19421855b3e1ee5f9be90268fa8d48ba4b4f4cc585f3ca66812ca1fc3c5ecfc7

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/05/2026, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 4.4MB
Sample260516-cwywwaas21
SHA256 19421855b3e1ee5f9be90268fa8d48ba4b4f4cc585f3ca66812ca1fc3c5ecfc7
MD5 9aca31c721f71151ce8b4c200831b369
SHA1 a7f0236ee51d292ad8d0b3943b574da2c3c03182
SHA512 133b9a525a52d3c5353b8c84454c093105018d9384a88198c95bf6fc8c416a2da36c2974c2036ccb17fff4dc36771c6c890ee7a0c3ce7eea04ac5cb0210a5285
SSDEEP 49152:F/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:GWQtZ/K0tGOFWVRuLftCT
TLSH
T17F264A03F2ED52A9E0AAD178DF39A2219F727C598BF165DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 2 IoCs

pid	Process
2796	Logo1_.exe
3308	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXA1B1.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXA458.tmp	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXA161.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxTsr.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\RCXB231.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\SnippingTool.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\setup_wm.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.Exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXB056.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Logo1_.exe	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe
2796	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5592 wrote to memory of 1464	5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	80
PID 1464 wrote to memory of 5352	1464	net.exe	82
PID 5592 wrote to memory of 5936	5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	83
PID 5592 wrote to memory of 2796	5592	2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	84
PID 2796 wrote to memory of 1636	2796	Logo1_.exe	86
PID 1636 wrote to memory of 3456	1636	net.exe	88
PID 2796 wrote to memory of 5184	2796	Logo1_.exe	91
PID 5184 wrote to memory of 5540	5184	net.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1383.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5936
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3456
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5184
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5540

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXADA9.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXADA9.tmp
Size 94KB
SHA256 4d3bad1135823dc761176cd505345a604dee71e8e9c1b2c12bc260c4bf55fa3c
MD5 3624bccbcbfe49c92c77230abb38f5cd
SHA1 6db0ff89bda10aedeeb3950194b8947c089d26a3
SHA512 94024fafeaed38b4a83c50ef361f28a330d0c578be9b45bedc28bc25b91d52e89e4eb43d43cd6194dcbc5acff48bf9abdccbc7d0c30e17c53005c560f869ab36
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjx6Z2HQuhtjRQXq9Nb:oCSjGoLpWM6VbBVjx6Z2wuhttQaB
TLSH
T13B933A5AB18DB376D0E259BC8E0FF2E1BD393E201E1D189FB6992F0DDE760C15508196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXAE5B.tmp

Path C:\Program Files (x86)\Google\Update\RCXAE5B.tmp
Size 90KB
SHA256 3384a324cc51c727196ecba480c8f6124659a8578d403253bbcce970a5fc8998
MD5 27a240ff55f63fd9ab7e2ae4c2ae3fa8
SHA1 2b9618d635c1458bc06e0c743d9946f8c1aa1148
SHA512 1e4abd13fdda17d7ccef0b8aad6877e577ac3825ad2ff581fbfc4609e56c6a9ba2c62d4bbc895220355d2e6b4f873752c93964ad95c9c39de3016d356a3af591
SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjx5Z2HQuhtjRQXX9Nr:QCSjGoLpWM6VbBVjx5Z2wuhttQ9R
TLSH
T1DA935B6AB28DB376D0E299B88E0DF2E1BD397E301E19185BB69D1F0DDE771C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe.Exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.Exe
Size 3.3MB
SHA256 f7755e05fb3d8dcd0b09065e1981dc4a1490d8a75ffffac966d8b94edf3c6a12
MD5 eccc4e02a4ebc4add5192cc52e06857f
SHA1 98df78bce5be138ef9c8f894e324ae92a62fbfbd
SHA512 8335152c6b853e844d6e38b0e375a6dcf5f346f87f1f488871d0f240ed926e0e10c54bdcd40e1d07ee990cf23c40a0f8ee1be9567a8c6e62a7df6c4b86b98dc5
SSDEEP 49152:rglZ4ThD+gGTZbqZK95S4pTiX2EUqMzADxulO7Udq+KqOuBk7bVnU7wF62JtY0:Hs6Gwxul1EE4wsH
TLSH
T1FEF53803E29D22D5D099C074CE4EA222EF627C8D47F562EF3290B6D52A77AD47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe.Exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe
Size 4.0MB
SHA256 b6390d5c928e8824c72b430ccc82f066fd312ad5f9aa505a860dee2247064106
MD5 5467a7ca646fbc602aa8c1659241c5c2
SHA1 9358ec94b538f363d19643574ad1eb6d979cc74f
SHA512 98f98b0323f3ce0a60aad10d093a9d99124d093384f4272ad4fd17c5bd593970c114b419609306eb1db68f1f705be7aca3d70d22cfb2e7b1e21e08763387e51f
SSDEEP 49152:fudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:tijnUdYd+RaAj
TLSH
T1AC164903B29D62D4D089C074CE5AA232AF617C8947F161EF3690B7DA2A73AD47B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB251.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXB251.tmp
Size 99KB
SHA256 f9b356b22fc4ec1c0733ee5fd9291bdff6f2983cad164cb28a9b8d3bc8a1b58b
MD5 c2893314e1bfd81bded1b7d040a5c752
SHA1 dedb9d77d955dc6967ec1298c756a17e12ee3e29
SHA512 238bb12b5dfeb3738e0e361a53f10d9b2a84f15080cbdb26a3a2bfb8fedb9afdd1f51f997526e9e95d1218694c3e28f63696082b9ffb80672f649d7a04a9937e
SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxYvZ2HQuhtjRQXeqkSZZZ3P9N7:QCSjGoLpWM6VbBVjxYZ2wuhttQgUVh
TLSH
T152A36C56B68DB3B6D0E28AB88E0CF3E1BD357E300E59185BB29D3B1D9E770C2151C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXA1D2.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCXA1D2.tmp
Size 91KB
SHA256 517a6fc4337f2fb2c008be2ecbab7b13db7903b3e2b6cdcb1539899cb7c98e98
MD5 925c80dcadab02097514ff7163248f1a
SHA1 aad75fb763be9d7a8f0104635db494a4b1424155
SHA512 0c086d5be6c5c4eb64370b557d363f4c0a8e7dfa9bab1db0ebd0b3661634cf733fe292d42ee63ebfce7437bdad9c9aff555a1ad852e1c709abc2da5550d4d739
SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxaZ2HQuhtjRQXQ9ND:wCSjGoLpWM6VbBVjxaZ2wuhttQ4p
TLSH
T1B1934B6AB28CB376C0E659B88E0DF2E5BD257E301E19085BB5AE3F1DDE771C1190C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXA3F6.tmp

Path C:\Program Files\Microsoft Office 15\ClientX64\RCXA3F6.tmp
Size 156KB
SHA256 c8c33c97e966496e6cc3330f1266ef66ec488c005b4c1d59b9eaef0df3d96741
MD5 ee6ec246a7faea9c42c262abeef75982
SHA1 4025845af4926f3d9dd21fd48bd86c069f56d061
SHA512 7c14b3f8b7ccfa1ad0789e07f6edfc001b388c38d5d1559b824f3054196c2a24f725568cb8183e57aad7993734651dea5f18e83a57b9eb9e73ff9f134b4f67c1
SSDEEP 1536:I7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxFZ2HQuhtjRQXPnW9NL:ZCSjGoLpWM6VbBVjxFZ2wuhttQfOx
TLSH
T1DBF3A476B25CB776D0E599B84E0CF1E0AC2D7E201E2BCC6A755A3F0DBB761C11A0818D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXA447.tmp

Path C:\Program Files\Mozilla Firefox\RCXA447.tmp
Size 91KB
SHA256 d45f97a111c15d3c30f695644a34c7028a2c01adc93057a3344526a699cf3daf
MD5 2baca01ae04005d46725cb33ae289bdc
SHA1 a8e6efa4f87fc1aaa1ae9bac84a2aee93a2c59af
SHA512 676ba8717a174008006082a25cb8eaceb3f701594f9bd2a42cf9207cc124ad37551ded8e8cc9a02a16e45db6e75ff8cf94924cb163e01041d0fd7760e37c2b97
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxaZ2HQuhtjRQXh9ND:YCSjGoLpWM6VbBVjxaZ2wuhttQPp
TLSH
T100936C5AB28CB376C0E2A9B88E0DF2E5BD257E300E19185BB5DE1F1DDE771C15A0C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StopConvertTo.exe.Exe

Path C:\Program Files\StopConvertTo.exe.Exe
Size 212KB
SHA256 5c6c3315f2eab463d1341d81adb02f8fbb9abac86da13623b780e0b2fc952687
MD5 238bfe83a682970f5eb4dd95a5e33594
SHA1 1b8bb3c3dfd0dffb94f245a9800db50d2da8b770
SHA512 884f36bf9994c7c0e73901659518f166bec30e8c7240f272b8a80ffae2256204d59a7a10438cf1ef2245e72ee00e8fc4c034149ba16c271153db95b8250d4091
SSDEEP 3072:ACSjGoLpWM6VbBVjxCZ2wuhttQCXqknQ2OoY0eUfsbgp7lWGec8ADaQszWIYcecX:2Xq1V59BqkQDoYOsbgx2czpeYkb
TLSH
T1AC24E096B59DB773C0E28ABCCE0CF2F0BC367E301E19156BB59D1B1DDAB61D10A08196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXA47B.tmp

Path C:\Program Files\VideoLAN\VLC\RCXA47B.tmp
Size 92KB
SHA256 7b4b73cd94a44337268fff68fe2219cc55d7ec32e45261cce5e12156df47e638
MD5 e75cb06d2d0d997a0747d1d8326dc99e
SHA1 b44b567a8ee0487db63504fa6369089d86ddcb42
SHA512 44e9d1d7cdba31d4cba0e749ad7f687df358f808a00bb4247c7d4e7a6587496c74ecc70e2d883a34a959011dadab62aa2813abf28afc57612bc19f7004690354
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxyZ2HQuhtjRQXB9Nb:gCSjGoLpWM6VbBVjxyZ2wuhttQvB
TLSH
T1FA933A6AB28DB376D0EE59BC8E0CF2E07D397E301E19185BB69D1B0DDA761C1190C19E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB688.tmp

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCXB688.tmp
Size 91KB
SHA256 b34c5ae6b03f347e965f4a9aa4d632a0d1b2842566e70546f76b964955a6e523
MD5 a8aa9fc88ffac8f8ab5defc590aa0e95
SHA1 a57de06a3a07e54ed4180eab84eaec93ab60b8b5
SHA512 162de196d28791f68e3e459bc0c7e67b4a038e802d853345923ff8c2fddadba5a2d05162368ece8420c55a9d8ffae05d0ec34a9de9694a09ed0c80d022d5f3ab
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxYZ2HQuhtjRQXo9Nj:oCSjGoLpWM6VbBVjxYZ2wuhttQAJ
TLSH
T19A935B6AB28DB376D0E299B88E0DF2E5BD397E300E19185BB69D1F0DDE770C1490C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a1383.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1383.bat
Size 902B
SHA256 53f007063a2589c1391811083dad666bb6df340bfa70db8742de64eae686f1e8
MD5 9ffb876c416a1443d423502dcdc781e9
SHA1 eaabc6e44b1312ca9f5ce960966c3230215ff070
SHA512 6a4d5477ead18105c62cfa9b19f046259167a283a989d0579b82800195ae91942dc20129a155e6797833724d5329569de9cfc6ed15840133b4bf12df00528a14
TLSH
T10C11C602C6E7DAAF0C36B82646E79DCAC497364E2F09322A9B5D84CD20D4C5CB965356
MD5 SHA1 SHA512 TLSH

Submit Download

2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-16_9aca31c721f71151ce8b4c200831b369_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 4.3MB
SHA256 b5afed0235fa6e7768da634f1b9235ef54d22e9583cee4d1ccb6a0107fbb3555
MD5 96e52debcfcd4acaab749b81c472f274
SHA1 5c9b3b500d15893082002bcecdba8938ae9e304f
SHA512 a0e792e748db99f849e654d22e62736d60d589bd827a7593a8010469f5d02bd55b88dd10516526732c35aaa228bb4dbe68a8d52b24d3ce7ee18b01f685af72d1
SSDEEP 49152:p/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:iWQtZ/K0tGOFWVRuLftCT
TLSH
T13F264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 ef744d7f98e4f86602a45ded1602958f83251bcc9addbdd27dd32e769bff8465
MD5 ce3d1d989abe207e0b8b3659ee8e8d06
SHA1 acbb5b894c0c69e5a0c82d2fc4b958c03fdbe91c
SHA512 7efdc799e152418de67df8468150a142d22acd923f7937eef5ee807352ba10afeb648666b2aca98175c64190505e9adb341feeb18517f83456ac3d59abdcd060
SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxCZ2HQuhtjRQXC9NBt:ACSjGoLpWM6VbBVjxCZ2wuhttQCXt
TLSH
T159935C5AB28DB376D0E259B88E0DF2E1BD393E301E29186BB69D1F0DDE771C1190C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2796-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2796-894-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2796-1257-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3308-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5592-8-0x0000000000400000-0x0000000000429000-memory.dmp

Download