Analysis
- max time kernel
112s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 16:11
Behavioral task
behavioral1
Sample
2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 3.2MB
- Sample260709-tmxqwsds2n
- SHA256 e430afa0aeaa44e4bb416edb9c1bdeb9989c0deb6de13f92f8729c36e6296aa2
- MD5 ec09e79b6e8b55137bf7bbe840975db7
- SHA1 b0a75972581e0256df5ebcc587375d5ca73fc951
- SHA512 69e82ae99507349b5a01831850f2de45ef07efbdedfc201a850a3375be580d0e27fa1476f8bf722fd7f6169d1c8d36959b2509249047559a270e8cb05b086578
- SSDEEP 49152:A3kMuX56rXqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mbq:A3kMu4rXFfkZcNfkZcq
- TLSH T147F51A16F5788722D0BBC0B9C6D26A99FA3338455F708ACB0285D73C2F276D58936736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/1688-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b6ec-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0009000000016bcb-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1688-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2832-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bb45-160.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019843-361.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019dd7-1026.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac1e-1293.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0016000000018863-1528.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000500000001b6ec-5.dat aspack_v212_v242 behavioral2/files/0x0009000000016bcb-11.dat aspack_v212_v242 behavioral2/files/0x000300000001bb45-160.dat aspack_v212_v242 behavioral2/files/0x0003000000019843-361.dat aspack_v212_v242 behavioral2/files/0x0004000000019dd7-1026.dat aspack_v212_v242 behavioral2/files/0x000300000001ac1e-1293.dat aspack_v212_v242 behavioral2/files/0x0016000000018863-1528.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2832 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1688 2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2832 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_ec09e79b6e8b55137bf7bbe840975db7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1688
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2832
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.2MB
- SHA256 e430afa0aeaa44e4bb416edb9c1bdeb9989c0deb6de13f92f8729c36e6296aa2
- MD5 ec09e79b6e8b55137bf7bbe840975db7
- SHA1 b0a75972581e0256df5ebcc587375d5ca73fc951
- SHA512 69e82ae99507349b5a01831850f2de45ef07efbdedfc201a850a3375be580d0e27fa1476f8bf722fd7f6169d1c8d36959b2509249047559a270e8cb05b086578
- SSDEEP 49152:A3kMuX56rXqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mbq:A3kMu4rXFfkZcNfkZcq
- TLSH T147F51A16F5788722D0BBC0B9C6D26A99FA3338455F708ACB0285D73C2F276D58936736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.6MB
- SHA256 ff2566e3e9ef0aa0a2faeb7d635f55d62c3236244e2e54f9fe0037ccf229a7e4
- MD5 877f6fe603902e7a0c6154b9f622d4f3
- SHA1 fdb9890bbb462417931cd8b1a0ccf67b0ec223c5
- SHA512 485da63aeb49a1adc396650c19e7afaa432d5cd474a41c52789b412a1bd12ef923cbb5cd6098dd7492029832fb3989c6292d2b54d1d605556fba82d5a08074c4
- SSDEEP 49152:A3kMuX56rXqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mb4Td9CHKyao:A3kMu4rXFfkZcNfkZc+Cqo
- TLSH T1E3062A15F2B88762D0BBC079C6D26A59FA3338455F708ACB0285D73C2F276D5893A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.7MB
- SHA256 c7c84ba0da89477fb68d86a3280dc01489f43fad26f992a16cc218e91aebe558
- MD5 f69a41ee9f144a3fa267617f6fac69d4
- SHA1 8087aaa065462a586ee5bccc02f73241842a202e
- SHA512 d694003869d3ddffc0033c9c2c9bde1e3017b1a9f93f2586f48f92bec006b40864b452d0065858fdcf9efbac0b2f48cb4a91e7bf7009ea0251f35e238975ebe2
- SSDEEP 49152:A3kMuX56rXqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mb6Pji0Aj:A3kMu4rXFfkZcNfkZcQjo
- TLSH T173061A16F5788722D077C0B9C6D2AA9AFA3338455F708ACB0285D73C2F276D58936736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 3.3MB
- SHA256 e079db966174b3b45b7d66dd744db4f14f4b446def0242189f1a323c77b54122
- MD5 df09f9a2ef612d86d94fe5b31d2d8db6
- SHA1 1fd1e19565e6e4b5cd5c7784a45339abc986baae
- SHA512 034a0eba2808e6113a3cb58d948a99d630add787174ea0503586efa246b1f930f359692ff184de39f5bd881551e2880e6476ce2b2c19548b55fff76dde01d13e
- SSDEEP 49152:A3kMuX56rXqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9MbH:A3kMu4rXFfkZcNfkZcH
- TLSH T1C2F50816F1788722D0BBC0B9C6D26A59FA3338455BB08ACB02C5D73C2F276D58976727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 3.2MB
- SHA256 3dc5d7e131395505bf510e06f3cdd624f24b1edc6d18a6a97937e2f5a416aa87
- MD5 ed36f708c4a9d176d0e7e3418cf8898e
- SHA1 b5bc44db7a00e68e77884ec3aecdb9c7e41b4451
- SHA512 6a32ab390b3ae63bda81f190d29d44841fd60adebc67f9917b41647d4918de9a81ec35adf1f303d2b2d9283ea2eb5521173ca32e1c5396bb60603c2429137bff
- SSDEEP 49152:A3kMuX56rXqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mbh:A3kMu4rXFfkZcNfkZch
- TLSH T1DFF51A16F5788722D0BBC0B9C6D26A99FA3338455F708ACB0285D73C2F276D58936736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 3.7MB
- SHA256 f90b6a16a822f5ce5c03bb42f22bde36736f44560d13b3bcdd77868adcc48868
- MD5 e8351073d487015113d3c7fd8967e6e8
- SHA1 47a600f2372a6ebd8d1c2d697705f0fb34dc94eb
- SHA512 b69511108c1ba81c728f2e373a8c0b976dfdd7f41f49dd9044c056454951ab705bf80d45d28c7cacc99aa75baae8f827532062261b08e8b4e716d802f378f752
- SSDEEP 49152:A3kMuX56rXqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mbm8tDZqrKV:A3kMu4rXFfkZcNfkZcmm
- TLSH T1CB062B16F6788762D07BC079C6D6AA69FA3338451F3086CB0285D73D2F276D1893A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\crashreporter.exe$
- Size 3.3MB
- SHA256 9c829771e46b8a37b7916ba883b600005a758e813ed8953793312e95642187d7
- MD5 ba9f5228fa126c57edefb43cea3d365d
- SHA1 10526a01e96b867c7b571979f83522d0cfeaafc0
- SHA512 8f1d82c9625536d954c2fb41379d922b8cbc584f5bd73ef70b38cd7ec1fe04634f17d0e53a3b30ac181ebd476c8f00396d33f997d165fc2488d4f25e89e32033
- SSDEEP 49152:A3kMuX56rXqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mb6:A3kMu4rXFfkZcNfkZc6
- TLSH T1CBF50816F1788722D0BBC079C6D6AA59FA333C455B308ACB0285E73C2F376D59936726
- MD5 SHA1 SHA512 SSDEEP TLSH