a046e63635e467a538473e839de2382356cad82bf754e06af02d2679e673b04b

Analysis

max time kernel
150s
max time network
139s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 1.8MB
Sample260608-weq99ady2p
SHA256 a046e63635e467a538473e839de2382356cad82bf754e06af02d2679e673b04b
MD5 e809b101dd9790adcef6cae915521273
SHA1 ce2c1632ccd99f70c0104fc25c7ef27f213f4943
SHA512 0d1e3ea4d61fa49a279eaf9ee1a3f1417d989485faed92a15243f510ceb5b819ffceb2b77990cdb05d8fadf49bee881998db39f88fb08317e7a7855982eb94b5
SSDEEP 24576:P4R5CIH/7te4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4cX:PabH/sabH/wtTToonbXaIHy5P
TLSH
T10E858D27B74440EDE026C5709E654236E9727CB20B60A9DF23C0B3592E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.xls	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
5012	UpdatAuto.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\dayget.dat	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1996	sc.exe
2436	sc.exe
3876	sc.exe
5164	sc.exe
2764	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5576	EXCEL.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1612	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5012	UpdatAuto.exe
5576	EXCEL.EXE
5576	EXCEL.EXE
5576	EXCEL.EXE
5576	EXCEL.EXE
5576	EXCEL.EXE
5576	EXCEL.EXE
5576	EXCEL.EXE
5576	EXCEL.EXE
5576	EXCEL.EXE
5576	EXCEL.EXE
5576	EXCEL.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 4996	1612	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	80
PID 1612 wrote to memory of 5012	1612	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	82
PID 5012 wrote to memory of 4828	5012	UpdatAuto.exe	83
PID 1612 wrote to memory of 5576	1612	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	85
PID 1612 wrote to memory of 5508	1612	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	86
PID 1612 wrote to memory of 5772	1612	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	87
PID 1612 wrote to memory of 5468	1612	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 1612 wrote to memory of 4376	1612	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	90
PID 1612 wrote to memory of 5160	1612	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	91
PID 1612 wrote to memory of 5264	1612	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	92
PID 1612 wrote to memory of 1856	1612	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	93
PID 1612 wrote to memory of 1996	1612	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 1612 wrote to memory of 2436	1612	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	95
PID 1612 wrote to memory of 3876	1612	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	96
PID 1612 wrote to memory of 5164	1612	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	97
PID 1612 wrote to memory of 2764	1612	2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	98
PID 5772 wrote to memory of 1032	5772	cmd.exe	110
PID 5508 wrote to memory of 1820	5508	cmd.exe	111
PID 1032 wrote to memory of 1476	1032	net.exe	112
PID 1820 wrote to memory of 2148	1820	net.exe	113
PID 5468 wrote to memory of 3144	5468	cmd.exe	114
PID 3144 wrote to memory of 4396	3144	net.exe	115
PID 5160 wrote to memory of 1068	5160	cmd.exe	117
PID 4376 wrote to memory of 4596	4376	cmd.exe	118
PID 1856 wrote to memory of 2984	1856	cmd.exe	119
PID 1068 wrote to memory of 964	1068	net.exe	120
PID 5264 wrote to memory of 5412	5264	cmd.exe	121
PID 2984 wrote to memory of 1784	2984	net.exe	122
PID 4596 wrote to memory of 4132	4596	net.exe	123
PID 5412 wrote to memory of 2544	5412	net.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4996
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4828
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Windows\system32\drivers\2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.xls"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5508
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:2148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1032
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:1476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5468
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3144
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:4132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5160
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5264
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5412
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:2544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:1784
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1996
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2436
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3876
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5164
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.3MB
SHA256 54e54531a40987000736909e5768d90c2f8aff12c489d0f5b22dcc3a0b3ac68f
MD5 ce3b5947f0abbdd347d9e3869bb28424
SHA1 9467d784d848d831ad638de88d20674d5fa71ba0
SHA512 3653c0154b663f58aedd05f3f2e7a5d92cd41342aa345582dafdd704ef71a896c04e865a5393b39d0ebd3a5433141dd15843c21030f4627430bbfa59b39e014e
SSDEEP 24576:P4R5CIH/7he4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4cN0Le5ji0hmxNrM:PabH/YabH/wtTToonbXaIHy5lPji0Aj
TLSH
T1B3B57E16F66442B9D037C075C9A59266F9723C620B3099CF13C1F76C2E37AE6AB35326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.7MB
SHA256 a9ebb49cf8ddc9800709596077b21c9a0a87012eb13d7c091ab465ac89da3010
MD5 e517254a0ab4d32f7bf9d18530809d5b
SHA1 bbc4c85eb7d77a6763caa288a15f83e3f6aa3de6
SHA512 62dc0dca009f2473b7836edd7b1349a9b410e05ac8574aa673635252b07090786c6bb6b139b3eff7fbbfe511fd9453ec0adf3a6592a717187d7e1e7d1756b034
SSDEEP 49152:PabH/YabH/wtTToonbXaIHy5C/ezSC6vUzPvMHjy:3/nbXaPmezSC6v2XMH
TLSH
T112D55C26F6788366D076C0B5C9D6966AFD323C520B3089DB0385B32C3E377E5963572A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.4MB
SHA256 fff54294aa81dca9ee78330cde45c0d1a068d8494f4d32a349ddbd19ea28eba6
MD5 f4b4100b148a9ef5b16c22bc104063f0
SHA1 9302356921cf0e66b4403885361016a08d196391
SHA512 c206b1cdd0783216319e452ef80b635ac2a019fbb4b88213ccb3139dd7112ed371ea2ca21d7ffa99532df4100c2df6acaa0ff51afddaa1e80d186fd14514830b
SSDEEP 49152:PabH/1abH/wtTToonbXaIHy5RVO88hXl+:O/nbXaPK/h1+
TLSH
T1D9C57E26F66482B5D077C075C9A2966AED323C520B3099CF1381F72C2E777E5AB35326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.8MB
SHA256 e4ac64923d3d4528e734c8d23f4c71f5658c7b7379509d611304960517b8abf9
MD5 f3f932cff46fb1c7b8be3f7b381aa735
SHA1 e1cd3e44de23edda7baa0220c13b28cc2c6ea686
SHA512 c503e8bf689e258e3100f459af7abadc885f3dec1d678002119a98000f32f397af5ba7c7fa08ff04c3e3f4ac242731d6c1f6b83e4e27824918fd5618b0f64075
SSDEEP 24576:P4R5CIH/7Ae4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4c3a:PabH/TabH/wtTToonbXaIHy5
TLSH
T10C858D27B78440E9E426C4709E658136F9727CB20B60A9DF13C0B3592E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 7.8MB
SHA256 da65cfb0ab9253b8c1bed12ace38df001e521c8ed0646ada5d609ed64243b54b
MD5 88c6b56bb9713edbb1c4286eea9d6186
SHA1 9736e01553d972041384fd6631af4c9f81339ddb
SHA512 00f2150705dafa3478a4db4cc831981617e3904f58bf6d054a0b1cfd8e35aeb553e781b26f54c9de9f342fec93946eea61ab21175ae00568299c10a8643adecc
SSDEEP 49152:PabH/QabH/wtTToonbXaIHy5Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaH:P/nbXaPLQRQyi36YOcP+Lvw2gAf+PN34
TLSH
T139867C13F3A501E8E05ED974CF3952329A357C5A4BB092EF26D436E51E72AD07B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 7.8MB
SHA256 a8afdb5d2027d2f804b69763745b281ce2f04ef2d18af5587e575c08fdda58ca
MD5 5c8cd3d152e17cd5d2170919bcb076b1
SHA1 a267a183b42989b28525853e267ecdb8cf1bcb2b
SHA512 fb97cb635b8e31aaa413f0624178613b51dfd6c898e833393ea000c69a3b0015f494c16c11230fa8bc62e222449ccd529c46b3356a8092828a0eff8f404c4ccb
SSDEEP 49152:PabH/QabH/wtTToonbXaIHy5Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaH:P/nbXaPLQRQyi36YOcP+Lvw2gAf+PN34
TLSH
T195867C13F3A501E8E05ED974CF3952329A357C5A4BB092EF26D436E51E72AD07B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.5MB
SHA256 f6df55c6331c47514a2e65a195866cbbeb88fcca8cc262bf2c3cef23fa906481
MD5 44251925045bb612553bbf4190208238
SHA1 f352b27c8fb092a43f2f9043821fe2a626bfcb92
SHA512 bb4f77e5916dc6619e9f3b798f3e06ba8395ee89e7465f40b13d6f9d6cb22b20656b5ee143ffaf6cd7fc33979de16526fa3fa589f7436f5e7f985efd6e02a2db
SSDEEP 49152:PabH/QabH/wtTToonbXaIHy5A68Qg55nhoeWu7PNU3/Q:P/nbXaP6thHRc/Q
TLSH
T1A2F53A23B2E200A9D05DD1759F568632E6E27C718FA0E7DB824173191F72AE07B3971B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 5.2MB
SHA256 590ad207fe7f433bc5e08d05ad18335e4b589103c23786427f5d2a8c9b6871f4
MD5 cdd5404e7e7fec003f464c42bdd1987d
SHA1 91c6b4b829fd92d36982a7c23f8e7046cb47dc0c
SHA512 61c70feac779f07c0f928f0cf3951c911e6994a178ab0aec59bab472a8b01bea847a6a28487a93dae3a6797d454f37467cc2e219c83b0bddeb9a862f4bc740c2
SSDEEP 49152:PabH/QabH/wtTToonbXaIHy543aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbc:P/nbXaP1y5112gYy5azzVvf69nLKnhZO
TLSH
T104467B13F69900E8D019D1788B5A8232EA72BC570B31B6DF0A90B7552F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 4.0MB
SHA256 9aa2637dca4dfd4ea1e33f4a2bc7a49d4bc90125e74f2e04bc0ae31bc7ed4104
MD5 098f0666290ba70bd890db4181afd049
SHA1 4d6720ccd3ecd8aa6672d9ba429f6fe54ea58668
SHA512 82b9a4e5b1fae50c7a18ce1a46edf4e6caba479226caeefda11079d3db24b89b737070bb5aa79c67b3a80bfb44d61219c82a10c13cbfcc0969577e0eda2799ff
SSDEEP 49152:PabH/rabH/wtTToonbXaIHy5FB+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:k/nbXaPru6Jm0xd2d3
TLSH
T127168D13F69501E8D06AC0749B5A9232F972BC660B30BADF0790B3592E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 3.4MB
SHA256 f378849fce6d8c5e484a3fe857bf278a2384c6209c7ac759553e7adf89e6fea5
MD5 f722d76baabef6cfad9acb97fc262d22
SHA1 d9f196ec4ee0160c74536078e7ac91c13fe7e814
SHA512 a06acacc35c20bc04f7777b6a2bd61108e7252e75239847836b26441cd68208361a45065024362fb9ef5ae70a3ee1853a6902c1477b4980a215729a242e25d0b
SSDEEP 49152:PabH/QabH/wtTToonbXaIHy5d1hpsNoJpF1A6GU44CwH7R4xu:P/nbXaPdmifP5R7
TLSH
T189F58D13F69440E8D06AC1749B558232EA72BC660B30BADF0780B7592F77AE46F3D716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 3.6MB
SHA256 75bcfdb0047ffc02f04d519a15056a7ab2f161040c91bfde14a1289ad1e8dca7
MD5 4fecd3863503896f4150eccd38fefdc7
SHA1 7b2fdbdafe219f9709ff243ed42b06ff849b567b
SHA512 6ffb2834cbbde87ad078ce2fafb7887adab26ba8dde16e4dbd5c3d8ea9fa828dd780344fee1ad70609f20acc1bd31a59ec78ff61729ed3ad127c429cbfe8d543
SSDEEP 49152:PabH/QabH/wtTToonbXaIHy50SuZQIY0Be2K8RVtOnks6NMHq6:P/nbXaPm5dKCi616
TLSH
T125068E13F2D940E8E0BAD5749B658236E972BC660B30A6DF078073591E77BE06B3D316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 4.8MB
SHA256 270604d66520777fb5acd27073ec550c83fd663dffc4aace6da2f92a5dfb6577
MD5 1772d72decc276a71be358f037e1bd68
SHA1 c19ad3dc1c4709aacb34912cc40d72f1e5a48f91
SHA512 209b6c4fd17dc220f7dcd498f85c2ad13bab3c87f994af4dca351891fb1e1ae6109e24c6468b8aaf21e5d40a2eb697c1067f7a9880f7f243bd5ad4f204d7c284
SSDEEP 49152:PabH/QabH/wtTToonbXaIHy5VyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNo:P/nbXaPUm7vj1BDlZG
TLSH
T1AE369D13F29940E9D05AC0749B5A8232EA72BC550B30AADF07D0BB562F77BE06B3D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 3.2MB
SHA256 3ef2e6c19a9bb15bd2378be36d9898c72cc24c389f4493473b0305cd23cd1282
MD5 527f80816559cd4ecf98a87814e00c38
SHA1 183827a44e06f23983ee5f1a00404bcbe6156e6d
SHA512 ddbefebd512c1ad156a27f7482e62e990c02d99f4c96734d1d0b80daa210508f54fe26fd620c12e04930fdb4122d4bfa63264e7933f2b1953dd871bcc482c4a1
SSDEEP 49152:PabH/rabH/wtTToonbXaIHy5WhtSn8EApI0fig1giDn0AP5w2:k/nbXaP3X2iwphX
TLSH
T12FF59D13F69440E8D06AC174CB568632E972BC620B34BADF0790B7592F77BE46B39316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.8MB
SHA256 92c8a1f9078862c0029c2a3a8a2d370563f43614598624582fc65592c931117b
MD5 39f93198698a860463ec11c413407fa0
SHA1 901c2e88dd8311e7793ee2f3eed25bdad47e1ce2
SHA512 44f7b78b8a5d42b93e30911e8ace083b451fa8589d21e4f5ff65ac9aff3d89e301e664890be3186e52472cce94c3975a93285dc51a8b27960efa2c92397ec9e3
SSDEEP 24576:P4R5CIH/7Ve4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4cE7:PabH/kabH/wtTToonbXaIHy5K
TLSH
T1BC858D27B78440E9E426C5709E654136F9727CB20B60A9DF23C0B3192E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.8MB
SHA256 a8b10224f1424d6fd25c4d99c8b005b813eaca8327b60fca3febadd2ddf6f79c
MD5 debeb1242bfe489cead6ae201222d04e
SHA1 049943e9944f3d0bcc8b359822bb65b17ca36c27
SHA512 7fe5cc762755e169316f24b245e76a248fb6e2a5e8852c677374381c2fcc36f06049af688ff88242325304017fe4cf6109b12ae89c3543d0fe36d5f5c6599579
SSDEEP 24576:P4R5CIH/7Ve4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4c6x:PabH/kabH/wtTToonbXaIHy5G
TLSH
T14F858D27B78440E9E426C5709E654136F9727CB20B60A9DF23C0B3192E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.8MB
SHA256 f387a2b829b33b394557cc814df22505e4aee2e09c9887e2b9359fa550fb634f
MD5 b6b1e11a9e4e12fa9e23d4ab24450d63
SHA1 b70423ce9e4681d2b606ab083ff7566c2c49346f
SHA512 be68230ac4e02d30fd9f1dad3e0571f5765ab8dc3271b0c3bc03244fa355911934db395235e7482d94d162a7193e5b553c4ea0e5f78900d35b13c7f262efe6e8
SSDEEP 24576:P4R5CIH/7Ve4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4cgs:PabH/kabH/wtTToonbXaIHy5R
TLSH
T193858D27B78440E9E426C5709E654136F9727CB20B60A9DF23C0B3192E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.8MB
SHA256 aef86b863e8fd5ccf8714ef702004b312ed210e6d3c01a7ef46f0559dc997cbf
MD5 db760499b90b42fa4afe2e3f6599f076
SHA1 6f4867a069f5311bd68822ae3d050215a2611ea5
SHA512 c8b175128fb1714824a3c39ca2876e266d9dbcdc272b7e5d598da0a13c8733b606ae26aead3b55841d2a550f0076f67c5a9d64d9a1474638a8af2455e992a342
SSDEEP 24576:P4R5CIH/7Fe4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4c8:PabH/0abH/wtTToonbXaIHy5E
TLSH
T12D958E27B78440E9E426C5709E654136F9727CB20B60A9DF23C0B3192E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.8MB
SHA256 a0d53662ea1f78b57e413e7a28e84ee4e2973d50752b49d26697d331cc3058f5
MD5 1845269aa5cf60e979d115f8565aa0a8
SHA1 4c4e91de0b289afcb4cbac599be660a7d49e3d92
SHA512 f91cc1edaad8c66c8206a04208b2b21f62ac875b1ba4befbadfac29c4a97e423420523aea7d45042c3608ed5f400d499583b29b303773f5e0cd197180dfdea1d
SSDEEP 24576:P4R5CIH/7Ve4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4cXZ:PabH/kabH/wtTToonbXaIHy5x
TLSH
T13D858D27B78440E9E426C5709E654136F9727CB20B60A9DF23C0B3192E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.9MB
SHA256 ed0a20366560786fddd6ecec5a4b75ade72d958164a8969c0c6dc5165fe220fa
MD5 8bfbfbc066ef9a33f686f047d9ccfbb0
SHA1 318ef9ed30a319117a49005677e293c7f9e3b1fa
SHA512 1266abf48e670d3bdba14f641acf5d981fd2dcc954613990a72a319f652bc772ed829391f6d37ea00d566d97b4a636b4104733db6ed0c9f9d6b2038acbcc9014
SSDEEP 24576:P4R5CIH/7he4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4cuD:PabH/YabH/wtTToonbXaIHy5u
TLSH
T1C3954A16E65440A9D02EC570DB654126F9637C620BE0AADB13C0F23D2F77AE16BF931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 1.8MB
SHA256 2df4c5fb75dd170bc95948357916847d492c2e16d680d4b320c9f096ad3da59e
MD5 dbd9983611b41ee8120ac60258bcccc5
SHA1 f19dee2e7315d92ecb5b7816bb2c1aa8c8f2cf88
SHA512 d472b48f5e83ce33fade5fc7db704597179e45cf0fb8a881b6ef7c615906023212eed83c8a243dd3cfbd6b77cc4031285c4638937b4318efdbb83fd28a5a37c9
SSDEEP 24576:P4R5CIH/7Ve4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4cm:PabH/kabH/wtTToonbXaIHy5e
TLSH
T1B6958D27B79440E9E426C5709E654236F9727CB20B60A9DF13C0B3192E37AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 1.8MB
SHA256 e5923a0eb38ec589b4fd9bfdefafd8d47b5be49879ad505c0e8688fb649674ed
MD5 688ae6d11b27bdeae8812ac7cca1df17
SHA1 33e2b1d6599b98f72deab714684bc57a5640c7d2
SHA512 567ec53f77078d07f6121be2b243ece1f1bae77bf9dd81d21e1cbe12affc18a82a476f3da29fac63331d61ce6d7e55288d8b8eee8eccbba472a0374a91c563d1
SSDEEP 24576:P4R5CIH/7oe4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4c+j:PabH/rabH/wtTToonbXaIHy5Wj
TLSH
T1AC958D27B78440E9E42AC5709E658136F9727C720B60A9DF13C0B3192E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 1.8MB
SHA256 e3e29b1b7d57b4f3b153f47d24c70d790e814094fc760f864154bd2f6acb37f8
MD5 bcd270fb77cbdb5e85c9c73db8ac4612
SHA1 a897950b6fab94a7507b1ea445410a8bcfb2f5a4
SHA512 dcb5d77dfb4bc7852c3e193783be22b157d3c5bf57f95959535bd551e929bd4092a5a7d8f10033396a4da0bac7876bca158f955ba6e76ea3486d25480d49832c
SSDEEP 24576:P4R5CIH/7pe4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4csjv:PabH/QabH/wtTToonbXaIHy5UD
TLSH
T108958D27B79440E9E426C4709E654236F9727CB20B60A9DF13C0B3192E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 1.8MB
SHA256 25dd4e4e5e5ea367e8891963fa863465fb5d1a9b0673e0adea60414a98df9967
MD5 67dca2396112af5d6707f42ed090e5d1
SHA1 87bfa0cc22587fb959a2b9c6094a3e74d3222c7c
SHA512 f623665c6a72c3415b4cb16a2bc0cee7a48585e747c1534e837455a6c4a446f5a209a9ca21f186f31376eba055b5d69b974d929d265bf6afdbd46368db7e2231
SSDEEP 24576:P4R5CIH/7te4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4cs:PabH/sabH/wtTToonbXaIHy5E
TLSH
T12E858D27B74440EDE426C5709E658136E9727CB20B60A9DF23C0B3192E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.xls

Path C:\Windows\SysWOW64\drivers\2026-06-08_e809b101dd9790adcef6cae915521273_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.xls
Size 5KB
SHA256 b25eaf78487e765fdfb08b305c2c2845ed5122bbc64e41a73d97c89e4757a1e1
MD5 d776ec8da46086dce5fd0b16fac80740
SHA1 f93337a07116e324efae79da53e4caa67908ea3a
SHA512 993a923ea715e2e3835e6de706dc8116651790130b1b68fc35a60a832b9240f7eb3fd3244e9ef1b7abe48517e566d5df19ec88701e73870a1f160f65742b481a
SSDEEP 96:n3333333333333333333333333333333333333331:l
TLSH
T1BCB12B34084F14FDC1DC8FC8142706211638104D83CCFCA17D0115CA88F2B3C31248EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 f55c4f0bef664ef37c23e65d6245c8421b4cd4f366d7c469d9ef83dd7c209437
MD5 149bb1fad2f486826a78425308b8f9e9
SHA1 ad92f38ec70f4b038f5ecade96a6ea76f1e42fdc
SHA512 7c15be976dc20a11ea40c6f64e1bd93e037cefbbd38b37f549d000de7ebf67b4c16b72f2ef37268cf86871c5c881d8322eaafc894b8e8183bb2f2a161401d7d7
SSDEEP 24576:P4R5CIH/7pe4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4cs:PabH/QabH/wtTToonbXaIHy5E
TLSH
T183858D27B74440EDE426C5709E658136E9727CB20B60A9DF23C0B3192E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 f445967711e8d142e34fc73a53e18f3bf38984819b5e49e94757fb1d3e277ce2
MD5 74f986f3ca49a61df1bb43fbcdb4a1dd
SHA1 91a99565aaba72b0acfbbb96ebd9ada087aa8eda
SHA512 5365cce158a7d23dc1cf5850419ac824bae9b828a7b4ef87f58be2e247beac042c6fea316d67761e9b5b1e7a4f848146d8453482e633a800cb0531ef01582763
SSDEEP 24576:P4R5CIH/7oe4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4cs:PabH/rabH/wtTToonbXaIHy5E
TLSH
T166858D27B78440EDE426C5709E654136E9727CB20B60A9DF23C0B3192E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 940ec22a396854d17634c1ca8307dc310ec764a224cbc673fbe043699a968f63
MD5 f57e14f34783e4c866c2f6031ad6ce14
SHA1 ae9fde38afe12247bd5adb5e8d9b0cf23b46567a
SHA512 b91d8a84a5173efd05290debb3c5082b8ed800a96c72c7a54fe3aa603c9226d3623e573a0cad302dcf155c1896c642c489bb3be8e0045b8866dea7601e06e211
SSDEEP 24576:P4R5CIH/7pe4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4cs:PabH/QabH/wtTToonbXaIHy5E
TLSH
T1B2858D27B74440EDE426C5709E658136E9727CB20B60A9DF23C0B3192E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 6477d17c6fe07e346270e301392d24e62f2066fff922e7b0857ed28ab65e3786
MD5 c39d2d0c9fc58b6c57751c560ae30710
SHA1 369a13af948cf87019558948ff046d3f6b1f9664
SHA512 e02695ed98d945e915737b6c348fcb717cabfd3b9da8b52116979bdbe6adb2e4461aec4c4343bdae96cdae252bec9872d55a17f5d8d00b027504881229ae4f86
SSDEEP 24576:P4R5CIH/7Fe4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4cs:PabH/0abH/wtTToonbXaIHy5E
TLSH
T15E858D27B74440EDE426C5709E658136E9727CB20B60A9DF23C0B3192E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 b785ba619f2f192da81926cebf154cbd7479e27d91e82dbaf3ac170d9ad061e7
MD5 bc08ca5b9e60be3e26a9b9b76b171962
SHA1 656e21b2a62c689a2a59c715ddb8e1c82a457499
SHA512 cbcfb1b5bb22c94f3eaae69c1089e9f9b47779dc5bcf178c66f89c01560d0dcc11822a858face15abbcc15ec30592108044d5a129ff737411b72f0c198d88d23
SSDEEP 24576:P4R5CIH/7he4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4cs:PabH/YabH/wtTToonbXaIHy5E
TLSH
T141858D27B74440EDE426C5709E658136E9727CB20B60A9DF23C0B3192E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 544452ac5c5842eafcddf3ce077900b7f37df9cc0b557af1ce35796c6d608d1e
MD5 1f4288e32ad7f92d5594777fc2b03082
SHA1 81d7a11f2d828e979d2919e7690aace66a244c09
SHA512 3493eeceb83982e4b8a0b52b89f0b680e52b50977b5f8620258daac7ec5f93e9f32114f444a6873cfac1105bad8abefedac81260338e8da61c8e37f0ef6acf31
SSDEEP 24576:P4R5CIH/7Ae4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4cs:PabH/TabH/wtTToonbXaIHy5E
TLSH
T137858D27B78440EDE426C5709E654136E9727CB20B60A9DF23C0B3192E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 6d17918c37a7b66f60d9cf562704db228b2bf2ca7d974ee596a53685b9b161c1
MD5 37a535b9aa706ced421a6d6c296b3908
SHA1 12fe387e63a5afb6dda8e2667f11f244f1c002da
SHA512 50f54663be1bd51a60a63892719776ce00fc8abd4336d619925f11f6e20878f54c5861acd6f2f5e10630799e3ad7d3b9b4dc33b8980d115d8942f9b77b846e80
SSDEEP 24576:P4R5CIH/7ue4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4cs:PabH/1abH/wtTToonbXaIHy5E
TLSH
T132858D27B74440EDE426C5709E658136E9727CB20B60A9DF23C0B3192E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 78858d9ef78406a0d5c5646b9a2ead3c4f8fd8a4513dacbeab0dc23bb170ff59
MD5 b486726acbd679fbd9d8260ba0314766
SHA1 f9b027572a2a5a913452226c4096633a1ac13a13
SHA512 1a60ce4bfcd6bf7ece0be8cdf111305b1f8ea1d7e0cdfc8c75ced56988b7aa8d620e3a395087778f192c301783ea49cc27b9c894a0e3ae28337e1703352f8013
SSDEEP 24576:P4R5CIH/7he4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4cs:PabH/YabH/wtTToonbXaIHy5E
TLSH
T14A858D27B74440EDE426C5709E658136E9727CB20B60A9DF23C0B3192E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 d18b85a150c935a71cc24d76c0bc0f381a8c41943e34636e51dde67b94e197dd
MD5 c581ac09f57910f83299adddb22e35b6
SHA1 8bfb11f66ae42c3f066434807314bf842820caea
SHA512 1eff034fbbaf4c959ec8ede971e4f2de5644e982fc3e49bd49f0369ada19a84720e6875666e9872a159a3e2dd5072748c6c1e78d95906ec4d80d9e4695090e60
SSDEEP 24576:P4R5CIH/7Ve4R5CIH/7WDtTuRWFsronbEqa6+GG8yKrO4cs:PabH/kabH/wtTToonbXaIHy5E
TLSH
T1B1858D27B74440EDE426C5709E658136E9727CB20B60A9DF23C0B3192E77AE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5576-37-0x00007FFD27450000-0x00007FFD27460000-memory.dmp

Download

memory/5576-36-0x00007FFD27450000-0x00007FFD27460000-memory.dmp

Download

memory/5576-38-0x00007FFD27450000-0x00007FFD27460000-memory.dmp

Download

memory/5576-35-0x00007FFD27450000-0x00007FFD27460000-memory.dmp

Download

memory/5576-45-0x00007FFD248B0000-0x00007FFD248C0000-memory.dmp

Download

memory/5576-34-0x00007FFD27450000-0x00007FFD27460000-memory.dmp

Download

memory/5576-44-0x00007FFD248B0000-0x00007FFD248C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads