Analysis
- max time kernel
149s - max time network
98s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 01:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 1.1MB
- Sample260511-bnf6esht5t
- SHA256 0b019f641acc974ae14ee7e24e13214cfc34d04f991e11cafaad0aa6402b463d
- MD5 5473ed5f7c1f16af4a865de7b50ce0f1
- SHA1 bb8e4f2d801e44377ef0bfb1c421bac26c8093ce
- SHA512 81e739d425175765db2021421efc288d0b0f8fc667071918c3e60109ff7879633d940beee106a478861871b1c28e739a4d20f853f3cfc1819ccf84ca02274699
- SSDEEP 12288:etZ41TtTuRWny8d+roTfREZW9Ax3K8CbEcieT6O48OwgIk55bCu/8huoMTJ/8roP:/tTuRWFsronbEqa6+GG8yKrO4cv
- TLSH T123357C1BA69C73F8D0EAC1748A5D7132ED72BC520B20AADF0690B3191E77AE45F39714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (259) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe - Executes dropped EXE 3 IoCs
pid Process 1904 Logo1_.exe 1384 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4304 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXC73A.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCXC328.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXB537.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXB66C.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.Exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\updater.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe.Exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXB66B.tmp Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RCXC707.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.Exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe File created C:\Windows\uninstall\rundl132.exe 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Logo1_.exe 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe 1904 Logo1_.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5072 wrote to memory of 4584 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 78 PID 4584 wrote to memory of 3988 4584 net.exe 80 PID 5072 wrote to memory of 3928 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 81 PID 5072 wrote to memory of 1904 5072 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 82 PID 1904 wrote to memory of 3772 1904 Logo1_.exe 84 PID 3772 wrote to memory of 3632 3772 net.exe 86 PID 1904 wrote to memory of 5496 1904 Logo1_.exe 90 PID 5496 wrote to memory of 2888 5496 net.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:3988
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2759.bat2⤵
- System Location Discovery: System Language Discovery
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"3⤵
- Executes dropped EXE
PID:1384
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3632
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2888
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4304
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXC0D0.tmp
- Size 156KB
- SHA256 958374c932a592df312171e240d1e54711dce44a675649b24880d463a357c3f6
- MD5 f41bd6e8722c87eb794cd3dc561a68fe
- SHA1 9fbf7b5ed95bb9a97161ed192b44af4535b09257
- SHA512 3740dfd8d287e49c5ffdce211c70c794516874ed513a91fdf3bd67322495688b9407bcba650a0f40cdc2f735e86fe423639966fae0ac26edd55110b59fb92fb4
- SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6gNz:hCSjGoLpWM6VsBEjx5ZdtZ
- TLSH T1E6F3B36EB18FB3F6D3E1597C8D1CF295ED29FE20CE19285B75993B0E9A760C30508291
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXC2E6.tmp
- Size 94KB
- SHA256 c860cf44f4174acba820391f674c414aaaabe89c820f5d170e9ff23eff0c1b41
- MD5 ad9159d3111af275bc81cf57e3e422ed
- SHA1 3f08b8a6d92bd0c6ab6c26c803b51bbd8d44a7f7
- SHA512 d0001ffcbf50c0e90144f8baa8b0544d456191c0ebe3af71b8b96f2e272a7bd4390aeeff79fee08f55b0d707aee9e564bb3f4f7c2ee728912bb6014a59149b06
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6PND:gCSjGoLpWM6VsBEjx+ZdOp
- TLSH T150932A5AB29DB3B2D0F259BC8D0FF2E5BD297E200E1D199B75992F0DEE760C1190C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXC682.tmp
- Size 103KB
- SHA256 832e42e461c8bd30529330656de5f958036e57f7501a8c21ffcbf09f77e7f299
- MD5 3356964c9bca04977612b113bab59476
- SHA1 127bbcf2b4cd43b15342e005fb4738763eccf5fb
- SHA512 1e99cc0d2c9d3e51d0e191952aec39d1abc8754b88a2cc4b9437592b23e730894c43700aa0cb31e2c5c1072ae9b981e4f222ce40fb7997a178ce07c7a92e8c4c
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHiVNQ:gCSjGoLpWM6VsBEjx7ZdddtPlLq8u
- TLSH T157A37C6AB28DB372D0F299BC9E0DF2E57D397E300F1A185BB59E1F0D9A764C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXC6D3.tmp
- Size 91KB
- SHA256 3e0ffb71eb76b83bbb0714228cc0c2ae6e26bd1f6f4b3ff8f3f9db068bef9ebb
- MD5 3abdb5ef56277c52f798718b29c2137e
- SHA1 bcd52b364a4338fbe963703d97a53de1b6071813
- SHA512 f312bf013dc72aafd338231d86a0f00e1b74c4fe95458aebb8e98ff3d5b5f5ec25a9b406dcca740533cca51e4781a2660a704dae9fbe7023c38876378422393d
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6ANT:YCSjGoLpWM6VsBEjxZZdt5
- TLSH T120935C6AB29DB372D0F299B89E0DF2E5BD397E300E19185FB59E1F0DDA760C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXC467.tmp
- Size 118KB
- SHA256 716daefbb8546f2dc4d5f313fe61bc00311d6afbf3a3208fce92297411f8ef8c
- MD5 9cc788d06b4d7b460d469bba1f0be3ec
- SHA1 f6667914a9255ebd67d9f4b93d9b051ad98dbdfe
- SHA512 2cb76b37f7dedcf93537ef7a5262294ea387eec3eb63e59549a4d485d35d843c3e0b06e1875e1216b9a7b1bda167d2096122d569e8ecd8781c3c102b9a920d90
- SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6x4GZjzQwK5WW7VCnf:JCSjGoLpWM6VsBEjxZZdQe5BV0fH
- TLSH T107C3AE6AB69DF376C0F259B84E0CF2E57D297E300E19085FB59A2F0DCA7B5C1190C292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXC7CD.tmp
- Size 100KB
- SHA256 2a67dc73e5308a2da8ae657a5cd89655853871ec5b520d557564dbf723c671f6
- MD5 e8d72aa183d67ef8860f4eee9cad3c68
- SHA1 5b9d6a07e1be3ba746bf2a2da3132659fac09912
- SHA512 b38bdfffcc835ddeef85935936aab3d4df482459fa9efeb5e67ed76e886ca15e15e39f45d6a1cb720f74861d1658063cc2930c9ffcdd54537c2d786d3a911d9f
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3INj:oCSjGoLpWM6VsBEjxQZdJUIJ
- TLSH T10BA35B5AB69DB3B2D0F189B89D0DF3E5BD397E300E59185BB2AD3B0D9A770C1190C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 7a4ecb42907684bf69ebf0e408b60a91efc6c537a2a2d13d38782777208a2453
- MD5 cbe0c4277a36fb8139e54818dca3b182
- SHA1 4fdb5e5dfc66569372f8eed64f815d8eb92a837c
- SHA512 71a189b307a28c6009577b4f2a4022fb27a84879feb125103aee343a694634013132a6c18a661d50b19faaec78bc689d6640f611080bd7addf5ca989199cbff0
- SSDEEP 12288:erXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:i0Le5ji0hmxNrM
- TLSH T16CE4F716F66CB331D0F2C0B9C5DEB68AED313C411B3089CB5286976C6E676E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCXB4A7.tmp
- Size 91KB
- SHA256 0ede660066374095b0f2d2a795fa5c5b605022294ee539f3eefe0be72db486f1
- MD5 85870b888bd9c46308e7a69d0d9e29e5
- SHA1 212395284b7c3382c6f01b6edd2bb15a3cc9fe79
- SHA512 0157c1d4a28593b6e8ab792a265071f2511611ded152525e459c9d3b31c8feabe9d987763b306ad3440be48b4375a3b4d54c355a461897d4cfe9443930b2b9b5
- SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6UNb:QCSjGoLpWM6VsBEjxGZdBB
- TLSH T152935C5AB68DB372D0F259B89E0DF1E5BD397E301E19185FB5AE2F0DDA760C1090C292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXB5B8.tmp
- Size 92KB
- SHA256 b1edaba59258b93a813af43f83e931f374f0b97c80da91e7fb49c9f9e6df3fb2
- MD5 0df8c0184ae6eb744da8e0224e8f4db8
- SHA1 ef35d2e355dd1c11a8124d495d91340a3e1794a3
- SHA512 d800b39077fb26fd7cd662f77f57d34267517ec50b860af673b8edfbaff6f7852d9c2618265c5c68f85bc41530df6ccc86586703774c34fa410814701f404064
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t61NL:gCSjGoLpWM6VsBEjxeZdIx
- TLSH T192935C6AB29DB372D0F259B89E0DF2E5BC297E300E19185B71AE3F1DDA771C1190C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCXB8BA.tmp
- Size 91KB
- SHA256 424c8fff083f401cafad763c6dde11acd90ececf16de85ebb55224c5e82da8ad
- MD5 cfd3b13935afe78092b0e062b3e3066c
- SHA1 e95acba12f4088842778807f55a2b44131b831df
- SHA512 7aeebba7a3e07fe7478b8241bca8a5345b44f5faf10746d4682179381a54e6fb4c85147486007ef88879c3d356a3d246de445d1faa8019feb03d1b7c917b36d8
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6qNL:YCSjGoLpWM6VsBEjxmZdzx
- TLSH T1A7935C5AB29DB376D0F269B89D0DF2E5BD297E300E19185BB1EE2F0DDA7B0C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a2759.bat
- Size 902B
- SHA256 76723a6b975e9e2e579ce197938b9f54a7b76ddac2a81fe9579fd6482e2fb757
- MD5 0f2f74ea70b68732510477bf7f16a15b
- SHA1 7d8fe8166a62ae611042e956c88a4ee06ab42cbc
- SHA512 f036cf63f685b7098de0fd413e086dc4e5bf619e5fb9b324acfd00015c295ce2fc0c9a66ce2ae6d16391fac89f164241baaead0e3fd317a46d3ad278d0db062e
- TLSH T10611E752C1F1F7EE853860564A32AD9DC809376E2F8833116F58C06E50E5C1CBA5BB37
- MD5 SHA1 SHA512 TLSH
2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Size 996KB
- SHA256 0ff1cbb1212fc12240a17455eb525fc152724134f760efd848ef86b8a03e85e0
- MD5 4b9433103a5315a2ffc060a4beee9aa2
- SHA1 2b19ab27a925bcafb595e746effa2e5231241f68
- SHA512 99296c47919f77c21d8663ff2bac1d0ce7ab386b458568a0dc9cadaecababcb049b29ed64a2d8adcd910c0480f270d67fd599f4b38927b434f5065450e5d3c1b
- SSDEEP 12288:BZ41TtTuRWny8d+roTfREZW9Ax3K8CbEcieT6O48OwgIk55bCu/8huoMTJ/8rovX:atTuRWFsronbEqa6+GG8yKrO4cv
- TLSH T19A258D1BB79400E8D42AC175CB554236EA72BC560B30AADF06D0B3692F77AF46F3A714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 b0ff333d8ed2795da6f694636e31c9e6bf262f98c9f88cfbfe86992372a45c17
- MD5 660935f0140e83269ead1f6a896fdadd
- SHA1 28a88b420baa83d8157c3425e62a695c1a423240
- SHA512 ef9698e08935390a4bd73b5852898709d95bdb106b5b8e70af5e9285cd55feae363e9782d213d922da72315eadbc26c7db55876b86f93f24f1b8ec0ea7d67bc7
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CFNT:YCSjGoLpWM6VsBEjx+ZdDF9
- TLSH T1C5936D6AF29CB7B6D0F199B88E0DF1E5BC297E304E19185B759E2F0DDA770C1590C281
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH