSH T1A0C3AE5AB28CB377C0E199B88E0DF2E5BD697E301F29085FB5992F0DCA7B5C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXA002.tmp
- Size 100KB
- SHA256 2f67b2e20f4860f4e1166281e1727a491b54eed9487a9e6a458cf4b728f767c0
- MD5 fcea787de4e5ab709862279c79d2c72d
- SHA1 94521f49f0989adde51310d6002f31ec47a014f1
- SHA512 226827833143a74b8279037e34f1690d227c111e66c0ae741a58fc4103da32a68ba9589bcb0945829c2ef7326c792dcd96382a9886dd60d18e6a8b7cb54e2d2d
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxO8m3G5QGPMLeqkSZZZ3tNj:4CSjGoLpWM6VbBgjxOxi3M0UtJ
- TLSH T132A35B16B68CB3B6D0F189789E0DF3E5BD357D301E69186BB2AD3F0D9A77182190C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCX8E14.tmp
- Size 91KB
- SHA256 86203aa17e0d0c597a4e352a04d72970c7312a1acfb39939f94cb7a82719560b
- MD5 9fc80b96d4a479884b617f8ce7251409
- SHA1 3d8a91da161f89884d30b70f63a98bb381cfa47b
- SHA512 b6dfb19874e55d5502e3e2ecee09ab10cd436c6ca301be65dd36879445ea1f1a8e67b1aff5cc6d2466921bfe03d1c29826865398ca0594ee167d2b7f783449d2
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxo8m3G5QGPMLxNb:oCSjGoLpWM6VbBgjxoxi3M9B
- TLSH T14E935B5AB28DB376D0E199B88E0DF2E5BD793E301F19086FB1AD2F0D9A771C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\CompressExit.exe.Exe
- Size 1.1MB
- SHA256 8b71991763606dd21de3f93724b9d89fca799bf4a147f6fbd10f38807ffba5e4
- MD5 9e79d61d6a65f9c1f82ff28057aff0ec
- SHA1 de504cc5ad9225e7fa10e3963bb8b1745f5a9058
- SHA512 a17cd5e3945eb6f293124fea42a21c2839a92e6b3d58da3aa060825a7d2ed1ee1b33343ca9ffa3881c7304eb802787afbcc302203cdeadefce0987f22038e367
- SSDEEP 24576:ukBuGpBKirQ9JQc7vJ6OYpzKDl2o9HlsFcaSk0HT6bd3p:uliTh8ghQll9FIVSk2SZ
- TLSH T14145235AB0DCB379C1EE85BD9E0DF1A1FD1A7E210F0C845BB5682F4E597B8424814ACE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX8F34.tmp
- Size 92KB
- SHA256 5c91e0e6ccda57e069417422c5156634a5ff5bf4d513651e363c4c3cd0cbfa84
- MD5 036ac411861117d8188fb9865d454270
- SHA1 a4ffd97b41d4a1afc90a70920bdf8fdba2877254
- SHA512 b3c6c16556cc73ea1a8f13be084d148a8c3c522fd4cb722dcd199e0868854a3b1ec045cf84d39ff5ea2c6089cb59ef19032df62c6e76671a96f77b4dc8ce0d72
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxQ8m3G5QGPML8NL:wCSjGoLpWM6VbBgjxQxi3Mgx
- TLSH T1FC934C56B29CB376C0F199B88E0DF2E5BD797E301E19086BB1AE3F0D9A771C1590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCX91C9.tmp
- Size 91KB
- SHA256 0eaad16c57698eb2ab84901d79bc3c4c197922baef618c615f0be79e03a4233a
- MD5 0be9c52c662ae410856264b46ae7d290
- SHA1 96df2cdeb02d0ba5e0943e9896706474da267451
- SHA512 1d9253295ebde2bba156f2adcfaf343f6b989d31c91ff8370c1380bb6047489262c8118f549b8fa448ff7d02d681d2f3c1d2cde530cae8edd31a1e276ae2e686
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxI8m3G5QGPMLXNL:wCSjGoLpWM6VbBgjxIxi3MTx
- TLSH T1C8934C56B28CB376C0F1A9B88E0DF2E5BD697E300F19185BB5ED2F0D9A7B1C2590C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$aB7.bat
- Size 900B
- SHA256 13f2a7e57669419a251a5f71e4ff1c3664247b48f17d2d9ddf6bba0e7bbaf60a
- MD5 b29d37fff993db5a6a9cbcc80d0acb9e
- SHA1 9cd291908061e3073681ff2e48ab33bd558facfb
- SHA512 67ed44d1c8dd796187b95397142d91acfbaea872d21c4039a2ff0ea3092635ff1e81fb5a66bbf5a79db745b6b3d8740d1a538e4e16bbab3a23074dcfb23e6c67
- TLSH T1EB11EC36CD95DAFB843AB01307919D8EC55B271C2B193311570E880D50E1C8DBAB731A
- MD5 SHA1 SHA512 TLSH
2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_80a5a61ed8ca1a62294a7af735f18ffd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Size 1.2MB
- SHA256 9f7f04ce2bae3e76e41ddc706f9c1cc35405a1d21c488fe4f81eb89fdff51907
- MD5 044cafeb287abc6a500c821b547d32f0
- SHA1 595fb18d1e5c64f60737cbc1061285cc2374dc88
- SHA512 683475098a9dc2b072427ce3a240ebf45c1201ca0ebbc8933bfcd74a5875716b82f201c1b0751c559313d00ca4990c323fa22974ddd7528654290ff36814b84f
- SSDEEP 12288:4NXb/7t0iUk2E+UiOS/osQbCP+V/7h0L6unnOPl4jK7en3mawkfd8PzH4qLiaveZ:c/7t0ib+UiF7ACE/UmafSLi4euLHa
- TLSH T1F4458D17B79941E8D02ED178C7458236EA72BC520B74BADF0690B3592E37AE46F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 791b8416bc35cd704ed0d7450e3c8534ab0c50a7d946632614285e6302761e99
- MD5 ee64d93cc510c937a8e73fa6b15e2141
- SHA1 636dba105cbe6243406015702451d224a2e9fd44
- SHA512 0836e35679a580faf2dccf52d643f1b12b78cf01f8d7dd61edebf9d9941de44325e86d8d048dab4d71aee07b88328f93afdedd44381515f0d23eb9b34bfcff38
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxw8m3G5QGPML3Na:4CSjGoLpWM6VbBgjxwxi3Mz4
- TLSH T107933B65B28CB376C0EE99BC8E0DF2E4BD697E300F29085B759D2F0D9A7A1C1590C18D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH