Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/05/2026, 10:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe
- Size 332KB
- Sample260525-mk8xtagy3w
- SHA256 2d71aff384606123c88b281c349ffcf7f83244f0dd38f00efa9099bcda4b26f3
- MD5 4a1920c7ffc2148ee2d2084187b0ffdd
- SHA1 f210b7f7948ff732bdf4dd31fe6be39b35d6b094
- SHA512 7b3dd2f71f08bd0346fe3527a3d8ef8601a9f42d63237afe18fe65d84005b8a247c4588cf08855426e038bc8b4c51c031ab8d70dd32008f23991b202f5facb0c
- SSDEEP 6144:mXqoE2W26XDpvPoYMT/DTqjgMSKfLJ7olgtlhns:1XDBAZzP/w24lhns
- TLSH T11A743929B79C7BF9DCE682788DAEF121ED317C200761DADB639446291E232C06E3D751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (255) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 3 IoCs
pid Process 3328 Logo1_.exe 3424 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 2212 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXB6AD.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File created C:\Program Files\7-Zip\Uninstall.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCXB462.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXAB3C.tmp Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCXB584.tmp Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXAAD9.tmp Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\RichDll.dll Logo1_.exe File created C:\Windows\uninstall\rundl132.exe 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Logo1_.exe 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe 3328 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 6116 wrote to memory of 4764 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 81 PID 4764 wrote to memory of 4736 4764 net.exe 83 PID 6116 wrote to memory of 3744 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 84 PID 6116 wrote to memory of 3328 6116 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 85 PID 3328 wrote to memory of 5800 3328 Logo1_.exe 87 PID 3744 wrote to memory of 3424 3744 cmd.exe 89 PID 5800 wrote to memory of 5620 5800 net.exe 90 PID 3328 wrote to memory of 3084 3328 Logo1_.exe 93 PID 3084 wrote to memory of 5660 3084 net.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:4736
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AC6.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe"3⤵
- Executes dropped EXE
PID:3424
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5620
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5660
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2212
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXB421.tmp
- Size 94KB
- SHA256 d8d93131073755f109a310d912b7cc1bf5987ba277d9906c58a6df1698059270
- MD5 b5ea458299f2908c03a9e9301eeb06ad
- SHA1 9b6a82115e9302fecf1444cb7abc9d0f4b6ba5e0
- SHA512 0494aee7cd955487c5e637f874a4feb839123e60c6a580eff43cad4864a595f16cbbb1fee2080aeda1e1199a0e48298b04c7a47832f6542a23a8e716bbed468d
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CND:gCSjGoLpWM6VsBEjx+ZdTp
- TLSH T150932A5AB18CB376D0E159BC8E0FF2E5BD297E200E1D589FB59A2F0DEE760C1590C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXB5C4.tmp
- Size 103KB
- SHA256 742b2019651362fe67da7a19288776610f4253de8760ea42bd14c35e66d63112
- MD5 824bcac149ab8169e282952735c8fbbd
- SHA1 c83e62d85c90474edb845f5cb7ddb87035ae91be
- SHA512 728af4660e195ac508828918ea3e4b2b8aaefacb74c856289d0572e731115c30bc54b92817a2ffd4ec663d951a729fb328b9928411b172ed59c557f4d6f5e38e
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHiENQ:gCSjGoLpWM6VsBEjx7ZdddtPlLqdu
- TLSH T132A37C59B28DB376D0E249BC8E0DF2E5BD387E300F1A185FB69E2F0D9A765C1190C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXB677.tmp
- Size 91KB
- SHA256 a567f4fffbd1b33867124e6531d2ee8b2982125a638c75da7b43e2e1c125a776
- MD5 77aa0e1977f476efc8737feb5addcf39
- SHA1 47efb029f65428bff0a5baa6711374424e6ab741
- SHA512 2d690182436ceb17be9ec6590d0dde7f11b9b9d3b68d43c5029d3c8b8b873565490baae3a5a6d930a5d4fd615fe5cdf11ae5e449375c8657ab5c1dc7f2e6e8dc
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6xNT:YCSjGoLpWM6VsBEjxZZdM5
- TLSH T12C935C6AB28DB376D0E299B88E0DF2E5BD397E300F19185FB59E2F0DDA761C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXB504.tmp
- Size 118KB
- SHA256 8dce519c0690c2fa257e999e00e35081798ddc0f5ee942851cc6e12ebaca008d
- MD5 d4917f64840ab1fd15b57517c950c81f
- SHA1 f13717c532d14a28eedc6674b376169b938737f6
- SHA512 96a28e2bd0980b198600aa7074aab85dbfe7afc6194edd0dcec525dc36a6cea8e190d59b692c71024657030d9a9364cb60f2ae0bd26c7ae878b751df36c0427c
- SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6x4GZjzQwK5WW7VCn6:JCSjGoLpWM6VsBEjxZZdQe5BV0yH
- TLSH T1B9C3AE6AB6CCB377C0E259B84E0DF2E57D697E300E19085FB59A2F0DCA7B5C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 92c94b8eb4eb4ab9e957f0a4bed1ce70c818cec070972424d583aecde80b7583
- MD5 d80fb11e0326c292968d686bc70b6feb
- SHA1 992c8e1d4414992b54154654832ba27ab860953d
- SHA512 0aaa960d1c448948a8ffcda0ca4b0b1d6d890762ffe3588a842c9a04a5cc9bed45f0399eb6d2e4922b71d8d55ce9e909a7ace5e3417bb6af1cd85a644606a012
- SSDEEP 6144:mXqoE2fXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ8F:CXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
- TLSH T1E1E4F716F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286876C6E676E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXA906.tmp
- Size 92KB
- SHA256 e96d91c42307a0306bcfc6492584e422806e1bc8e8c2f71686233cd08d6485b2
- MD5 db4f7a8956ddbbf01a12c4156e27d215
- SHA1 c7f4b1a41af9e29afa1ddc4a1987f5b1765fa4b6
- SHA512 899a12cb2cb2eb5cf1e90fafaafa15360af89b8c4809d3cc3b72e08f26c2861ae39f78e5e1a6eee728435f2f619b816728d22ea807e8bbb2a314a668b2e12137
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t6kNL:gCSjGoLpWM6VsBEjxeZdJx
- TLSH T1F6935C6AB29CB376D0E159B88E0DF2E5BD397E300E19185BB1AE3F1DDA771C1190C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\RCXAB1A.tmp
- Size 156KB
- SHA256 3bdd2ebe6b1ab9c29bd4233fcae02b53faa23b5c97d5389635a551f4038d2c76
- MD5 db7843f37efedef542cb6333b46dbf2d
- SHA1 875aa8a3fc4df243d823506623e136e5f0b53ca8
- SHA512 84d9786c26d6c6346eaf35b551a31559a3459150ede71fdb16b119ba8f47f95edca678209149d72b6f5dcbf73066234dadaa77cbb0b3f51933d497a8d873bdde
- SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6Pn2Nz:hCSjGoLpWM6VsBEjx5Zds2Z
- TLSH T101F3D576B25CB776E0E199B84E0DF1E1AC6D7E201E1BCC6A715A3F0DBB761C11A0818D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXAAE9.tmp
- Size 91KB
- SHA256 d1677aac5a3bcf5dc66bdc1983623a7fe2a3e3540aff76971a725fe0b65cf460
- MD5 15b1142a800ae40b6f1c2f6fd127c68a
- SHA1 cdfeb75d131ee34f1a2a01a1d7971b2a4815c480
- SHA512 f9f1355feb401cf3aaddcec2204a2645faa071bfe241c651f54f29e29e848cfff1b12287d8237cf976968653ffde01823c7423aab4ef35adc3f2a0d17c6a7fe1
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6/NL:YCSjGoLpWM6VsBEjxmZdmx
- TLSH T165935C59B29CB376D0E259B8CE0DF2E5BD297E700E1908AF75AE3F1DDA761C1190C281
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe.Exe
- Size 1.4MB
- SHA256 6e782b56b3a89fcd2b842061c4ed8362579096b309e7f290cf03f8aa4d839e5f
- MD5 a805b61944a7f4a3facb399d4edf33bb
- SHA1 3a02e86215170e2d281d7092282beb00ec8f7880
- SHA512 a50c446908d58f4ff58e79fcdbb9e46d0e5e7673e8c33af44a73958213cceed30b8923b4eaf73503993e7150971a175b56ffb6c360fedf1df89e1785b0722628
- SSDEEP 12288:qUbTyUjD5xN9euP+bnEPKSjlSoRUJDJ095+B7a2SooEP2WKtsm45c:7TTHhmbEPKSjIov0BW1oZP21tT45c
- TLSH T116655B01A79CFB32D8EA493078BCF7262F35BD916F51C6B7331AB25C4E71351996820A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXBB6B.tmp
- Size 92KB
- SHA256 37f384e354898f55e655ff5edaaec13a4fe6ed2b962e5962d68a9477d15e95aa
- MD5 89cf80f31cc081cfed9cc8f9142de5fa
- SHA1 c775d8f7028385418a5a2c7c7636dfc3948cdfaf
- SHA512 6cdbadbe00ceae25525d8ea9bc021550aad928ff2ac64f90de8ec79f8e4a82e37bd41a1c3e67adab2436ab6c1dd2ac2c8d1b344a4bea8c5638c60092221ff10f
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CUND:YCSjGoLpWM6VsBEjx+ZdDUp
- TLSH T18F936C6AF29CB376D0F299B88E0DF2E5BC297E304E19185B759E2F0DDA770C1590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a1AC6.bat
- Size 824B
- SHA256 6ef7b1aa827b35897b8261e8ad2ae6f5e043aa34b5fea3d13b00115e7408393c
- MD5 d944e07d690e4c89bf668f908c031ca1
- SHA1 14a289409370bc3b2862d71156922377ed5022bd
- SHA512 7041b898fbfffa360378628ad164e098096c1fd1972c91e46921cdeffdbd26df77b0f40ee57a7858d8bdb649a6c87582e213c8d8c50a38bb4dcb1b30a6621c42
- TLSH T13B019B16DAFFCA4F452630230FE75DDAC821268C6F1C33119B5EC66D21C284D7AE6716
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
- Size 239KB
- SHA256 fcd3a002ebe8f18615a8fd6bcf561b54276a9e8952a3cc683bbe95843fcc37e5
- MD5 8af4b7f9fcabf7fe2ba30bb74e825574
- SHA1 541c90a14a81121402aa6ad382185668a0bbecf2
- SHA512 7e6576de0712f9011e7cd150c8529a5fd9602373eba6a3b51f32f21a6c4a8a2983583da5d17b4429f258fb14f786d66fc3a4b9e7346906f7589d068a050bc729
- SSDEEP 6144:G26XDpvPoYMT/DTqjgMSKfLJ7olgtlhns:uXDBAZzP/w24lhns
- TLSH T1FE346C3AB79009F9EC67C27DC9F2C522E67278650360EADB039486651F237C46E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 2955441b19a9d66d6b2610227491546e32b02883f09dabc0cb6a657ac1494225
- MD5 3a2f6ed937eb8a3fc1edd9aba837cfaf
- SHA1 9227341b0bbec0d248e1574dbe75bfdd2efb5de8
- SHA512 df1a43b757e1f3cc85c532d4cc35a0275ef852225e77e7702e1b3245f576152a7acd50987f306da0b2a337f867f737332c3efb7c3f71d7d6fce9dbd9cce6f16a
- SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6aNd:QCSjGoLpWM6VsBEjxGZdrr
- TLSH T1EF935B6AB28DB376D0E249B88E0DF2E5BD797E300F19185FB59E2F0DDA761C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH