b0199746c569ab067fd72dd10b4ee1daec9f8bcea325999848b6428f5357b0ac

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 03:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 736KB
Sample260701-dybd2adv8l
SHA256 b0199746c569ab067fd72dd10b4ee1daec9f8bcea325999848b6428f5357b0ac
MD5 aa72c02d629d64d4347c0dfbb324908e
SHA1 d0fab657312942905d8cee23b85bc718d70b3764
SHA512 8292d2d8dda279c2927fb6fdd211e1961475565c53bdd70a5a564a424fba38061d93e69845a12481b4b237ab217d998a5daa55ff551509495078c9ea8e342ee8
SSDEEP 6144:mXq1gZi3gQyk1xZBq65kzLy9tEoEtKE0rcarn+BhK629PRIYp:+CgQy2Zo65kzLy92oIt0xr8IUm
TLSH
T1E4F4A712306EB75FE5E36CFA0A8EB0309DF43DED15D5D20E6281B71A0AF6324155E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
2144	Logo1_.exe
5976	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\RCXE72D.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	Logo1_.exe
File created	C:\Program Files\7-Zip\7zG.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe.Exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCXE64A.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXDCF4.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\RCXE7E7.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXDB42.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe.Exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Logo1_.exe	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe
2144	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 5968	5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 5968 wrote to memory of 4076	5968	net.exe	91
PID 5072 wrote to memory of 2724	5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	92
PID 5072 wrote to memory of 2144	5072	2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 2144 wrote to memory of 4712	2144	Logo1_.exe	95
PID 4712 wrote to memory of 2656	4712	net.exe	97
PID 2144 wrote to memory of 1252	2144	Logo1_.exe	100
PID 1252 wrote to memory of 5232	1252	net.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5968
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C56.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2724
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2656
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5232

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdobeARM.exe.Exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe
Size 1.2MB
SHA256 ede37e3da675fb1bab6d3ab497460ae8f6e731ac62477967fa59654e15c5e772
MD5 5fed46d78ae3cb82ffa4571028293513
SHA1 501ce000f9cfc3a602cfa4eb2e0ab31760d1230b
SHA512 adb74a4c38ddae90bc8e545619acc7b9f9a2bcabf26fd7d7e5e27c69974094bfd43bb1d254e3d960de28d689f712ed80f662861aa3821748c096f5e13b85a754
SSDEEP 24576:LYSgouvz0ZRHkFfenxyQZXS7gZnQh2NIq:LYSgouvAeFfenxyQZXS7uQ0NIq
TLSH
T16E55C40267FD7329F1F37B71EABDB2645E767C61AE39C50E5284025E09B0A909A31733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE64A.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCXE64A.tmp
Size 104KB
SHA256 0d4c2a50bf116712e79a3c26e5ea7506b1d005d4e50b2822aa11bd6d7f79dd8b
MD5 3e20e18da499c495d4a9f2de15a54855
SHA1 304fb41687e4f0fe12a6a37cb728ec18e2919913
SHA512 e2db1e2ffe9e4c79f613d77aee2620fb475d2e3e4becd5b5589f4f2d8ac8d5038ff61dd747d6671c8925d7c461b718d4d1793dc76fade4822ba15ca27dc90a5a
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxA8m3G5QGPMLM1XkSPsULMHilNR:oCSjGoLpWM6VbBgjxAxi3MAdtPlLqM/
TLSH
T17AA37C2AB28DB376C0F199BC8E0DF2E4BD397D201F19186BB19D1F0D9A775C2590C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE71C.tmp

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXE71C.tmp
Size 293KB
SHA256 3162ad870726ab0888021c3b3c75db2e358d4809b57d5fe173674479b95a96bc
MD5 b904d2ee5d293a9eaf2a1fc95f97c5a7
SHA1 6d60ade45168e37e45d80357edf066a61dbff53c
SHA512 c16ecd4a73c761d06b2e9cee11b6e1d9af4e2ee9c4c88524039e73663c1573afa79ac5b9b648a40b05929db5591dc8186bc026b3e22651eb57ce293e6139edae
SSDEEP 3072:oCSjGoLpWM6VbBgjxmxi3M0V/rfzYT6X/D/24l/DFeodwgjf+FvC6C36lnWesuou:eXq1gOi3DrZl/DFf3WC3as7B+WCR
TLSH
T1CB547F1233FC7B39F4F39A305D3DBA66AD3ABC309E24E66E2644125D1D36A419D20763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE5AB.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXE5AB.tmp
Size 1.9MB
SHA256 c05273aa96a7b4f80c22cea056a73818e19f2e635a86aac1db7034550e98a748
MD5 9579cacd7f3b907236cc29618d3ba118
SHA1 0f7693ec6c7b175500e873598a1dc86750febd36
SHA512 c4a8afa3c2ae1f7d8bf4ae3806f694598f9d59a7871c8e1a4965442f5f9004082e2ccb93392bea156d8f7be73c536d53d25b1d61f896cb94f43343d33cd5da40
SSDEEP 24576:lY35kAGu6McqpA7D9ruO3O7Q7OBLLMdus7CtW7KSdHBxmRkkkkkkklQXBysWAb:l0ZGu6qG13O7Q7gLYduZrSdHBAVfb
TLSH
T16E956B03F69DA3A5D0D9C2B8CB2EB725DE617C554F20A6DF02807A652E77AD04B3D390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE807.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXE807.tmp
Size 100KB
SHA256 97ae92e5f08ac4aa0856ec7b124c5c65fa2d573e166f0892bdf30b704f0067f5
MD5 1600692bee9231f2886671fb06c9ba22
SHA1 d1b3807c86cefd9fcad9cbaedf0a18758f80dd08
SHA512 b2a32c4a5dee32e3a873d755a7beb7c1681f46a5d7cc927172a149ff3c5ba925c578fa4db3b6e5b70dc603c3ca18fa737e9b80bc2d6bd46de7962476e76047dd
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxL8m3G5QGPMLeqkSZZZ3wNU:oCSjGoLpWM6VbBgjxLxi3M0UwS
TLSH
T1F8A36B1AB68CB3B6D0F189B89D0DF3E5BD357D300F59186BB2AD3B0D9A77182190C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD9D3.tmp

Path C:\Program Files\7-Zip\RCXD9D3.tmp
Size 92KB
SHA256 13eaf461fe8aab179fbe3d8da32fa37a00d7afeba2304703ff7bcb8b2a7e260c
MD5 249307783053db25692f182bb7dcb089
SHA1 d693ea8cdc5ca429fb70fb30be89e7571a495ee7
SHA512 d053f06c974197dc6f8665a352cbabba8064fa76c14852bc9d2ff2855fe981ae1bf8e9a755eef0005934c37e36320d689256f369f363ffec382b406b2091b8f0
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxT8m3G5QGPML0NM:oCSjGoLpWM6VbBgjxTxi3MgK
TLSH
T19B935B5AB28CB376D0E199B88E0DF2E5BD797E301F19086FB1AD2F0D9A771C1590C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXDAE3.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCXDAE3.tmp
Size 92KB
SHA256 1ef0f5f8ade3fba5e40c21d51021e58c63ec0ffcd2e9d78c1d0ebc5a9b358952
MD5 2a982ef970fdebd81df5060f8fab8ba7
SHA1 dbd9a668b03dd79c2fb40ef7e2c37f91277c8a5a
SHA512 c4d445b0281fe407a81db665ee200c4420151e4c4eeee121be1b2f116c098b2bd687e04dc2bb854b0d2a10091fae39bf4df6dcf8f7e8ab37e6ea07c32d68cfbd
SSDEEP 1536:h7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjx58m3G5QGPMLFNc:ICSjGoLpWM6VbBgjx5xi3M5a
TLSH
T1A4934C56B29CB376C0E199B88E0DF2E5BD257E301E19086BB1AE3F1D9A7B1C1590C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe.Exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe
Size 4.3MB
SHA256 39e0d68d4fa275ee0a3681d55a90f85fea54c4a3bbebaafe3f23afd0a94e42d2
MD5 bba13cd0db8a16bc4d212a627d0c1f81
SHA1 a6ea8d10f44cf1540ecad907b0c186850bf0333a
SHA512 80feec8647618f0276c685ca3bb8e5d0aa7ee425b3b09c99f21fd1d7a62b0f3a17107add6687eaa9a656ac08b6e2ca86ba0f4853709d0ae2ac37f3826fe703ba
SSDEEP 49152:ZTQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3Tf:BQvGAdlCEL8c/bRNw5CO
TLSH
T1D2263A656BEC91F5E0E7D134897A95B2FB7A7C020D32EB4B0151CA2F2F336904D29729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXECCC.tmp

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXECCC.tmp
Size 538KB
SHA256 4e5ff3cd20055a383ad8ae771b021501f1aeec4ed5fb603ec5670c832e0c3528
MD5 deeff163c88f0981c2a9e0bc9e70698d
SHA1 ce5afeedeb29055cd4559675ff580fed5440ee13
SHA512 114ec062f7a00a801d75ebd9af8b99d867c6430fb9aff604b5f31838eaac7346c03f2a36cb307acb3a671da39f07521041711a4048c366b42c9e222f8585689b
SSDEEP 12288:+Cd+Zc0IursYCYQeSnyZJiqlEbXSb9NtoqOFBqkYHp:7MMYenGJiKEbXWtpOLl8
TLSH
T188C47D32A69CB332D1F10473E91DF1707E3DBD185F2444AB97949B1E2A68482ABF7247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a4C56.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4C56.bat
Size 902B
SHA256 d1a080178d96170160cd05a40cf303b03dcc5d527ed768c7afe8d65587008bdc
MD5 775db894c4782de77361abe04f0b096b
SHA1 c1a3f74aca3783d076b79a1638b38ada144e3dff
SHA512 c65cd4f79c773ad8234bd725d200aa6adc6ae235416dc46aa52d400d244dae2997750b6b4a03c941e0bea994bae57ee310c7bfcfeb3869601f24c9c3b44d21b0
TLSH
T1D8117302D6E6F6F90438B0934A176DDED093350E3F5A3722AB9CCA0E11D294CFA96356
MD5 SHA1 SHA512 TLSH

Submit Download

2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-30_aa72c02d629d64d4347c0dfbb324908e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 643KB
SHA256 d03580d8f776dd443943ad47bdd39190176fbcaf51c996c136aac4eaf3f1f60d
MD5 2d392ddb7097aa2fb51bf858553823c0
SHA1 c0b04bd92ab319b08966b53be6f2096557ae910f
SHA512 778533cf598f2cf96e88da24a3d25c8f084eb0e8ab28e3210de2249649302600ad32c2a93a9ae62d3d87b6993d064939f07596cf6026ff597702844e3da76638
SSDEEP 6144:9Qyk1xZBq65kzLy9tEoEtKE0rcarn+BhK629PRIYp:9Qy2Zo65kzLy92oIt0xr8IUm
TLSH
T1E2E474133066C45FE667ADFA07CF853091F47EED11E9D30E6281B71A0AFA324195E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 0c3f26772e81c6e001e74ec57114fb9d1e45345120673401d7fe5a9fd79e3af8
MD5 d31265134e64f74a8f0d8a5ad0b904ee
SHA1 56982a64e5dcf26a771475e0ff4eaa7807b644b4
SHA512 dd8765891d50b18b7af114382ad98ac668663746827b21c658fcaa9c37f7ff4efcd10aae104ad3cf104e3cf279170aa0ebd249bc1a4663a068173c3dfe2f3e2c
SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxZ8m3G5QGPMLaN:QCSjGoLpWM6VbBgjxZxi3MG
TLSH
T1B7934B55B29CB376C0E299B8CE0DF2E5BD257E700F2908AB71AD3F1D9A771C1590C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2144-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2144-1141-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2144-1262-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5072-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5976-17-0x0000000000400000-0x0000000000429000-memory.dmp

Download