0d06cff5e161a78e5fc4ea2b6bcf99c1e24c06dee1c974b8a5f292ec44c504dc

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 1.8MB
Sample260715-a5d7qabs3x
SHA256 0d06cff5e161a78e5fc4ea2b6bcf99c1e24c06dee1c974b8a5f292ec44c504dc
MD5 657d811e72c5f19ad899981fd4662ea5
SHA1 adeafeadc5d4f42e981351d64d61b70cacb7fd6f
SHA512 1d7b120b0123b12c640235046fc8ddf09c891ead6961499953514c2bfe4ec62458b6fb6778d0d2f08936dc6398111b1228e0e51228eacb47d405118e2430a1da
SSDEEP 24576:w6TLCEHcJWxdFKcOV2nKrSIV+D/5WgSCS0n2MTVk1+VJHu0of:9TW9Vck2cbV+D/53SCX2MTrHc
TLSH
T186954907E25D73E9C0D9C178DB0EF631AE61BC450B25A9EF22906B163E76AD01B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 2 IoCs

pid	Process
4712	Logo1_.exe
4544	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\RCX7DDD.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX7BAF.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCX7A00.tmp	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCX7A10.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX7AC0.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\RCX7DEF.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX6C6B.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX70DB.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX6D2B.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX6DE9.tmp	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Windows\Logo1_.exe	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe
4712	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 4708	2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe	86
PID 4708 wrote to memory of 916	4708	net.exe	88
PID 2360 wrote to memory of 6032	2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe	89
PID 2360 wrote to memory of 4712	2360	2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe	91
PID 4712 wrote to memory of 2944	4712	Logo1_.exe	92
PID 2944 wrote to memory of 1392	2944	net.exe	94
PID 4712 wrote to memory of 4816	4712	Logo1_.exe	97
PID 4816 wrote to memory of 4624	4816	net.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE41.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6032
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1392
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4624

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX76AE.tmp

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX76AE.tmp
Size 157KB
SHA256 c2121335d89d6046d575720ef916e7c7e5000606c5575e37f0df0a4d7ff18343
MD5 d8a89bf8ade50181101e829206996b22
SHA1 c9132b6648073b2015c8f275c9eee2f141976298
SHA512 eff6b2bb93a6b4634c2fd76c7d9a5a7c99e1c83a7fc014c6e315a44f6b79f918136e780af35f4b380f8a8820f7642fbe3b1fb3185e9d99ef94f6b86fb74f9d9b
SSDEEP 1536:A7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxRZ2HQuhtjRQXsND:RCSjGoLpWM6VbBVjxRZ2wuhttQcp
TLSH
T166F3B36EB18FB3F6C3E1597C8D1CF295ED29FE20CE19285A76D93B0E9A760C34508191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX79AF.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX79AF.tmp
Size 95KB
SHA256 8a3fd84e0fad8290736825b93ba34e70e487e8e73fc5ca0c37310009453733ba
MD5 4afa00173b062ee12fd6d80713f84dc7
SHA1 e954d9b8d1e4fdaebbe862998ff33ea19f7be4c3
SHA512 b1be158156479e4ae60509bdb2c8d06fb5046f84acbb5362e3e4ad46731fb2399263cd0a6f2f53bd16046c5df68c62505068b9efc6d647410c1cac5d0b4d020b
SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxGZ2HQuhtjRQXfNT:wCSjGoLpWM6VbBVjxGZ2wuhttQv5
TLSH
T168934A5AB18DB376D0E299BC8E0FF2E1BD393E201E1D189FB6992F0DDE760C15508196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX7CFC.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX7CFC.tmp
Size 104KB
SHA256 fc3f25a09ce697c94afe122136534dbc1b5758c8ecf451caa227abeb980fa31c
MD5 fb0ad46de48a8fa54ecd1e2c0afba116
SHA1 58c09d72ea9855913b84ffb11788c5acef44b0a4
SHA512 401834c74cd5e3936ece5bd0a763395e2ae5b138d53cdbd791cbafd44f8355f98ecedfee14cf817037a765dbcdb42ca252733006b323f094c811dd7746600089
SSDEEP 3072:YCSjGoLpWM6VbBVjxrZ2wuhttQcdtPlLqge:uXq1Vm9RLM
TLSH
T110A37B6AB28DF376D0E299BC8E0DF2D07D397E300E19185BB69E1F0D9AB75C1190C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX7B01.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX7B01.tmp
Size 119KB
SHA256 38dc5f781727a9706937ad6b59d2fdf6753b627c5ca314876025379b8c9ac93d
MD5 9902980d5c9cdbfa8e102cdaf8d0a063
SHA1 cf958c7822838f82d637904396e795f6edfff3c5
SHA512 45061097dd1bed8e3452e0e53f68f6a14232d9876b1cbd9ad1f671e53d62a41f84b8a3fa6194124d62b5cc45f8e3d9b26fc08b18e14849fd5a8673f9e08bf599
SSDEEP 3072:ZCSjGoLpWM6VbBVjxNZ2wuhttQPe5BV0P3:DXq1VU9ae5v0f
TLSH
T185C39E6AB6CDF377C0E299B88E0CF2E57D297E301E19085BB6991F0DCE7B5C15908192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX7EF3.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCX7EF3.tmp
Size 100KB
SHA256 19228d9539e94f98b8bd0e380ad7aa46b49ca02a1a1dcde29b243e4db576ff68
MD5 a8657b16b6975b45f3956711a289a39a
SHA1 13eb386dfe1874ab72aac49c9638239e0b9394c5
SHA512 8afbe11474ca1058dab3a542ef1adbd57eb21126c0a5b3debad5453aba2770667e7cc3e7e95dbcf28546995f24dffbb36e3a45c017615c49593a93bea0b630f5
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxUZ2HQuhtjRQXeqkSZZZ3UNz:YCSjGoLpWM6VbBVjxUZ2wuhttQgUUZ
TLSH
T1E5A35A56B68DB3B6D0E28AB88E0CF3E1BD357E300E59185BB69D3B1D9E770C2151C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6B9E.tmp

Path C:\Program Files\7-Zip\RCX6B9E.tmp
Size 92KB
SHA256 89b010801208e1ac1711ba787dc44075c08416c724635e20dd93c59f0c089f77
MD5 975382afb451bcc3c348c0e1095dd384
SHA1 389bcdc7f3d4e7d3b58f712ee1ca99e524448300
SHA512 008eb64f9025dfe4e6259cf5d759621e2c4bf3d759dd5baf22b0329d64a662dbcf23be058ea76786401c49e937ea51b31642d7b3ab8a840f66fc8e37abc73db6
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxWZ2HQuhtjRQXYNr:YCSjGoLpWM6VbBVjxWZ2wuhttQoR
TLSH
T103935C5AB28DB376D0E259B88E0CF2E1BD397E301E19185BB69D2F0DDE771C1150C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6D3B.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCX6D3B.tmp
Size 93KB
SHA256 c5d42b149d17ac128da8efc63768bb6da37dfe0165a438e2f174178846805a95
MD5 727a777ade05f75e0b35ee3a60159214
SHA1 c17dbab44cf914d046a9dca9c83f8b70ecf9eb81
SHA512 4dd52e4bff3e3e8b23630e4a19385797f70fe7581eed5ba513fc976fa720b613de2e7476a42dc512839cdb31dcfae675d466750943bf988832215a572046e791
SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxmZ2HQuhtjRQXhNb:ACSjGoLpWM6VbBVjxmZ2wuhttQRB
TLSH
T13F934A5AB28DB376D0E259B88E0DF2E0BD397E301E19185BB69E3F1D9E771C10908196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX7048.tmp

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX7048.tmp
Size 92KB
SHA256 d8586c81c6a5feec905477430dcd5ea32a4aa5db8fe360210147d56a5b23e1bf
MD5 d2d0a9e0c6f7383120df9c8959ee7b41
SHA1 072cdea404c507d7e2bce427c91d4ff3f7a78a56
SHA512 dfa66022203687b77bf3018ecc6a29318183e526ac6a884432ae5d795a60ada029511eb2332bfe0e66ccb1f65e2df5750702a20ad49392c84c3529e5a3e2a385
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxmZ2HQuhtjRQXCNb:gCSjGoLpWM6VbBVjxmZ2wuhttQyB
TLSH
T122934B5AB28DB376D0E259B8CE0DF2D0BD397E701E1918AFB69D3F1D9A761C1090C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX8389.tmp

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCX8389.tmp
Size 93KB
SHA256 558170e82714764abc4a8d22829533b35b9dcad52925582e25d7d18c34bf8c64
MD5 d1efa2cf5fd80da28bf625b3fc6a14a9
SHA1 67fb3660041050d1a532a8a8d88d12ac10b5a935
SHA512 801c3182763a6a590ac19e29d4800a61d3c42d06cd291439ffb19259b105b42e59c61903135a39a80541e26a32cf3981bc37c0e8cc86238bd7d98cbc5e142f1e
SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxeZ2HQuhtjRQXCRNT:4CSjGoLpWM6VbBVjxeZ2wuhttQSR5
TLSH
T1F9935B6AF28DB376D0E299B88E0DF2E07D397E305E29185BB69D2F0D9E770C1450C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aDE41.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aDE41.bat
Size 824B
SHA256 4d686f72a5c9ef7537cd795bce40bf8756a431008c5978e9d9ae7c3223f19b8b
MD5 823b2621956c256eab3c9933d04fa920
SHA1 1355d8571db743bc2f616d67fcc1a80874220be4
SHA512 3383c771ec6d31ec3d63c482ed0bf354b0374b9683be20b806b4c2e3c0b1b7fb5ec3a916943fefa0eefe2b2a92623a313e88be5ba932a0f2ae1cb24cf2f82db0
TLSH
T19A018431D79FDA8D8435382707E60ED8C4E268696F0C3234FB98C81966D244DA9D7B9B
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-14_657d811e72c5f19ad899981fd4662ea5_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 1.7MB
SHA256 1f29cfa0bde5dfeea2bf7aa9bf59460ea20c4a4c4961b63dff193ea155926af8
MD5 e8a7fd36edbde850c55ce09c71d93d24
SHA1 eb7b457e7ce857215ab8384a0cbe63b9f79ad475
SHA512 c4533efb047337a54f740c0863885e9f418d6be336281d4cb9cfe646b3b81364e26e1f2e5eae93b8711aa1311708e6beccbfb64c755898b185b9c4b40d6ee38e
SSDEEP 24576:WTLCEHcJWxdFKcOV2nKrSIV+D/5WgSCS0n2MTVk1+VJHu0of:WTW9Vck2cbV+D/53SCX2MTrHc
TLSH
T1F4857C07F26540E9C05AC1B8D706D631AA71BC894B35B9EF23906B663E76BE01F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 a80d1b51db8d3b0e43778f4904255bb1683f1a3fa2ce5d5c2449b47f6b6d449e
MD5 288f88efdb388c2127f01aa69ad17459
SHA1 de8f3b253766467b298483d211168339e7845713
SHA512 0e5b6ef7b1c39be9c5e865f6f1b9bb8ca51caf4c7a9c93b51f5e73953416f537551e182a3543641a349270de8c9e95bcabc55fdaa03e094a5865bb3e56006544
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxNZ2HQuhtjRQXhNc:oCSjGoLpWM6VbBVjxNZ2wuhttQxG
TLSH
T105935B6AB28DB376D0E299B88E0DF2E5BD397E300E19185BB69D1F0DDE771C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2360-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4544-17-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4712-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4712-1053-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4712-1259-0x0000000000400000-0x0000000000429000-memory.dmp

Download