Analysis
- max time kernel
97s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 04:30
Behavioral task
behavioral1
Sample
2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 958KB
- Sample260715-e5aazsev6w
- SHA256 e7bad54046008b9550927d3359a62c87e3fc63345d5f0b7464c94fca1df4e078
- MD5 a1616c4c47781a29f0df71fbf698b803
- SHA1 7fd1a4d69aca5ec9dd4206f59161eb35bbfd927c
- SHA512 24c8910ffd1669a2bbd2d98dfdfbc020efb437f487fd34480c70b9f6ecda9a423c0d9ae0c9e39db89d193a91a79c34bb2c503ab0d56920c77fc10d251d631fc8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fFmg9:A3mnXoZjzyaEzD5TvinrmkzywFqRFmg9
- TLSH T1E7256B07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/3348-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c4e2-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-57.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a000000017649-158.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3348-177-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3204-178-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a85-262.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001babc-260.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c000000019cf4-1040.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019cca-1295.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00170000000188d8-1493.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c4e2-6.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-57.dat aspack_v212_v242 behavioral2/files/0x000a000000017649-158.dat aspack_v212_v242 behavioral2/files/0x0013000000018a85-262.dat aspack_v212_v242 behavioral2/files/0x000400000001babc-260.dat aspack_v212_v242 behavioral2/files/0x000c000000019cf4-1040.dat aspack_v212_v242 behavioral2/files/0x0004000000019cca-1295.dat aspack_v212_v242 behavioral2/files/0x00170000000188d8-1493.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3204 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$ patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3348 2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 3204 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_a1616c4c47781a29f0df71fbf698b803_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3348
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3204
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 958KB
- SHA256 e7bad54046008b9550927d3359a62c87e3fc63345d5f0b7464c94fca1df4e078
- MD5 a1616c4c47781a29f0df71fbf698b803
- SHA1 7fd1a4d69aca5ec9dd4206f59161eb35bbfd927c
- SHA512 24c8910ffd1669a2bbd2d98dfdfbc020efb437f487fd34480c70b9f6ecda9a423c0d9ae0c9e39db89d193a91a79c34bb2c503ab0d56920c77fc10d251d631fc8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fFmg9:A3mnXoZjzyaEzD5TvinrmkzywFqRFmg9
- TLSH T1E7256B07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 1.0MB
- SHA256 4d8342ed4cf8591cfb433313f8711ff759361ccb56ec5af9430a1b28f58e45e6
- MD5 14239a1e26c77bbf0a6fd1c43395a613
- SHA1 404a48cb85c5c1eed3dc10dda6fd30aed0ca2767
- SHA512 78f117783ae9ec81f505b357dce361bddbbe80c374c8dfa6c24bc52053b0f832a3111550a910ae1ea2489c59f7012cc4cf854dc1e96e2cd181e6a162023f29e8
- SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzywFqRFmghhk:A3kM456r90W
- TLSH T1A2355A07A6951FE9D12F817489924A22E7737C225F2087DF13649E263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 dbea1b178dd0d3f3daf2250dfc3871a05b9702c11e4cc4f88f067277cb696401
- MD5 d26ef05abde20ef532096c69af17406c
- SHA1 2cbf04fb1d4b2937c213d2d097e9c033db669149
- SHA512 655119ce971518d938f45bcabf405d4e7eeb42d8b46ea4ba70419180a1f4a9e37590fb015941cd149508368a2a63896d8bb2835e9a6c2d88c8ba4dc059ec1c93
- SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzywFqRFmgJ0Le5ji0hmxNrM:A3kM456r9QPji0Aj
- TLSH T18D654A16F6A44BA5D02BC178C5D2565AEB733C521F308BCB03949E293F277D19E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 973KB
- SHA256 bb19917137fae2e37be10065ebf8bb6a790b9ce58072de3490247185255b0ef0
- MD5 1e7efb55138d2d9f5747cc0a083f348a
- SHA1 783e34467efb3ab35bd0063837c324e979f34b3f
- SHA512 4b9e59e9eccf306277af8121e53d83c4753907ea4f98c9288810bb7f6a4e7b463d435cf60e0d94c032c0f670218a29237e05c24ac610789a28b6e90f46446095
- SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzywFqRFmgba:A3kM456r9
- TLSH T197256B07A6941FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe$
- Size 1.1MB
- SHA256 54be597d61e5ef9431baced71027bb413d8d317e94273c28fdbf83a556b90479
- MD5 1d43cb59baac49480b25c7cf25c6f0ad
- SHA1 a9798a8cb652548684e4eb87e44489b35c14543c
- SHA512 da4fbb7d34f7460adbf7b5a0d6e326e45841fd6aabd1c228101d869a2257acbbb312c5a7d625c0a01ec6a7662de1a2e32bac71cbf1ff01e4bb1dc031cf61baa5
- SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzywFqRFmgSD:A3kM456r9t
- TLSH T1A8350506E2940AA9D01F8174CB914652F7737C225FE087DB13D4EE3D3F226906EEA663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 982KB
- SHA256 a06cff29f43bac04d4d70bbc871e869cc55e9a822055e8833f2e2140f21b631a
- MD5 4bbdb368141915a2805390334ca5fbe3
- SHA1 03354d85f5f09c5a528c5f2e53852640477928f2
- SHA512 c7f9273049632fbd95e7329142c8e9e1ea750265b8a8bfa21a3a9502c33e8d18bc3f155889b90c784e0d0b83b44fda23f8971b28ef38191a28d18d94cb8d966d
- SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzywFqRFmg66:A3kM456r9e
- TLSH T17A256B07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$
- Size 1.1MB
- SHA256 4b366b065fe7796d776d3974e92d9013cec68f1d8c1d5168bb49d4675f5eef5a
- MD5 58061c80959dd9906d98ed645ab84bf6
- SHA1 3a24d864b0f38710a896fcc73b7dcc065cb6784c
- SHA512 9946341351c467746c601d8f99689d5696a0ebf345b250b7b4314f2977a3587d1035f8a4784a15122424532f61c1abab25d24f5536d46e7ec5a644b0d2122261
- SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzywFqRFmg+zy8:A3kM456r9PT
- TLSH T187355A07A6951FE9D12F817489924A12E7737C225F2087DF13649E263F327D0AE3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1002KB
- SHA256 d177b3dd317af518c6f0d2ad7a90581b6902ff8331fed4c0d37f3b19aacc6955
- MD5 89612bfbc533ad5917db1b95a04124be
- SHA1 19ef975a57bcba92f4a1ff378dc48390b8317f7a
- SHA512 96a93095c08f4a469c3c08e0cb77fdc9ddf4a2a80a0c6a975c5e9766d87bffd2ac013012da01b6f99b78e95d9a909a46a94b798742bc03f91bca6e6069784ede
- SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzywFqRFmgEwE:A3kM456r9V
- TLSH T13F255A07A6941FE9D11F817489914A62E7737C225F2087DF1364AE263F327D0AE3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.0MB
- SHA256 74ee9af41d80d8d3e655e0c30e0eea8ba34cdf792ddbe2e389a7842084e7cabb
- MD5 429de76c179ad0e2f9e45d0ea0780fef
- SHA1 a25036a94876d318ae33b1c0d5a2d7f853bcead8
- SHA512 868318fad7ee477ecb9bcaff4a07ea5291dff7ac0bc9782dcb1ec93fb052101c44c3f06bf6a5102896c9d801b43c226160aba2e7376a3eae5be252b69a27408d
- SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzywFqRFmgpF:A3kM456r9g
- TLSH T1D7353802A6950FE5D55F8134C9964A12E777BC620F208BEF1364BF253F326D06E3A663
- MD5 SHA1 SHA512 SSDEEP TLSH