f3fd6b3f4b88de8934a6e5aab7c5589c33aa4dbd9777e0f69b7282ac9d7fc94d

Analysis

max time kernel
149s
max time network
139s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
Size 20.2MB
Sample260525-ff1bjsa19n
SHA256 f3fd6b3f4b88de8934a6e5aab7c5589c33aa4dbd9777e0f69b7282ac9d7fc94d
MD5 44c9d5784ad796d7a07892d50ea02972
SHA1 66134f5bbad8bd5f9ffd306e750bee6bf4e05585
SHA512 af9e8954d7af786db5fd27e4df5eed020fd1fdf00a1afc2831202871a3f801c1c07678cb2c70bcc1ba640265e71bd1c1c608e2af44175db4d265550ef066097d
SSDEEP 393216:ds9yZ/K0ttYZTd3RwlptVYmfr7yBG/4uOzH01/Nc1eJ/RXZMPDyiX:eyZ/K0ttYZTdGpttD7yBG/jx1/N/tZU9
TLSH
T19827F113F2E940A9E0AAD175DF3596319B327C194BF164EF328076D81E76AD07B38722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1396	UpdatAuto.exe
4824	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar~4.exe
4716	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar~4.exe

Loads dropped DLL 1 IoCs

pid	Process
4716	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar~4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3020	sc.exe
4768	sc.exe
2544	sc.exe
4724	sc.exe
696	sc.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar~4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar~4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3600	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
1396	UpdatAuto.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 2840	3600	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe	84
PID 3600 wrote to memory of 1396	3600	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe	86
PID 1396 wrote to memory of 2888	1396	UpdatAuto.exe	87
PID 3600 wrote to memory of 4824	3600	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe	89
PID 4824 wrote to memory of 4716	4824	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar~4.exe	90
PID 3600 wrote to memory of 4604	3600	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe	91
PID 3600 wrote to memory of 3568	3600	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe	92
PID 3600 wrote to memory of 1036	3600	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe	93
PID 3600 wrote to memory of 3544	3600	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe	94
PID 3600 wrote to memory of 1080	3600	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe	95
PID 3600 wrote to memory of 2120	3600	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe	96
PID 3600 wrote to memory of 4572	3600	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe	97
PID 3600 wrote to memory of 4724	3600	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe	98
PID 3600 wrote to memory of 2544	3600	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe	100
PID 3600 wrote to memory of 4768	3600	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe	101
PID 3600 wrote to memory of 3020	3600	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe	102
PID 3600 wrote to memory of 696	3600	2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe	110
PID 4572 wrote to memory of 2184	4572	cmd.exe	115
PID 3544 wrote to memory of 4676	3544	cmd.exe	116
PID 1036 wrote to memory of 2988	1036	cmd.exe	117
PID 4676 wrote to memory of 1620	4676	net.exe	118
PID 2184 wrote to memory of 4072	2184	net.exe	119
PID 2988 wrote to memory of 2588	2988	net.exe	120
PID 2120 wrote to memory of 3268	2120	cmd.exe	121
PID 3568 wrote to memory of 3056	3568	cmd.exe	122
PID 3268 wrote to memory of 432	3268	net.exe	123
PID 3056 wrote to memory of 1216	3056	net.exe	124
PID 4604 wrote to memory of 2280	4604	cmd.exe	125
PID 1080 wrote to memory of 680	1080	cmd.exe	126
PID 2280 wrote to memory of 3256	2280	net.exe	128
PID 680 wrote to memory of 4836	680	net.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2840
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2888
- C:\Users\Admin\AppData\Local\Temp\2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar~4.exe
  2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar~4.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\Temp\{CB4AA75A-19A4-46AF-9152-D9BF593FF519}\.cr\2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar~4.exe
    "C:\Windows\Temp\{CB4AA75A-19A4-46AF-9152-D9BF593FF519}\.cr\2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar~4.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar~4.exe" -burn.filehandle.attached=728 -burn.filehandle.self=732
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:3256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:1216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:1620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:680
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:4836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:4072
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4724
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2544
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4768
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3020
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 7.5MB
SHA256 35418765f441c4a91a5cecea6df37eadb663e942b5962eeacac7f50c1a9707bf
MD5 78071a7e4da3103913fb681061253dd4
SHA1 bec56c0fc43607971cb450ac7c3f459e12c75dda
SHA512 53040a94a2fe12e54ea0c2f7368c4ee9eb410367e43007a18592d743cd4bbaece0f2962b7457cc3b5cefc46b59bda31f329cf14edd74103247727bb88c3664b5
SSDEEP 49152:wabH/vcabH/ap/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRx/:ZsiWQtZ/K0tGOFWVRuLftCTyjo
TLSH
T1F5765B13F6A841A9E06AD174CE759721EB327C594BF1A5DF228073D42E73AD07B38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 7.9MB
SHA256 1af3531b9dc07575c993634c6b915d9d007c405be6c7e72399a11816757fe64a
MD5 ffc557827adfc72382d71619513f2441
SHA1 998ddb70b531f6ce3c526d647e0ae2de8aade4fe
SHA512 b8aac71cb51f21a71d50d2c475d116592aeb6f02e50c7057261555629c90ac205c40ed5033bb226f0c8639283dfe15b3a2eb189e4d9d52c63efc0478fd5f6bd1
SSDEEP 98304:ZsiWQtZ/K0tGOFWVRuLftCTvezSC6v2XMH:ZsiWyZ/K0ttYVAAT0
TLSH
T12A866D13F6A841A9E0AAD175CE769721EB327C564BF164DF224073D82E33AD07B38725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 7.6MB
SHA256 07dd567d2e5a136a4ee95bbe7dc0945b665a5eaed58bcdf7b37d2c662c4b9650
MD5 fcb95a9dbfe94fa89322ff6c4b83f499
SHA1 6ae6dae4c5eb0f631cad2ee697cefe67dd7c82e4
SHA512 c9ec33c59cda155effff553b16828f9e9d6ba1ab61aaba1ff3370f4d9b173ed5f4dbb2cb92121fbd3f439039c48e9f09211436ee0a0c7f7f507b2c02898efd4e
SSDEEP 49152:wabH/mcabH/ap/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxO:MsiWQtZ/K0tGOFWVRuLftCTv/h1+
TLSH
T19A865B13F6E441A9E06AD174CE729621EB327C554BF1A5DF228073D82E77AD07B38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 6.9MB
SHA256 ad8b258caf0c29047fba4a7fe9be7d7ac82b05fb3e1b97ffc08e0e9901de7e02
MD5 713d3e430f82f9e9887536ec2377dd1f
SHA1 8484936fbdcd70943bdf08d1b046609395c6cf5d
SHA512 0615bdbec9b45448e05f1703b12bc25850ea3fc3b31ff90c5e42d9e1a124f96b5ae1b1a329ad988d8ef3a0e1c8b7aee806b071d0db9844493d9d1fc93275ddc1
SSDEEP 49152:wabH/mcabH/ap/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxu:4siWQtZ/K0tGOFWVRuLftCT
TLSH
T102765B13F6E940A9E0AAE174DF359721AB327C594BF164DF328032D41E76AD07B38726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 13.0MB
SHA256 045987b3d0130dfbe9fb30e4ea1d07e599b0766aed768c1a5419733969451c99
MD5 5cd4a13c831d9cf941710a07ca79ad71
SHA1 38e90e6ef6a2857b26c5a9287e9e5f91314ab7d2
SHA512 48e866fbff4cba844638327db5f2b7566e1c870210ebd89254c92ac4ad1f21ec4337cdf8a720fe0cdd9bc898bfc3b4d2f19aa08246753bc051bdc43ebd1049e6
SSDEEP 98304:ksiWQtZ/K0tGOFWVRuLftCTuQRQyi36YOcP+Lvw2gAf+PN34:ksiWyZ/K0ttYVAAT1QyiKaUX+PNo
TLSH
T11FD66C13F2E501E8E05ED574DF3952229B317C5A8BF1A2EF219436E51E72AD07B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 8.6MB
SHA256 e77d7c1670798740b99bae9c7676dc2cda24a3b6a3dbc6b4e35967b9a4745db4
MD5 a855c50d10941d1b3ed3dbe339fe44f1
SHA1 e1e50bec6aa15c8845f97ea68a13386bc1f3218f
SHA512 7341aedd5d75dcbac9c02cd91f66595d8491c4cea1e211da2173fb6de6ff1a3c6c825d94c3e837dc671039ed2aa32da02399fd32a8fe9c53b37d1166a8743c55
SSDEEP 49152:wabH/icabH/ap/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxN:ksiWQtZ/K0tGOFWVRuLftCTJthHRc/Q
TLSH
T1D5965B13F2E500A9E05AE175DF2687319BA27C658BF1A6DF224033D51F72AD07B38726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 10.4MB
SHA256 8b9865e3db4ee1b4f289d4e1151f1d56edeefd47d72bbb65f77dc203e901ef90
MD5 31406703f16c6149c1b3120c60895ac7
SHA1 39066fc5a202947fc9f213c8b71e29c575f29595
SHA512 6147bfce24bbc64e72678ff292063a7c15fde4af7f6a27a644567eadb94b7c2148b1efc70823843dbc474afeb10430f4fbc2b1910f676b6181fa85d5fcff3942
SSDEEP 98304:ksiWQtZ/K0tGOFWVRuLftCToy5112gYy5azzVvf69nLKnhZO:ksiWyZ/K0ttYVAATBLIHuWhs
TLSH
T152B67C13F2D900E8E05AD178DB269232EB72BC564BB1A5DF264073D52E77AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 9.2MB
SHA256 9d100f5b66bb185141effcad5a94c043cc159e4b651c06997be917028c69ae9d
MD5 844ef9d34b0d532c5867f5c794135ffe
SHA1 fe782ebae67dc209b08951ebcf39c242f8bbbcb4
SHA512 1fc97ec549c8c335d1655b38e71e1d5bffff22cfbf512d8cc39c93a7076f0e48190af6082a26129bf35b75655d987d70706533178cc7acc1aec2c3960999366b
SSDEEP 98304:ksiWQtZ/K0tGOFWVRuLftCTSu6Jm0xd2d3:ksiWyZ/K0ttYVAATh6Jm0G
TLSH
T124A67C13F2D901E9E06AD174DB259232EB32BC594BF1A5DF228072D51E77AE07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 8.6MB
SHA256 8fbb45404d95bebb12a61bab265b58fcfdccc2041e5da9ae6d8afae8944da7d1
MD5 0144a08bfd8b6ea5325d66e90c13fe43
SHA1 81bd19ef8bd5b791a71b2f96282d0f68457a987c
SHA512 82fba6e7bc7fbe1282a56f749b50d626190f2be867046c2ecf98b42b4777d0dfb6b017656c189de9404b40e1b023e721b5c7206b64d2a9c0c636b25c82fe2ec5
SSDEEP 49152:wabH/icabH/ap/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxW:ksiWQtZ/K0tGOFWVRuLftCTimifP5R7
TLSH
T182966B13F2E940E9E06AD178DF259232AB327C594BF1A5DF228076D41E77AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 8.8MB
SHA256 90bcfc29281d8ce65f191828daa60cf6519631b6be5600bc53ba1e9f9ebfe602
MD5 7cdf2b0a99b867e7647bfcca38618e82
SHA1 1a7815fea8cf0314eaf4550bb6414cfca69915e9
SHA512 304265861157569774875ce857f9dcf69fe5ca4958a67f78014a8d1317eb6320a849ca961716a9dca0a74409b847d0c08a3ef9f07fda1667a1688b5fc7b06e0b
SSDEEP 49152:wabH/icabH/ap/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxq:ksiWQtZ/K0tGOFWVRuLftCTp5dKCi616
TLSH
T1A4966C13F2E940E9E0AAE174DF359222AB727C554BF1A5DF224032D51E77AD07B38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 10.0MB
SHA256 7f4320bbcd1d066bb133748ec79f054830523f0eca978187dbdbc7d95d5d0e13
MD5 67fb9012f808ae784300138a6a3ec649
SHA1 be7c9d1dccd0feb1ec98d8bb5f39cf9806c29396
SHA512 4135ee3b44fd6ecf0995684559df93ceef5bbfce5f8a97ddac7b45da3fcf4bccb7bf63451eca77f71d1797c7807b33de0b1abca92b546b1c38d37ebd0c8ff992
SSDEEP 98304:ksiWQtZ/K0tGOFWVRuLftCTzm7vj1BDlZG:ksiWyZ/K0ttYVAATijnDO
TLSH
T118B68C13F2E940E8E05AD174DB269232EB32BC594BB165DF228077D52E77AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 8.3MB
SHA256 456b4bb2b5a2ff7cc9c8e0271036389cb92ca50c455907c33142ae77c7e8c960
MD5 5eb1112187d4cf9357c4d8e0bb1f2d22
SHA1 87036fc307db897f89daafcda316c2159ca662d5
SHA512 035fdf323db7e5c4c8f8b20d49eefef73b78214c56d6af283f193bf2ca556b9891d9d6fd981932a2ef86ffb732d8edf07b3ed8cc247c1035442fec6bf3efe8d0
SSDEEP 49152:wabH/icabH/ap/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxV:ksiWQtZ/K0tGOFWVRuLftCTkX2iwphX
TLSH
T12C966C13F2E940E9E06AD174DF259632AB327C5A4BF1A5DF228072D41E77AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 7.0MB
SHA256 90febe1d2f30f95c8a9a3b2f9b467e690a755c32e5564e079d0aae1a498f4fb3
MD5 407646e78a16bc3f7262d39c598d0f23
SHA1 d89fcb42e410c170fa75deeb5ffde5541b2263e8
SHA512 aedfcc65555f0c65fc844ab9bb4c9623e6703074fb95743fcbd50fe505628d168f80af8cdd6738277b456e1210bdb64f02d05d0ef0538f9c0ba7f73804b1dff7
SSDEEP 49152:wabH/ucabH/ap/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxt:wsiWQtZ/K0tGOFWVRuLftCTV
TLSH
T1A8765B13F6E940A9E0AAE174DF3597219B327C5A4BF164DF328032D41E76AD07B38726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 7.1MB
SHA256 0a94187f7cac8441a5d5991dfb2cc5da8a2a38f750f10b74af7362981af15784
MD5 fe482e90e1b060779be73fe157fc8bc0
SHA1 24df925b32818b70f5815121d508726ed9d779a4
SHA512 b24cc09b87d0e6552d5e26d53498c7ee0ab4bbb8e369d981b12b8e5d5994cc5ab0a4cce35c1c931e83b126472b579984a61eb2c22a6cc78790779ac202b5090d
SSDEEP 49152:wabH/6cabH/ap/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRx5:MsiWQtZ/K0tGOFWVRuLftCTR
TLSH
T1CC764B13F2A540A9E06EE174DF359621AB337C594BF165DF228072E81F72AD07B78722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 7.0MB
SHA256 bf888c2dfe2494d4c47b508edaaa978982e67391a069d080dba1d7b0d5d60301
MD5 186fe31a63099458945e85dbd21d6ea1
SHA1 4017dab1ad050d48dbd2898ce0ed1d04d08591b6
SHA512 1de3e70cd5bec37297b7557e7198fd0fb2fb5f716cede967cb38fcdaf39d158eccf1970eb4c50445d37420d21fd0428a734253204c3f650a8f279870b4167156
SSDEEP 49152:wabH/ucabH/ap/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxd:wsiWQtZ/K0tGOFWVRuLftCTl
TLSH
T1C3765B13F6E941E9E0AAE174DF359621AB327C594BF164DF328032D41E72AD07B38726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 7.0MB
SHA256 d13bf36d069d2937771bf11ddd5bc3ce3ec6f41cdb04112f0ef577983feb2344
MD5 6a73309d8d224b147052ac86b46d5a4a
SHA1 8c0b3ac972e670d04a759352a6869a3523380b94
SHA512 a0e93a15d5a1009e87cda30501c51cd66e475ac516a4d8ad8fb9cabe3ad5e62d57859909302685c9396a8ac77b4c284981c04d15cf7456aebf011cd084e85105
SSDEEP 49152:wabH/ucabH/ap/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxT:wsiWQtZ/K0tGOFWVRuLftCTfj
TLSH
T19D765B13F6E941E9E0AAE174DF359621AB327C594BF164DF328032D41E72AD07B38726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 7.0MB
SHA256 23cab9a8328d2f5e4a699183e5f0c96da602024c187fa2165005cfe162aaab1c
MD5 e0a43ae4ec5e4f20d77c3c66d655e393
SHA1 b214e6fe7c19141c14613b22a7f9690c48235f1b
SHA512 a2282aaab380f040b42aa7e93b5fc66d57548e3161c697a220e7bb54a59eab0c7c958a35b745e3fa2c9c6c01a2ffefbfef9f401f5d8e09fc1dd2116dde1456c0
SSDEEP 49152:wabH/icabH/ap/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxN:ksiWQtZ/K0tGOFWVRuLftCTVD
TLSH
T13F765B13F6E940E9E0AAE174DF359621AB327C594BF164DF328032D41E76AD07B38726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar~4.exe
Size 13.2MB
SHA256 f9c04304e7d6ad484a7902819692f5acdf4a850952ab33702408aa7f034b753b
MD5 6c0f12385052ba307b8f9e2926ad8084
SHA1 e0429a78f381c107478947c7e08fa3d7f45552d3
SHA512 f97a6cd0422b3b491c4259d02c17515532096f73a07a68c625584993d7aed8e956e63d2395940859fe869f09b34e153d32bf5f01a664d97c3af9c045937b0efe
SSDEEP 393216:x3RwlptVYmfr7yBG/4uOzH01/Nc1eJ/RXZMPDyi1:xGpttD7yBG/jx1/N/tZUDr
TLSH
T169D63332E158413BDBB704736998FA242E3CE12823148DBBE3D8ED5D2B7519227FB651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 6.9MB
SHA256 3c1c6e1b3b66fb41345c6b28008db7b916866fa18123b9dee147468334b38f4c
MD5 01d9891f52343df71c0e51cc5c0ed31b
SHA1 85fa949d1f7b270cb1d0cbe946d9c875a83f91e5
SHA512 b80f2da58a5c49957dceb6e0cb28f1a3399c35e3487c0c68dcb931ece18da3299b943ea7770f81e2108993182783993aa5b675a82899e7563b79fa58d67eda3b
SSDEEP 49152:wabH/TcabH/ap/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRx5:dsiWQtZ/K0tGOFWVRuLftCTB
TLSH
T19E765B13F6E940A9E0AAE174DF3597219B327C5A4BF164DF328032D41E76AD07B38726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{0EB39D9C-8389-4F02-94AF-F5116AE252BB}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{0EB39D9C-8389-4F02-94AF-F5116AE252BB}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar~4.exe

Path C:\Windows\Temp\{CB4AA75A-19A4-46AF-9152-D9BF593FF519}\.cr\2026-05-25_44c9d5784ad796d7a07892d50ea02972_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar~4.exe
Size 634KB
SHA256 81873c2f6c8bc4acaad66423a1b4d90e70214e59710ea7f11c8aeb069acd4cd0
MD5 337b547d2771fdad56de13ac94e6b528
SHA1 3aeecc5933e7d8977e7a3623e8e44d4c3d0b4286
SHA512 0d0102fafb7f471a6836708d81952f2c90c2b126ad1b575f2e2e996540c99f7275ebd1f570cafcc945d26700debb1e86b19b090ae5cdec2326dd0a6a918b7a36
SSDEEP 12288:GnMwHskY7gjcjhVIEhqgM7bWvcsi6aVQ/Iyc3L0JGvJtg2t/Jg8mq:QMysZgjS1hqgSC/iz4fc70JGvJtxhJf
TLSH
T1E4D49E3295604036E6F206B3B968E2347D7CD2282714C9AEE3D8ED1D7EA848177F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads