b6906d68b595790ff42f45183380cb1644613d9aaad2c5bdc41c757dfc16e53d

Analysis

max time kernel
149s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 2.0MB
Sample260511-ba58dsct2j
SHA256 b6906d68b595790ff42f45183380cb1644613d9aaad2c5bdc41c757dfc16e53d
MD5 20d4ae46d6b9fc4f675a796d10e984a0
SHA1 995ce990e9db4ae6a4c5e9345c79c2b0cd27c923
SHA512 5b53db0ebbd9f8bf8274da2330761645d6f7a08215d7859c17f11e164843f5088fb79d1654a6d4110e52334cb3af7dddcd423c145949ab59ddf76d0830bda26d
SSDEEP 49152:wabH/habH/g69dsTh7IwVT28foh0Y1oQTM3NCLT7:R7Iw12880rCz
TLSH
T194A57C11B7809862D86A893078B5C71B6B35BDA12B50C6FB7396B34C1E337D2A97431F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
468	UpdatAuto.exe
2520	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3880	sc.exe
3748	sc.exe
2588	sc.exe
5900	sc.exe
1352	sc.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1072	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
468	UpdatAuto.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 2324	1072	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	80
PID 1072 wrote to memory of 468	1072	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	82
PID 468 wrote to memory of 1524	468	UpdatAuto.exe	83
PID 1072 wrote to memory of 2520	1072	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	85
PID 1072 wrote to memory of 576	1072	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	87
PID 1072 wrote to memory of 3792	1072	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	88
PID 1072 wrote to memory of 4048	1072	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 1072 wrote to memory of 2028	1072	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	90
PID 1072 wrote to memory of 5376	1072	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	91
PID 1072 wrote to memory of 5856	1072	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	92
PID 1072 wrote to memory of 3304	1072	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	93
PID 1072 wrote to memory of 3748	1072	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 1072 wrote to memory of 3880	1072	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	95
PID 1072 wrote to memory of 1352	1072	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	96
PID 1072 wrote to memory of 5900	1072	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	97
PID 1072 wrote to memory of 2588	1072	2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	98
PID 576 wrote to memory of 4684	576	cmd.exe	111
PID 4684 wrote to memory of 668	4684	net.exe	112
PID 5856 wrote to memory of 1164	5856	cmd.exe	113
PID 1164 wrote to memory of 3788	1164	net.exe	114
PID 3304 wrote to memory of 864	3304	cmd.exe	115
PID 5376 wrote to memory of 2236	5376	cmd.exe	116
PID 4048 wrote to memory of 3972	4048	cmd.exe	117
PID 2028 wrote to memory of 5016	2028	cmd.exe	118
PID 3792 wrote to memory of 5892	3792	cmd.exe	119
PID 864 wrote to memory of 3560	864	net.exe	120
PID 2236 wrote to memory of 4040	2236	net.exe	121
PID 3972 wrote to memory of 2740	3972	net.exe	122
PID 5016 wrote to memory of 3952	5016	net.exe	123
PID 5892 wrote to memory of 1624	5892	net.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2324
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1524
- C:\Users\Admin\AppData\Local\Temp\2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:668
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5892
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:1624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2740
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:3952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5376
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:4040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:3788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:3560
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3748
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3880
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1352
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5900
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.3MB
SHA256 48e8857d291c5c06e51812690604bf6b18fe253b0d8825ad82c21e129d07cdb8
MD5 0d217cb8abfd0c6814e5d9dc7a27606e
SHA1 b50cc3cae28dfb5293327e61fc12eb2dcbf31137
SHA512 689dd1e59fa88a9ef02469d0d1f3e1f002aaa7ed1e389e13a198638f39fc2f0991e7daf07380dd6f64186db7b8a555ce5cd67fc61e7cb93e46a085d3bc51bc15
SSDEEP 49152:wabH/babH/g69dsTh7IwVT28foh0Y1oQT+Pji0Aj:37Iw12880Jjo
TLSH
T1B9B56B12F7908622D4778470A8E5D71AAB317D911B60CAF76386F35C2E337D2A93532B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.7MB
SHA256 11a0d1dddd413e4fefd59aa35a7d104ca92397ed0671deea5de32fc2cbc2a54f
MD5 e98e279f63dcfddee3d1804857d6c3d0
SHA1 7de75ac064905586a3e2270fbcd2deab02304efa
SHA512 ac48c965743b360c25bf434bacb37a5e25fabacc454ca3d7c2ff9b3067cf4648a4daf7571c02cb6cc4b3349c138c741948d3db9d8b5773ae4428b4804f47ef2e
SSDEEP 49152:wabH/babH/g69dsTh7IwVT28foh0Y1oQTh/ezSC6vUzPvMHjy:37Iw12880CezSC6v2XMH
TLSH
T180D55A11B6648623D4B6C471E8E6A75ABF317C921B20C9FB1346F35C2E337E2953532A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.4MB
SHA256 095b3348edde01b2a0a83b73ad87744e0dbc3255b63c878ca4e83b544be3c33e
MD5 8254b941273f1c8bd52711337d7abe8b
SHA1 f52b82ac14ea399cbb0098c550d5f28ec0e03107
SHA512 90385665a4576b5166b8a4f9bf10e97d4d9d4ac3045b85c09db219c5b44e71b8d14395c923cfe4ac1e7ae73b1ee5c21342d899d709fe29c2add6b38532ce3bea
SSDEEP 49152:wabH/yabH/g69dsTh7IwVT28foh0Y1oQTOVO88hXl+:w7Iw12880+/h1+
TLSH
T1B5C55B11B7908622D4778470E8E6D75AAB317D911B20CAF76346F35C2E337D2A63532B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.7MB
SHA256 a56f53f937d72462e7b7f1917dbef2b19fa396001438850eef83c0f88aab2d50
MD5 33007752664c1ca10dac72c80c644024
SHA1 d4a43cdbc955c9c441e6508fcedf9cc9a54b924f
SHA512 91b5f268523e1d34709d97d575ce5bcffe2f4314c852176f6f165a7c180f314fdbdea88c11a4e5b206a383ab731ff599792e04cdaea97f17d75bea33b5564e6c
SSDEEP 49152:wabH/RabH/g69dsTh7IwVT28foh0Y1oQT:d7Iw12880
TLSH
T1CE855C11A780D862D86A497078B9C71B2B35BDA12B50CAF77356F34C1E327D2A9B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 7.8MB
SHA256 d1d55facfda2f6c578b0220b638a0468ab89819cecf32c6a1778f489263978eb
MD5 8f79787066421ce70cb485af56bfcd5a
SHA1 420952f38f5e97997dbee6e2597ac631b9374d42
SHA512 fde2fe149ce11532f6912bf8f7b644f45ba7fd30b8f43b17240d0ffb7115dacd99a45a4282760b3f1bba63d7a9d3a06392ee43b35a66dfaac51b86a918bed62c
SSDEEP 98304:f7Iw12880XQRQyi36YOcP+Lvw2gAf+PN34:n2X5QyiKaUX+PNo
TLSH
T159868E03F3A441A9E05ED970DE7992229B357C4A4BB0D3FF269436E51E72AD07B38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 7.8MB
SHA256 87bc0b4ffacaf04ce40eac42c9b715292ad2a2fc908cdf29ee2ad24bcd39cdfa
MD5 ead77ec85e34b089cfe218380e91886a
SHA1 be709a58979dba5339dc4e2f5099f682fbc80ec8
SHA512 4e523fe0027aa7a15e5b120efebb92b3aae667d8f4580523543b4d3111933f6ef86fe384667d4cb47439480ec935a6bdfe8d6c867ef12a55caaf2c7e2e435f86
SSDEEP 98304:F7Iw12880XQRQyi36YOcP+Lvw2gAf+PN34:J2X5QyiKaUX+PNo
TLSH
T1C6868E03F3A441A9E05ED970DE7992229B357C4A4BB0D3FF269436E51E72AD07B38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.4MB
SHA256 8b2b83e081738f5e9825aa4c4640b36c489c1b23097426f3a71ff7a82e6ad21f
MD5 7ef22c847d8a869810850439ede2239b
SHA1 d4b6967c6673dffa3c8274e8083341b6c53e057b
SHA512 ebd81acb6f028f12b30feff93b08f972a281e5fe9b90d3c74fbb524dde468ca2b4907b59a3893a2f0a74011aa32972b9df5020242552cf42cac87f683bdbec4c
SSDEEP 49152:wabH/jabH/g69dsTh7IwVT28foh0Y1oQTJ68Qg55nhoeWu7PNU3/Q:f7Iw12880mthHRc/Q
TLSH
T1A7F55B23B2E14095D45EC471AF568722A6E1BCB18FA0D7FB9245B3491F72AD07A3930F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 5.2MB
SHA256 6a74590a1f584d950ef1fd79053356b6059e5ff527f3580c397d108803e38cec
MD5 d7d2b06f33d6eb4ff1426ac445850e18
SHA1 6e55205eced9231e053302891aee3751fb976a3e
SHA512 3814e9176f3e5139b81b14cadc70f043e6805194a66c0a6e138fdc44e7209ca146521221a1e54ddfb892c7a8bcde31be73384d46725519a5db6db67bf6f07e58
SSDEEP 98304:f7Iw12880Ry5112gYy5azzVvf69nLKnhZO:n2XdLIHuWhs
TLSH
T1AF468D13F69840E9D05EC574A79A8222FA71BC920B21E6EF0750B3592F73BE16B3D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 4.0MB
SHA256 949edbe657bbdd0476268566650acbef425097f5a3a19d8038f92a40c7f32a42
MD5 e2caf46bf328c865c98e460d5a714536
SHA1 149e55283569a54cc252f2ece2daad650bcbe014
SHA512 ea3d07592ac0475f3bcae56013fc20b5ac188a85582079b8fb0b46cdda00868c194fa10101bad44eb60731133edcd464c397d1df7386a554a77a4d65cea57d33
SSDEEP 49152:wabH/ZabH/g69dsTh7IwVT28foh0Y1oQTKB+taZ3usBWOBr4tEGW0bqx0z+n2173:F7Iw128803u6Jm0xd2d3
TLSH
T16D168D13F68441E5D06EC4706AA9D223BB31BC551B20E6FF1791B3592E73BE1AB38316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 3.4MB
SHA256 fda7a59b3459fd223d7acd148cb39f5e7133792787fd54d450c5a3631d7bb12c
MD5 0f0d1b898677794a15a0aeb1a69b45f0
SHA1 ead721b355a0db5f389a18ead43ae18e4b2e56c5
SHA512 c6a3f1f422b34689c5e6860187cf18be646d95378e986689176ea3e7e33aba07a0d8370155b8a1ed649f03f15cf578dabaf218e09389889fc32c3e7f8b29f57d
SSDEEP 49152:wabH/jabH/g69dsTh7IwVT28foh0Y1oQTk1hpsNoJpF1A6GU44CwH7R4xu:f7Iw12880BmifP5R7
TLSH
T14DF58D13F78084E5D06AC570AAA5C726AB35BC951B20D6FF1345B78D1E33BE16B3831A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 3.6MB
SHA256 1d2d8a1a615308d2ea6dc2803379ab37918f80543ddce98914c0eeb7d704b79f
MD5 30a985d1f2330b1ac4cc99dff0462859
SHA1 0072773b573ab7902333e7820607981ee2591326
SHA512 1975c7efb3d0a44b88dc1c1f868ecf10d83ff3deef5617f13a482397cceb63981b29695ef1434d081a88dd39fc48607e1e4e8390b99bb5ce27291fce53206018
SSDEEP 49152:wabH/ZabH/g69dsTh7IwVT28foh0Y1oQThSuZQIY0Be2K8RVtOnks6NMHq6:F7Iw12880S5dKCi616
TLSH
T121067D13B3D480A5E0BEC570A9B58626AB31BC951B30D6FF1345B25D1E73BE0AB78316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 4.8MB
SHA256 0ed32af77d82000a89381112cee3dd68f77a4305cfd5580ca03a05abb2ab2c38
MD5 d40843b50fcc712cef4f063f07680b6e
SHA1 ee7a88a6ced614bb4836645f67c86d8a2730d5cf
SHA512 db7082955d870980a4a48e50b8cb90407f95c99fd33839105ebb956b5b8e8a7cab66e0989b5a9f3c5b922ccf8685ea02398014b8106627891c0872250213a623
SSDEEP 49152:wabH/jabH/g69dsTh7IwVT28foh0Y1oQTeyLSrJhMeJNvjLAE3dGGj8b2EGcjesH:f7Iw128804m7vj1BDlZG
TLSH
T131368D13F29480D5D05AC470A6AAC232EA31BC954B21E6FF1790F7592F73BE16B39316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 3.2MB
SHA256 2de431d44e6f8a0687d59820cf6c80c363cfc42961720b20dac455322d3418d1
MD5 3418928a0a324bd4ccc16094a6eba14b
SHA1 cad3750b90112309ba4edf2d47f4b31335941d74
SHA512 d1756e09eeebb31c7189cdc08893fd42f8693ea14d4e982a0c6c14316a28de11f9b6acb9df545e1a9611bf4416177d376004e37e9cf614577e5ee350cec94c25
SSDEEP 49152:wabH/ZabH/g69dsTh7IwVT28foh0Y1oQT3htSn8EApI0fig1giDn0AP5w2:F7Iw12880TX2iwphX
TLSH
T154E59D13F78084A6D06AC570A9A5C727AB31BCA11B20D6FB1355B34D1E33BE16B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.8MB
SHA256 21461b6803bfcb96bfb147d3410cf9b26c7934e1fc97aad0c33ed3e45df8a762
MD5 5a6266a420183400a3085cf594ffb66d
SHA1 32c6e328181b4b9bfbe4323c704ea1a6a71a659c
SHA512 59fc582532dff99e031039286fca0cc817e278433593ba3b88a3b72e708c3031b1430e168e6a514f230fbee5e8420f16da68a5922f38dd05bdf41e10038c36f9
SSDEEP 49152:wabH/3abH/g69dsTh7IwVT28foh0Y1oQTP:T7Iw128802
TLSH
T111855C11A780D822D86A497078B9C71B6B35BDA12B50CAF77356F34C1E327D2A9B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.8MB
SHA256 75d3e0388b099410711256b1387fc4b2035abf513feaf597d9c6d1282d45888f
MD5 0125cb097d1b85513a7c05c682ebac6e
SHA1 ce0182fdfd3bf190cd1e94f992807827a81803df
SHA512 fb50eb47b7b5c24b7282f9df67e4eb12f594ee952e959772fe0886000818af7bf2617a52026641e4452b1391deb20bf33706c3bb4d2cd2dc58da107b8640eb30
SSDEEP 49152:wabH/ZabH/g69dsTh7IwVT28foh0Y1oQTf:F7Iw12880S
TLSH
T19C855C11A780D822E86A497078B9C71B6B35BDA12B50C6F77356F34C1E327D2A9B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.8MB
SHA256 b2a7e197ecf12a4a3b33def1cbbd961a6f87b9a5f8e4c5d6c750f69f3d340c6b
MD5 8a28bb60e902ea222697aaed03a837ea
SHA1 cd27ec9d9e2bf0e519c9041ad7626522c5cc77b4
SHA512 e40af089067c6a5fd0248c779511675fac89cca53255881a649921969fb6aa45940723898ff26bd94b4d62c1d857617dc459be5aa8c1e55f3c2ebaf393f8e862
SSDEEP 49152:wabH/3abH/g69dsTh7IwVT28foh0Y1oQTQ:T7Iw128809
TLSH
T151855C11A780D822D86A497078B9C71B6B35BDA12B50CAF77356F34C1E327D2A9B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.8MB
SHA256 0b42741823bb44a8010c101efab8cd4283e52668e168d8b42835dcafc3d8c2ba
MD5 442d57a7f953966040043528fa9bde8e
SHA1 fe32626ffeedaf0c098bada50eda41617e2bd0c4
SHA512 6e76fba5095c6a5a230ebbfd6f5f8b498ee1ca99ff4f85b7a00bdfbc58c38da7194bfe8e9f891ca760c74cd575bce006ac2e92c017c59127fa5a00cb4e3ffe3a
SSDEEP 49152:wabH/pabH/g69dsTh7IwVT28foh0Y1oQTp:17Iw12880Y
TLSH
T16C856C11B7809862D86A497078B9C71B6B35BDA12B50CAF77346F34C1E327D2A9B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.8MB
SHA256 02257632ba6c80848327946ff818cc480f75684520323af4d55714a38de8d359
MD5 ce0eca6ac8b751c2558894906615e9b5
SHA1 d02c4d066d5084c3c9889762f2e79d04277f0fcb
SHA512 9e8f97f8a916eb381fd7d92c8dc79e3ba5009bd65e625c80c9b1052834a8995a1b5a48a1eb48617c9ba48577aefcd2c8d8b3506ba83fd4bf8dbbfaea4256a8b5
SSDEEP 49152:wabH/ZabH/g69dsTh7IwVT28foh0Y1oQTU:F7Iw128801
TLSH
T1A9855C11A780D822D86A497078B9C71B6B35BDA12B50CAF77356F34C1E327D2A9B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.9MB
SHA256 19ed712614626cf507a55f94ee227f5d3fe0668ce3fdbdb21a2fd99b2e1095be
MD5 3d801db5e0829db2f0af2406c8a7edfa
SHA1 ba9b0c7c7a2428c8e8dfdc69c6f01910c1ceeacd
SHA512 7a36050ccb90f6331339e0b0e0445b2b2b8b6315226aa19195edbce29e98a28a2a8928bcc2536038ce06374394d465372c606ccfe9352b9ba58271268732365f
SSDEEP 49152:wabH/babH/g69dsTh7IwVT28foh0Y1oQTz:37Iw12880K
TLSH
T1B9951711E7809862D46E4930EAA586167B37BDA11BD0C6F763C5F27C1B327D2A9F430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 1.8MB
SHA256 6ebb5df6c9af6a3488955b1672277338c63f26949b4fcc871d0cd478db864976
MD5 80190ce2d2d9f497c5e740d1335c7894
SHA1 ba85bd091ff487838feaacbf5b8c26cbe4305e2c
SHA512 cd6ef90f0095e2da7ea274d2b068ae57437d24e880633bceef8f6a4e40c4e86dae10c634920fdb0cf6370d8c93aa81c4e942b1719856965e799c9ab3233b724f
SSDEEP 49152:wabH/3abH/g69dsTh7IwVT28foh0Y1oQT/:T7Iw12880C
TLSH
T1B8956C11B7809862E86A497078B9C71B2B35BDA12B50CAF77356F34C1E327D2A97431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 1.8MB
SHA256 0fe662126202aa77f3281c66773abafdcb26eb7a54925e71356ea82369b59080
MD5 bcfd0df4a384b1168d0fd5834a0f6351
SHA1 3bf10fdcd9d69c6f7421e2d600ebd58f9e518132
SHA512 9b46d03d98b2d4c0b1b5f9fc56a397f2ef38c454d7e13c41558f677c606b088c75f7447d4c388b4617921f82ea13bf78a42b09fc31175ffb7a6695ef72123dfb
SSDEEP 49152:wabH/ZabH/g69dsTh7IwVT28foh0Y1oQT1j:F7Iw12880Sj
TLSH
T14A956C11B7809862D86A497078B9C71B6B35BDA12B50CAF77396F34C1E327D2A97430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 1.8MB
SHA256 bf350ae65dcd4bf1a5cac116a7a5fa86e2560fee1f85d3f31036a751083e584c
MD5 60602b7417b2f3a6d23a20fe06e6c5c0
SHA1 44cd1bfa7cdad997d4b0bfbfad7ce8aa882b1894
SHA512 f50f67f1498e3a24a279b4b3c02f7313f92c4608743d083c6c94ff1eff61405d69f0f10662bb004ff68c02b118110c1a706501897545739d052f02131bbd026d
SSDEEP 49152:wabH/jabH/g69dsTh7IwVT28foh0Y1oQT/D:f7Iw12880ID
TLSH
T141956C11B7809862E86A497078B9C71B6B35BDA12B50CAF77346F34C1E327D2A97431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-11_20d4ae46d6b9fc4f675a796d10e984a0_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Size 270KB
SHA256 f6db5b9217d190c6d8f16a95b67d2f26f1bff4ec79d95f00d3755f182cc8e5ca
MD5 4e61919354a60148cb77981ff58f5ef3
SHA1 74dc9d4189c09ee8079375d579b3a7ba6d561488
SHA512 852d5726b8f0df036ce75ef5b0a81981526b80a313b968a66aa615fd234be54ceed89f0e7d746e94549254afe988cb854374f5cdfb83516aed7ad849a930c626
SSDEEP 3072:NMZcwhYciHmqo3v7ro/2szqJ71rISTQt8UPDSzXZc22Pb2pEx39TBf/uyfWIEICI:uZcweFm37cxzmRHUPD65Mb289TBnXvks
TLSH
T14D449DA1B3A04CF4EDB7813EC8518916D6B27C5A06B0C74F13A836665F733611D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 1.7MB
SHA256 12d67cbc793fd14442fd9774ae8fec0cb8f09508ac093d998283e64b5c4f7d77
MD5 01188b292f1db650097a8d3855941ab6
SHA1 3111a947ed6bf41d58db51a2fc955b5e081d0fb3
SHA512 227c644687ff5925e5f19691ecdcb14ccc4ec965afba8048f9149e5d90bf3a8f38102276f235e5720ebd3724da2fd48c031bed9c32959e5d366e0091bf43e82b
SSDEEP 49152:wabH/habH/g69dsTh7IwVT28foh0Y1oQTH:R7Iw12880g
TLSH
T188855B51A780D822D86A497078B9C71B2B35BDA12B50CAF77356F34C1E327D2A9B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.7MB
SHA256 3a00d6311287d1a2bab61b43725a54c4b012faec982f2765bba6957f7a8bc7c0
MD5 aad92a00486b036d205ccc3476552d50
SHA1 09e13256d17a78dcbf89f55f2c15ce7bea389a69
SHA512 b5ca32668738ba9adda7e17b8a34126f2da4163c726e3807ca8df9139b2a54014db73149ff5aa630669847befc893e6aa8f0362020b5e0e71e4f806b9a4f26c9
SSDEEP 49152:wabH/3abH/g69dsTh7IwVT28foh0Y1oQTH:T7Iw12880g
TLSH
T109855B51A780D822D86A497078B9C71B2B35BDA12B50CAF77356F34C1E327D2A9B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.7MB
SHA256 6bcc0e11507ef8118e495eb4f4790f7cadb0ccd53dba8d332eb1a6c4771d15ed
MD5 54e3a0e36b0097bffa020d43ff8bcec9
SHA1 79eec195c98ebaceb902e0498306fb39c7d84dff
SHA512 3f3e86c836331d0f6a0045cee00b02c9c71cf14a85a9cd553a2901a3e9540f2ba1fd70994066fed34a01d8f4016f12aa808d3556bb573f9698cae9ca2381871e
SSDEEP 49152:wabH/jabH/g69dsTh7IwVT28foh0Y1oQTH:f7Iw12880g
TLSH
T1AC855B51A780D822D86A497078B9C71B2B35BDA12B50CAF77356F34C1E327D2A9B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.7MB
SHA256 9a0c6bb5b30a8fda1bdcb9d74e6f8cd459cc39f661877c894d43812ef6956c0d
MD5 1b1ba3cba83f2ab86be6fc3f35794757
SHA1 1f6cebc4dbc2bdeca0640654428dc12c8255752e
SHA512 a388daa977237c457322c38486081a0fd1a63459da9471bfaa69a36f5b590eb40610fa513455ef477644d2e88e7c91375e504d39a304ac32ee8542bb76a51803
SSDEEP 49152:wabH/ZabH/g69dsTh7IwVT28foh0Y1oQTH:F7Iw12880g
TLSH
T164855B51A780D822D86A497078B9C71B2B35BDA12B50CAF77356F34C1E327D2A9B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.7MB
SHA256 6420b5a99ceb49f6ab52f7e0fcc640be2b6cb66924072191577eab272d4da848
MD5 a9e6bf580540d3fc2f0559a79450d43f
SHA1 7e377d0cc1c72a314b7b6ec2620f3ea6b2667873
SHA512 079340c63569b30cf59ced8fc3742b92a0a9717a7714d4a899fd01da3fc6d6fbb711403df7f1822391783038785c5eb678ccd4347153f2e1248e4f53b9a9d8a2
SSDEEP 49152:wabH/pabH/g69dsTh7IwVT28foh0Y1oQTH:17Iw12880g
TLSH
T107855B51A780D822D86A497078B9C71B2B35BDA12B50CAF77356F34C1E327D2A9B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.7MB
SHA256 47a2dde1f5fa305d700a79cc612928f5a084e9f32a8bedbdc5cf99bd5e2f8b65
MD5 c803cb626b8d199c4a8dd3b5fabf0d84
SHA1 36b530d486da8ccce08cd11c479be56398be529d
SHA512 5704ec338b83a289c98a0189a0680b6f1141d139d3834ce2223885ef1e466a48823e35f58fd7701fb27dda32cff11affa73faf241abaebc1c874344ba7ae49ae
SSDEEP 49152:wabH/yabH/g69dsTh7IwVT28foh0Y1oQTH:w7Iw12880g
TLSH
T1FE855B51A780D822D86A497078B9C71B2B35BDA12B50CAF77356F34C1E327D2A9B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.7MB
SHA256 f1484a8ade6cda409dfd35fe2eb340c784d30030d64c82c82afb69a16470c370
MD5 152cbe33b3a8e266db53a72f0c86295b
SHA1 d49d0762f5c9e39d36de52e8fad62fba3c032fa2
SHA512 1bb33e23e032d0246ecb96877881f5c05a0051c1a212ccbab1b8e4fc091d29bf0611775316fb0265d517641a5b9d0b00d5142785805404d6f3639dd51a3274a3
SSDEEP 49152:wabH/RabH/g69dsTh7IwVT28foh0Y1oQTH:d7Iw12880g
TLSH
T152855B51A780D822D86A497078B9C71B2B35BDA12B50CAF77356F34C1E327D2A9B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.7MB
SHA256 51558b51846f464ee8095c0f5a7db6f17c5e9dd6bedc89621e945b0d13f4f4af
MD5 458ff3e03adf9c7545d4c5b38d9d179b
SHA1 2bcb4137055dab14b56c61fd9beb97ba8467a1ff
SHA512 b63ed791eb7e7cf409630b4cf3c772ed22913b7a8da592615e966f9a8ecb242e5c1984fe9fe4aaaf598c3e4edf31aa78f09df8ff8b681a61e3946ea8d5acecf8
SSDEEP 49152:wabH/babH/g69dsTh7IwVT28foh0Y1oQTH:37Iw12880g
TLSH
T1D9855B51A780D822D86A497078B9C71B2B35BDA12B50CAF77356F34C1E327D2A9B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.7MB
SHA256 2ec7277eca206d6ef132f7faa2865f5b64d90ee3136a6df397fa6ba40798a357
MD5 f28c2439edeaece2d28b65c867061f24
SHA1 cb1ab225ae6488f48a8443ed2292a52887046c64
SHA512 831a08f29dce9a149c65226f8bb9495d2eb20fcfb3b27f304b3fc4c8bb3499b78dbd5472cf37a45f26d5e13f901df03164344ab6016b079b680fce8cdae0ab2a
SSDEEP 49152:wabH/jabH/g69dsTh7IwVT28foh0Y1oQTH:f7Iw12880g
TLSH
T161855B51A780D822D86A497078B9C71B2B35BDA12B50CAF77356F34C1E327D2A9B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-107-0x0000000000880000-0x000000000093B000-memory.dmp

Download

memory/468-284-0x0000000000880000-0x000000000093B000-memory.dmp

Download

memory/468-511-0x0000000000880000-0x000000000093B000-memory.dmp

Download

memory/1072-97-0x00000000009B0000-0x0000000000A6B000-memory.dmp

Download

memory/2520-43-0x000001E9695D0000-0x000001E9695D1000-memory.dmp

Download

memory/2520-33-0x000001E9695F0000-0x000001E969860000-memory.dmp

Download

memory/2520-45-0x000001E9695F0000-0x000001E969860000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads