1e15b9a305c573592424438b7a86b6623abffd5a0f6a9ed85011c17390b89920

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 933KB
Sample260523-ek6tfscv8j
SHA256 1e15b9a305c573592424438b7a86b6623abffd5a0f6a9ed85011c17390b89920
MD5 830dd39e91abba86a4c4096b6a8ef0ad
SHA1 77f7c98452534a1a2a142ffb2e4471cf3f48f663
SHA512 6eb91250656f8d154f665e1381113062b76dd616496dc92f043771041b865b74403c433c4aaaa27dbe9baff7cdccbadb382b7699f86b5c375a220850fd8601d1
SSDEEP 24576:w4R5CIH/7mc4R5CIH/7020GNcydWXkcDPjHg9PnNUcQU:wabH/CcabH/YoYXxPjH+PIU
TLSH
T128153951B7D400A9F073CA75A8758506EA367D750B60DE8F6380760E1E32AE3AD78F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
2324	UpdatAuto.exe
3564	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar~4.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2840	sc.exe
4392	sc.exe
1744	sc.exe
3600	sc.exe
2236	sc.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3356	javaws.exe
3356	javaws.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5040	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
2324	UpdatAuto.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4420	5040	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe	81
PID 5040 wrote to memory of 2324	5040	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe	83
PID 2324 wrote to memory of 4640	2324	UpdatAuto.exe	84
PID 5040 wrote to memory of 3564	5040	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe	86
PID 3564 wrote to memory of 3356	3564	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar~4.exe	87
PID 5040 wrote to memory of 856	5040	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe	88
PID 5040 wrote to memory of 2628	5040	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe	89
PID 5040 wrote to memory of 4088	5040	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe	90
PID 5040 wrote to memory of 652	5040	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe	91
PID 5040 wrote to memory of 4888	5040	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe	92
PID 5040 wrote to memory of 2512	5040	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe	93
PID 5040 wrote to memory of 3580	5040	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe	94
PID 5040 wrote to memory of 2840	5040	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe	95
PID 5040 wrote to memory of 2236	5040	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe	97
PID 5040 wrote to memory of 3600	5040	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe	98
PID 5040 wrote to memory of 1744	5040	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe	99
PID 5040 wrote to memory of 4392	5040	2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe	101
PID 4888 wrote to memory of 784	4888	cmd.exe	112
PID 784 wrote to memory of 4648	784	net.exe	113
PID 3580 wrote to memory of 544	3580	cmd.exe	114
PID 856 wrote to memory of 1464	856	cmd.exe	115
PID 544 wrote to memory of 656	544	net.exe	116
PID 1464 wrote to memory of 3148	1464	net.exe	117
PID 652 wrote to memory of 1152	652	cmd.exe	118
PID 1152 wrote to memory of 4568	1152	net.exe	119
PID 4088 wrote to memory of 3748	4088	cmd.exe	120
PID 2512 wrote to memory of 2024	2512	cmd.exe	121
PID 3748 wrote to memory of 2436	3748	net.exe	122
PID 2024 wrote to memory of 4236	2024	net.exe	123
PID 2628 wrote to memory of 2052	2628	cmd.exe	124
PID 2052 wrote to memory of 1992	2052	net.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4420
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4640
- C:\Users\Admin\AppData\Local\Temp\2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar~4.exe
  2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    "2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar~4.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:3148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:1992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:4568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:784
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:4648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:4236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:544
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:656
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2840
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2236
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3600
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1744
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.0MB
SHA256 b5152962ab86e82c36309bc18215b9b7de0626d15d1b2533afd170a007e1c717
MD5 ba103cd03db852ea82b9d8247a771da8
SHA1 e407eb7238c7d2da6cd87ab1705e40c033d93070
SHA512 cc746784e2705ba0bd8d0dc7b5caa18c8d1f0f4c28827aa08a1803efcdbdf6454fdc7709ca1dcd03b83d84ed0e93ff0a3618fff4aaf4e4dbded0755147681ec2
SSDEEP 24576:w4R5CIH/7Fc4R5CIH/7020GNcydWXkQ0Le5ji0hmxNrM:wabH/ZcabH/YoYXJPji0Aj
TLSH
T1AE353B11F6A44225E073C5B9D8E1964AED323D610B308DCB6381B76D2E376E3A935B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.4MB
SHA256 81b356b4bc089b37dc33d99811142e9830a5a0385bd267d13e054bc7885113d3
MD5 8e7f47fa604a4c09e34223eb6da1c402
SHA1 539fd9fda8bc54c5a9681b0185c7d6ee7270abca
SHA512 69829e09b9de4531c25bf957c721fc5a8e5d128359ebd533cefa252e8d4cf2e0a14bb7f74c4dc300a503d9322d4217d1de05225eb3fd3148e58242ebee4ed345
SSDEEP 24576:w4R5CIH/7Fc4R5CIH/7020GNcydWXkUa7/ezSC6vUyD/aqgrvWx6q8wyu:wabH/ZcabH/YoYX2/ezSC6vUzPvMHjy
TLSH
T13A65F915B6788327E0B3C0BAC5E6A659FE323C520B3089CB5346B75C2D376E2953573A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bff3eeb898ec057eb00354d0229f8c214c44c7ac4634b5ef376fe9f89de97a15
MD5 11b5a086f02fbe6f17ea89bb724ca196
SHA1 509839c8d9ef7859355e8dea8e842a0395c21fb0
SHA512 4a77150babad11035bc9659177e12fb7bbf94b2163d86c63835cb6e4c0e34f383af122d98516a39790eb3e5810c5f66fbe0c8acf9d88e1d0422ac73ce8b0f316
SSDEEP 24576:w4R5CIH/7wc4R5CIH/7020GNcydWXkMVbqPb88hv/l+7:wabH/8cabH/YoYX9VO88hXl+
TLSH
T114452B21F6648225E073C1B9D4E1964AEA323D610B318ECB6385B71D2E776D3EA35733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 504KB
SHA256 cbe7b028da1196fa4ef946cfc5b60984dc9eec237ecd7a0a46ef98369537aea9
MD5 78aec9d827095bc70bb4e22d098bf335
SHA1 a4decb00bf8d31ffa8a5c9ac85e3747201abde54
SHA512 7f6f14e13d0afba83ff2835bcc5f3aa79ffa209a0554aef499b2fde3265dea5f8b31093d14980710989a6750ba2ba2583ece6c03be4796df7639626eb41b12be
SSDEEP 12288:w4Ryed8I7r/7mZBy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkia:w4R5CIH/7Oc4R5CIH/7020GNcydWXkia
TLSH
T166B41921B790405AF073C9B57874850AAA367E710B519E5FB3C0774E1A32AE3BDB4B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.5MB
SHA256 36da4b52363b8142c94b1967f609deda744de9a327d98f6d74e3a43731116155
MD5 edeae5dc43812be4eec970031840b6b5
SHA1 4690239bc869e8493d14c1ba8545f38c54de77ca
SHA512 189bee0f1df48610b244b04dcf1b5bb9865548f7d684ee45442b7ea7ad84765bcfe3a03f81f722ba930dc9d5916cc9ecb67a8877489bae67fc8dc51b23ffcf48
SSDEEP 49152:wabH/RcabH/YoYXQj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMr:Fg3QRQyi36YOcP+Lvw2gAf+PN34
TLSH
T103667D13F3A501E8E05ED974CF3952229B357C5A87B093EF269436E51A72ED07B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.5MB
SHA256 14678fe4e3fb5178654d605b24a3479ecc0449a825b2aecffb103a949268792a
MD5 b789dd826316a0204158fbb455e302ed
SHA1 e4171e6b5576b998197021827d8d87b9eae95b00
SHA512 f4305eeb90d92acab8a87fd9f687c07ddcb7b45a8380bd15daf18667688fc4570dd86637922c74364f04266b73546ae0ecc0cfb135420e2ff5a891fb60a9d43a
SSDEEP 49152:wabH/ZcabH/YoYXQj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMr:9g3QRQyi36YOcP+Lvw2gAf+PN34
TLSH
T1FE667D13F3A501E8E05ED974CF3952229B357C5A87B093EF269436E51A72ED07B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 53946ace2e5ce533add04abc6f547ba30c2d7519f2d5432adf1603eb27db16d3
MD5 4b80f8401c06d402fe31b5aa2d58ec21
SHA1 48bf1a17cb5339acf875f143e006ae94744f5af7
SHA512 96f32f212e6ff10bf692117ab36912f55164a9b40c5b931a1b12ee42fd1c4b6abe2ebb276de28105a24873ba85aca69949f50167a37c53dfb8b412a548154ace
SSDEEP 49152:wabH/8cabH/YoYXM68Qg55nhoeWu7PNU3/Q:AgGthHRc/Q
TLSH
T1AEB53933B2E20099D05ED176AF568721A6E27C718FE0D7DB8241730A1F72AD17A3971B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.9MB
SHA256 2bff7c2eca47abe6bb9a1b55b0f745f47f296739eb54d548bcd90f0c445b4c3f
MD5 15505bdd0cf2280e9de27a5396b613ca
SHA1 c5bde29370b5cbd332214d6e30dd76098b1984b4
SHA512 7369922c8123795dbf7b8ce91f5a595cc9a88449ec688eb190c08ff4fbef2f5aa4cf56338c64114f52bc3ddbb605331f122bf915a9e08e49995337a677148f13
SSDEEP 49152:wabH/qcabH/YoYXk3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgN3Oh6tznT:Sgxy5112gYy5azzVvf69nLKnhZO
TLSH
T1CE167B13F29900E8E019C179975A8232EA72BC534B31AADF0B5077562F77EE16B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.7MB
SHA256 6d46c448728287cc29eb061789f273c56184df49d68143a2f1b4895485dcf077
MD5 6274f1893969865a0c56696e51ff08c2
SHA1 43de4a05c97bd9fd4b0b5f7ffcf17b86ba185aaf
SHA512 149f049fb3b35ef016bb3cff495e81e77986e0fbe914091049b99e3853b56f7be0ce3217f45dc02023ba21ead950ba3a19aa7e82c1d973f54bcb0d08edd1374c
SSDEEP 49152:wabH/ycabH/YoYXBB+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:qgXu6Jm0xd2d3
TLSH
T165D58D13F2D500E8E06AC47897599122FA72BC650B30BADF179073562E77EE1AB3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.1MB
SHA256 1f31def3dffd95a749076243ef87fdf86eec18862f33f547708dae9213898f56
MD5 eb1064243f91032f34ff2f4150f749a5
SHA1 bb6675b70faf687cc3f740ba7c32e837b1eaa111
SHA512 30fa2435f9386d99741a139f3a61ab2188f6fd2f15cd67bb1627094bc3aacb835313721540c85035b6d974bfd99b89c9be5ab8c6312c0c1f7448f65fbdb72335
SSDEEP 49152:wabH/ycabH/YoYXh1hpsNoJpF1A6GU44CwH7R4xu:qghmifP5R7
TLSH
T17DA59E13F2D400E8E06AC5799B558226FA72BC610B20AADF1780775A1F77BE16F3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.3MB
SHA256 8168d31743bf2535b300553a98e41c08711f477f8afd2964c16c8bc0d2d9b9e4
MD5 1eb412c01d156c8f26a84d7b2bb00873
SHA1 e960096c9a5cb62b30a810d5d6b8c8c4dee7d786
SHA512 9a927e332b5e203c4b16d6daab273018c44c6463b4aa9bcb4ffa205901d58c7f5df21d177dd4145bed50e7cfe54a30a7b6742a3d798a3c78dbf47365ae34cf8f
SSDEEP 49152:wabH/GcabH/YoYXoSuZQIY0Be2K8RVtOnks6NMHq6:+gy5dKCi616
TLSH
T169B57E13B2D940E8F0BBD5749A754126EA72BC610B30AADF178072591E77FE06B3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.5MB
SHA256 2ee472c492a7e5365f681f59c23d6a451c744b60a594009f58f225951621ed59
MD5 6a88a4563d8ff8768648ec19733d9100
SHA1 66f2b00d367c6613f9bb2cf92d5d2c06e87004bd
SHA512 fa149c8543b14fad7cd2925adb3bfb9fba77885f907ae0a632c895a4b8ee99b25312f17b654426e67ebdf9022a07430a20a1d889b968c814ea6ff808f53479c3
SSDEEP 49152:wabH/RcabH/YoYXhyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTH:FgYm7vj1BDlZG
TLSH
T159069D13F2D940D9E01AC07997568232EA32BC550B306ADF1790BB562F77BE16B3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.9MB
SHA256 95797210d603d1e4e2156d74eb004616c3bcc7160a2d6932ec2acc99a9532d4b
MD5 da44411d2af895b52c22b2456fb24044
SHA1 5687b152ce4f87f207ad6fc05941b5b8de2313a9
SHA512 589beb5cb06b6380b2951b3e737bbaf2a2f311b0c5a0a4d81e2bc30c0e3f9a08c6eb40545fc197583f1faee03f7ef20e324b6f0a0f0af78488ace6d9487853f4
SSDEEP 49152:wabH/ZcabH/YoYXyhtSn8EApI0fig1giDn0AP5w2:9gzX2iwphX
TLSH
T1D5958D13F2D440E8E06AC579DB558622EA72BC210B20AEDF1780775A1E37BE16F39717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 513KB
SHA256 58d302a7056d55076b2e12eeb04bacae9a3454407c49b2e28f28f921ae1ea83d
MD5 b8e9e3b136ba672070ca30643331b9f9
SHA1 e3dab422b1474f2e0e7ad44b5b540726fad09eee
SHA512 56bf01c3bdd12814e0c182d0fdb8a4c5d591685b788d7bfd8a079d4d2e6282e524992400156afb70e891993cb14bcbe9789581096bf0b977c94860a9534da390
SSDEEP 12288:w4Ryed8I7r/7mCBy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXk17:w4R5CIH/7Bc4R5CIH/7020GNcydWXk17
TLSH
T19FB41A21B790405AF073C9B57874850AAA367E710B519E5FB380774E1A32AE3BDB4F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 513KB
SHA256 cbc1c56fbf44051c3377d80423a57951aeb0e44492e395131b22344ac5148a89
MD5 6f9eec5fc680752c8016e67d9bd8c81b
SHA1 ed6400a0276a31afa5809e49050003f96226c761
SHA512 cf511785490f65d45b11b077ce631c800418bd3aa4f5b0178d243fdc4f44116731d57f8001f0395a81e0efc92d1be49aa707679d5ee5592dfb78724ca2d34fbd
SSDEEP 12288:w4Ryed8I7r/7mBBy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkzx:w4R5CIH/72c4R5CIH/7020GNcydWXkzx
TLSH
T19EB41A21B790405AF073C9B57874850AAA367E710B519E5FB380774E1A32AE3BDB4F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 513KB
SHA256 90a8b9cfd0abe14fabc16225febce88878f10a893840d37d5ba9731561c3a582
MD5 e266a6cc4d5cbfaaf398f1e42d8eb500
SHA1 8ee975866aa3b37b4a7cb84889895e109b7a5e9b
SHA512 c26f0f885ed54a00cc606eb8f7d76860dde86d5472c177f24329fd445f0587ce2ba45739169aaa936ecfc383d65a25dc3c897d3d56e098b7e933d6a310d2760f
SSDEEP 12288:w4Ryed8I7r/7mBBy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkFs:w4R5CIH/72c4R5CIH/7020GNcydWXkFs
TLSH
T1C0B41A21B790405AF073C9B57874850ABA367E710B519E5FB380774E1A32AE3BDB4B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 534KB
SHA256 bf8b543db9354ed74251a31675c224a54a8e90f82cace024ad79cd01c90cabec
MD5 7e6ff52adb652e85832232418a672636
SHA1 8cb917b74f80fd07cafccb8385684c92440a739b
SHA512 e860d8b1247b6e6acf4242598c4749c0716d5c287a7b736a61078ca814633a003e04e3a53f977a1faef841484aa787665a28cf8eea0f95450809ed9863beebde
SSDEEP 12288:w4Ryed8I7r/7mRBy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkCVc:w4R5CIH/7mc4R5CIH/7020GNcydWXkL
TLSH
T17AC41921B790405AF073C9B57874850AAA367E710B619E5FB380764E1E326E3BDB4F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 513KB
SHA256 767a571327e6eebe2f0781174cc7cee45e9af55167dab373ffbfa6f73c5fadf1
MD5 49676d51a8031f99e43af41a9bf47220
SHA1 017db7f4ae71c900385603d07032142816751e6f
SHA512 90e6ab78c94ecbb3004cab5d3a9451bbddb1303c603b341488365a23aaa641038b5549c29469ede9713f1a44b9f94f6c0ce8d80e20147736fd00757654f934b5
SSDEEP 12288:w4Ryed8I7r/7mBBy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkMZ:w4R5CIH/72c4R5CIH/7020GNcydWXkMZ
TLSH
T1D7B41A21B790405AF073C9B57874854ABA367E710B519E5FB380770E1A32AE3BDB4B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 633KB
SHA256 a933200ffe4afbbe4af9cd3a6a1127220090892fb07a55effd92bc4dd6608a80
MD5 b8eef202c7c6fddcad2dcb7e348376fb
SHA1 4be727ebe269a0d3d2e24c6dce34edb7a64f1127
SHA512 7f595fa30d36d9c46631f5a5d2cf3de956ccbec38e294299be5733fe509e79e5d51a424f3d4307b7d55303ada659e0e50aefbfb2929aff9256330d8bb3206748
SSDEEP 12288:w4Ryed8I7r/7mtBy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXk2Xsf3z:w4R5CIH/76c4R5CIH/7020GNcydWXkVD
TLSH
T176D4E511E6904099E06E8575EB648505BA277D710BE09E8BB3C0F63E1B326D3BDF4B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 546KB
SHA256 392364b50b84662855ccda590d4b96a2c25b11734f6324a97287fe301d5abbcc
MD5 97030765e3c4ecf9fdb3ed33858999c7
SHA1 43776b1571f159d187a8b847b20703141b2caca4
SHA512 cfa4c474f79a4a37c1f8c8b7f7bafceccf7c52038145e3219487726ae77e22d28122a329f0e7257497bf3856a01e87d4ecd8c5a411ead740c08d172932aa46d9
SSDEEP 12288:w4Ryed8I7r/7mBBy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXk1r:w4R5CIH/72c4R5CIH/7020GNcydWXkh
TLSH
T1DEC41A21B790409AF073C9B56874854ABA367E710B519E5FB380770E1E32AD3BDB4B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 554KB
SHA256 343a91b99a366a17388ffbb4c04d0f596429cf91352f7a22074ae67f5896f5c1
MD5 adeaa4f54195b12049f236c5c16f4f8e
SHA1 3181e74cdf5d2243b2c770e5b3971ec62b22ce2b
SHA512 412aa4d506ded2309adf28f8ae4b75bd183076239b7bedc8c5efc4e861963691b9287cee4aac88a880c7ab694a5cb20d552a802ee48d33c8dbc9ff93857585a5
SSDEEP 12288:w4Ryed8I7r/7mBBy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkjqnkraG:w4R5CIH/72c4R5CIH/7020GNcydWXkjj
TLSH
T18BC41A21B79440A9F073C9B968748506BA367E710B509E5FB380770E1E72AD3BDB4B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 550KB
SHA256 fc12837a38d96d29666be613e9eb58600fd2a3ad047a036d20e78eb9a6e11d15
MD5 19eb2c86db18310f079904b628cff2ca
SHA1 ce3a114981625878400ecd1c22ccaeb082ebbdcb
SHA512 41f31783e3e4a91ebce21ee1e6d3bc5bd5c78ca9ba672b5928b9317a51a94b400d236588ce4095f897a468696fa3dd2cc25295ef719fff9414953f64cc1f246b
SSDEEP 12288:w4Ryed8I7r/7mVBy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkRpIyvJd:w4R5CIH/7ic4R5CIH/7020GNcydWXkRD
TLSH
T116C41A21B7904099F073C9B56874850ABA367E710B509E5FB380774E1E72AE3BDB4B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-23_830dd39e91abba86a4c4096b6a8ef0ad_cobalt-strike_elex_icedid_njrat_vidar~4.exe
Size 443KB
SHA256 10467a911647d77681726b62eb12685306d715716f4cd6da6b785e7883b65fb3
MD5 d978544e353fabdaa2a06a501b7143bf
SHA1 c040ca5c0913c9c2ddc30ffa14120ef79289ee02
SHA512 9e37e8a2c08a3664ad042fc605adf18663c1b62b89058547558e754c85bfac9c9fab696932a042230dad2be3252b0aa32bd902663def051f81a7f79e36c97121
SSDEEP 6144:MN1nvYeF5UfHOx3XDX/4yR5k+vP7MFPzPnNU9yfZnBXCvX8:MDQeF5UfHOdXDPjH7MJzPnNUcCvX8
TLSH
T19FA43950F3E414E8F0B79A3589769511DA767C9A1B60CE8F13A8261A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 490KB
SHA256 10f9d03af41a4e79b0dc49a62e0c1fe226a3d3f7aadaebd697c24e40b4a5d567
MD5 461f110a92d2b6309323c332b3d11a4e
SHA1 b7355a1f0d72711132fb79c760368c43d3f433f5
SHA512 9792f2c2deeb1340216e65e1df58ca77ad8c555ec5af127c6df014ceea420988b4563e8fcd3050e833ca1ceb7d7070d0701dd4c629230585b0d95a4938678b16
SSDEEP 12288:w4Ryed8I7r/7mNBy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkl:w4R5CIH/7mc4R5CIH/7020GNcydWXkl
TLSH
T17DB40921B790405AF073C9B57874850AAA367E710B519E5FB380774E1A32AE3BDB4F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 024506c17d739df0615213724c8a0ad5ff1c2c507c7abff8333fd02128b0c1ef
MD5 910f94711ec39e65636cb5704ab64216
SHA1 cd2fa7178a67cf3ed7a0bf9398660be6bbe09db8
SHA512 fb990110a8ed78f3897cd6338865b426d1302f3a0584cce7d8d15717dc8771d48cae26b2e750a9b7704ffcf52e284b016a2fe938d5191267fcc14f27041e8955
SSDEEP 12288:w4Ryed8I7r/7mBBy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkl:w4R5CIH/72c4R5CIH/7020GNcydWXkl
TLSH
T1ABB40921B7904059F073C9B97874850AAA367E710B519E5FB380774E1A32AE3BDB4F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 7536a5a616be5b6f527d832f160964155f3462873295d9ba3c05248f3e49b7d4
MD5 c2cd5a5cc5b4d020819d8d953af6319a
SHA1 2847a89e8ba4df2238d7f67e9c1055b3f32051dd
SHA512 a5ba7f2a73fbaea7e2bb28608d28d7a583e4f479821a310be948649e6a42184425b62f090e92c055f4a7fa8522625eb83b114072847ac99d37ef2593e9335719
SSDEEP 12288:w4Ryed8I7r/7mCBy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkl:w4R5CIH/7Bc4R5CIH/7020GNcydWXkl
TLSH
T1CBB40921B790405AF073C9B57874850AAA367E710B519E5FB380774E1A32AE3BDB4F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 db43d768d0a343593f5a239c368f923758cea92f72e3b999cd0b69516803e26f
MD5 fcf939cc7e4fd7e6ad2816adaff5da0b
SHA1 63c6e97f95fc80984d5ef07a69a6190d3354faad
SHA512 6a1a27d62ffdb8e6539c8583ce71ab8f439f30aae850f6446c5df5ed24b3744e2587dc41b1e60e993d20513d1ac34bb5b983d17680ac7576c96b15b38a388535
SSDEEP 12288:w4Ryed8I7r/7mRBy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkl:w4R5CIH/7mc4R5CIH/7020GNcydWXkl
TLSH
T17AB40921B7904059F073C9B97874850AAA367E710B519E5FB380774E1A32AE3BDB4F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 145a738d7e03e0dc49f88a41935d23cd175bf169397ddea6c22b0c64bd929600
MD5 a4677c2111baa50020e7d090eb531569
SHA1 5645800f47faf7c0dcc2fbff2847fca9f7dd4819
SHA512 c40a2e5240be0a6aa5754a200688d79ee14b12f7639fac8b5269bd7fabe16c13f02b3653fc887ca0a8f5275399d439cb4fda2fda50c9277a6745853425a01003
SSDEEP 12288:w4Ryed8I7r/7mABy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkl:w4R5CIH/7jc4R5CIH/7020GNcydWXkl
TLSH
T11CB40921B7904059F073C9B97874850AAA367E710B519E5FB380774E1A32AE3BDB4F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 27c8f591ce7f6a9d4c742b127e8a474614db597ee4f6d9d54786d9b7dc00ad35
MD5 ec10ab8cf9e955ce30fa13fb94c2b02a
SHA1 2d9ce325154789f74d1ea26d7c6e4bfc6cddfb1f
SHA512 1304dafe32f59332f649f815b7736520a8e789423338c3f0353d2c43f3ec51210c41cd73e183947e6d87ee8d10d7bf321cbb5a7c5e66db9ffeb0b0826c8ad3f0
SSDEEP 12288:w4Ryed8I7r/7mVBy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkl:w4R5CIH/7ic4R5CIH/7020GNcydWXkl
TLSH
T135B40921B7904059F073C9B97874850AAA367E710B519E5FB380774E1A32AE3BDB4F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 530d2fcd320627ed6314a1f7bfddf5e41032a88459d9b82c7612569648a565c9
MD5 fcc354eae578b9744f2473dba1349070
SHA1 1d58a7c4d3249eb31ed9525c6c8527953aa2aa53
SHA512 1e69cd1eccae03d869553d81301452db2cccd5169f1d9a3098bbbecc7067b7779f735ede691ec9ad9ab263f1c0eb605fb26f2c553d01d8aa3faf9626eb7165f6
SSDEEP 12288:w4Ryed8I7r/7m2By4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkl:w4R5CIH/79c4R5CIH/7020GNcydWXkl
TLSH
T14DB40921B790405AF073C9B57874850AAA367E710B519E5FB380774E1A32AE3BDB4F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 907a09da74fef020fe49e0e4d23138f2fe67c0b42080e8966d4dcd804282651b
MD5 993c6ca0f97e05ea6a017e1d4c40379e
SHA1 5386ee66528f674b91f76325bc5ba5d85a92e97a
SHA512 b57ca3fa7910c6c81c4fc1aa29d3e9ce7103652390b522e32a5175400a85cb86c6af59444459220622ce3a5e1989b580c4f5f2060b69202a236aa370d27e4eec
SSDEEP 12288:w4Ryed8I7r/7m+By4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkl:w4R5CIH/7Fc4R5CIH/7020GNcydWXkl
TLSH
T1BFB40921B790405AF073C9B57874850AAA367E710B519E5FB380774E1A32AE3BDB4F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 e10567921434edf1e3e4a612e0f68d27558999f524e364261dcfdc838a384b2b
MD5 f248c4ec1d50c1360730d38dd99e7fc9
SHA1 f21f7db90e1ef2a0f357a97f0ea0e2fb24c68c48
SHA512 0a22e5fcc8f0b2cf6cd3004912b5715f3a524490d0fbb183c83b8c819a0b61e791daf5a1407cb20c45f0b36908d74d14ecc81ac1c32b99e62cc50f66ac807694
SSDEEP 12288:w4Ryed8I7r/7m3By4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkl:w4R5CIH/7wc4R5CIH/7020GNcydWXkl
TLSH
T113B40921B790405AF073C9B57874850AAA367E710B519E5FB380774E1A32AE3BDB4F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 47c82a9883fe47801f9c2f91b20c2e7799f6390fb69b9c46d54eeb7c3e27ecf2
MD5 3d887cd31ed1b1f1c223fae32419a9fd
SHA1 6ad0792fad7754239a6192776d52475e0f736fab
SHA512 7b8138b363211bb7de83e15ebd1abcef2d217fbcc3d0de23929eb92a84165c2fed3154481b934ba02fc17c9f0b803c48ef5529f6aeec000c66fe63693f6a0471
SSDEEP 12288:w4Ryed8I7r/7mZBy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkl:w4R5CIH/7Oc4R5CIH/7020GNcydWXkl
TLSH
T148B40921B7904059F073C9B97874850AAA367E710B519E5FB380774E1A32AE3BDB4F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 490KB
SHA256 6ecf57833daa6fc8cc5dbb965ffaa07fd134ba7dabeec63cd85795a0e1b09848
MD5 6d58bb3bde34d4415cf3792b435d1cf0
SHA1 7bf502167e40c44dccd301ad7e84918afb4c738d
SHA512 356119f2e936471f8adb9a94a6acb4e1995c9175beae36e253e566ab30e54d514874e804401e18ec25955dcf512f3c8da5aac424abb54299107e890ee98a9b0f
SSDEEP 12288:w4Ryed8I7r/7mtBy4Ryed8I7r/7mTL1fh7NhO0ZUrxOBlyO1UdWXkl:w4R5CIH/76c4R5CIH/7020GNcydWXkl
TLSH
T1B9B40921B7904059F073C9B97874850AAA367E710B519E5FB380774E1A32AE3BDB4F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download