cfdea761b9b11ff46200c223283be82b663c9e6bb2c34f5c1e2f6e1196e950fd

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 2.5MB
Sample260718-ccqfdscw2q
SHA256 cfdea761b9b11ff46200c223283be82b663c9e6bb2c34f5c1e2f6e1196e950fd
MD5 d44dcc2cc17c5c556cc27defc343fe99
SHA1 221a8d0d6e83ff5817f9805f5f0e81c5b59f458a
SHA512 8172df8afd3dd390523f7d6030de531b2886b6cbb77dd518ca313310bc2a39252f1e9bbf8995bf5446ded523bde5a79bd1cb31d5be28af5d067b6ad394f65e48
SSDEEP 24576:P4R5CIH/7JGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJS:PabH/wuYScerPrgjI45TMwwapIgTi
TLSH
T110C5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.xls	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
3716	UpdatAuto.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\dayget.dat	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4868	sc.exe
3596	sc.exe
4536	sc.exe
804	sc.exe
2828	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5044	cmd.exe
1964	cmd.exe
5844	cmd.exe
5300	cmd.exe
2484	cmd.exe
6040	cmd.exe
2928	cmd.exe
2624	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1852	EXCEL.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2832	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3716	UpdatAuto.exe
1852	EXCEL.EXE
1852	EXCEL.EXE
1852	EXCEL.EXE
1852	EXCEL.EXE
1852	EXCEL.EXE
1852	EXCEL.EXE
1852	EXCEL.EXE
1852	EXCEL.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 5300	2832	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 2832 wrote to memory of 3716	2832	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	92
PID 3716 wrote to memory of 2484	3716	UpdatAuto.exe	93
PID 2832 wrote to memory of 1852	2832	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	95
PID 2832 wrote to memory of 2364	2832	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	96
PID 2832 wrote to memory of 5844	2832	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	97
PID 2832 wrote to memory of 1964	2832	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	98
PID 2832 wrote to memory of 5044	2832	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	99
PID 2832 wrote to memory of 2624	2832	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	100
PID 2832 wrote to memory of 2928	2832	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	101
PID 2832 wrote to memory of 6040	2832	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	102
PID 2832 wrote to memory of 804	2832	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	110
PID 2832 wrote to memory of 4536	2832	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	111
PID 2832 wrote to memory of 3596	2832	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	112
PID 2832 wrote to memory of 4868	2832	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	113
PID 2832 wrote to memory of 2828	2832	2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	114
PID 5844 wrote to memory of 5548	5844	cmd.exe	120
PID 2364 wrote to memory of 768	2364	cmd.exe	121
PID 2624 wrote to memory of 5948	2624	cmd.exe	122
PID 5044 wrote to memory of 4896	5044	cmd.exe	123
PID 6040 wrote to memory of 944	6040	cmd.exe	124
PID 1964 wrote to memory of 4468	1964	cmd.exe	125
PID 2928 wrote to memory of 4856	2928	cmd.exe	126
PID 4896 wrote to memory of 5620	4896	net.exe	127
PID 5948 wrote to memory of 972	5948	net.exe	128
PID 4856 wrote to memory of 2376	4856	net.exe	129
PID 5548 wrote to memory of 2112	5548	net.exe	130
PID 944 wrote to memory of 5684	944	net.exe	131
PID 768 wrote to memory of 1336	768	net.exe	132
PID 4468 wrote to memory of 4672	4468	net.exe	133

C:\Users\Admin\AppData\Local\Temp\2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5300
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2484
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Windows\system32\drivers\2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.xls"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:1336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5548
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:2112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:5620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5948
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:2376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:944
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:5684
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:804
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4536
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3596
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4868
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 3.1MB
SHA256 72b6041d8cd64d2f1e5c03e6dd38510fc36481c5d3abf35232b47b11d74f099b
MD5 5117c3786c0d672d4136ecc9eb50f652
SHA1 95be9d0645f09ef479d64b82b596f905e0a65774
SHA512 f266f48f46a2d33ea184c70275a36f9cde1a78318dbe7fc35d78034edcde6b501957513916ab6a23134cf82516193083bdc1d1393399a05b5a82f9aa4c6db49d
SSDEEP 49152:PabH/cuYScerPrgjI45TMwwapIgTIPji0Aj:PWr9LapIrjo
TLSH
T1ADE52A22B1A10569F159D872CF46A325A7E03C698FF182EFF10972D82F725F07A39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 3.5MB
SHA256 621a55a99b89a5177971bc405efd7ccf52b79b4efc0d74be8bac2a2ea7f76339
MD5 0a63d7bf5918cb3347736fec20cafc7a
SHA1 642696d3931d03e9f38375d3657cacbb29d0af5e
SHA512 9b25d55f04048794826094c6c1d6a423d60e0272cb045fe261cffc0b9ec4949ac602e5f41515c6c22ed4734a29f9ab8bd3b7903feaaf8b4565db4cd732ef8674
SSDEEP 49152:PabH/cuYScerPrgjI45TMwwapIgTr/ezSC6vUzPvMHjy:PWr9LapIkezSC6v2XMH
TLSH
T1F2F53A22B1B14166F069D472CF86B725EBA13C594FF086DFA20973D82F326E07A35719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 3.2MB
SHA256 9fec464eba33f37204cea14c017deb1cd8b2def176527a94b3f7ca2711ddc842
MD5 a042d289924721c9cda9c77f3e5d6273
SHA1 e552a3e8170f16e4f3b47147be16c7197e8bd4fc
SHA512 cbf078ab09690378490ec9a301d2bdf54a26652ddedc7ac35f678de9d6beda375fc44e9ed879f9928f4aa5f7110ec34eabd4ac164c77bb2629a43f4483e10ec0
SSDEEP 49152:PabH/7uYScerPrgjI45TMwwapIgTkVO88hXl+:oWr9LapIw/h1+
TLSH
T130F53A22B1A10169F059D872CF46A325A7E13C698FF187DFB20973D82F725E07A39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 2.5MB
SHA256 e8c8daf35c126fd8355a29c3d26715277cb9d2b89956d4f8b081a7ef41b50daa
MD5 8da305779e3c386bd8fda2c4bd106a20
SHA1 296a6ea221ba9ad953b7a4f52508e973035dc9e6
SHA512 294d29ddc15ce1a3082e2fa459d75bde668f44071d1bf246aecc24d58b965ce3e4febbd53547a57f35235c6b1b0fa0aeab9a3ab0cb589e92be09875d12d3ead9
SSDEEP 24576:P4R5CIH/7GGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJ6a:PabH/RuYScerPrgjI45TMwwapIgT
TLSH
T1A6C5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 8.6MB
SHA256 60f0913d6181f7a9e134298952ba3892c4145f3fd17c15bbc2022c7542729549
MD5 d43fe86b81b97f5881cc5a546a347ee3
SHA1 ed4f8899535b4c6b7574b58e6a2303d94b6c83ba
SHA512 5befbf6a86e7196e63160c4bd95d93202ad4eec5aec1542c377e3fb4cb5eee55c6cb48aabb865b0a6f1aa8164fdb6481c221fc79856eb6095b1504bc44f76bc5
SSDEEP 98304:GWr9LapItQRQyi36YOcP+Lvw2gAf+PN34:GWr9cIEQyiKaUX+PNo
TLSH
T188966C13F2A101A9F05ED974CF29A3319BA17C5A8BF193EF258436D51E729E07B38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 4.2MB
SHA256 0f851172c1f91491962e97df50e991b00c9a76cd2bfab863b9048ef27214a737
MD5 35fe8ab2a3bb10164c0c85ab424bbbb7
SHA1 72a44bd6268f4d4de7bc9e80630d6a5d2a41a233
SHA512 b065742d6213bf95b299f2cac7d8a48ae5dc9d9e50fbee85e46902d36cf28cae1cb9cfb24121a52556c44d630a37ba8ffe2da1905486206c333363131291324f
SSDEEP 49152:PabH/UuYScerPrgjI45TMwwapIgTb68Qg55nhoeWu7PNU3/Q:XWr9LapI0thHRc/Q
TLSH
T15C26F63371E20099E44DD972CF4AA721A7D17C698FF193EFA10572C91B729E07A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 6.0MB
SHA256 6c1e86875565e50c0a7edd90f8f15c3ca91f5401da5c0c136998b28384487ef6
MD5 9271fb585e18c033aa87780693b711a9
SHA1 42677349d9304da0cbc03d67b48b280a818dca79
SHA512 180a026e7b2f87c76e4820ac14e887653f3115f4d81ce66a9fac6eb0defc5b85b04f7ad93b0ae5ad251b77eed7f5bf4e175cbdcea7c5eaeb96b9faaa153ed6d5
SSDEEP 98304:GWr9LapIry5112gYy5azzVvf69nLKnhZO:GWr9cIGLIHuWhs
TLSH
T1CA565A23B1A500E9E049D575CF4AA331EAA17C6A4FF1A2EF560073C52F76AE07B39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 4.8MB
SHA256 7dc4114adfd2cf7c5282626385e78b318d951b8b0f73b899eb88a8346f2b2c03
MD5 6b5d52b668433d2f7766471774b2fa77
SHA1 eb10aff84ea5932cb39fa52b9a571ae68546b7c0
SHA512 9733074cd45743e23adabc4f6f0758e0cb72075fc5e7cb882c5d32319eaecf3ecc987b4c6adc82d374d70792e28078401b555175d96b88ace8fcab6949806c8b
SSDEEP 49152:PabH/UuYScerPrgjI45TMwwapIgTUB+taZ3usBWOBr4tEGW0bqx0z+n217aau1gp:XWr9LapIFu6Jm0xd2d3
TLSH
T158365B23B1D200D9F059D875CF0AA331A7A17C694FF1A2EFA64472C52B76AE07B39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 4.2MB
SHA256 cee61404f71c795d2e41bb6ff0074d4781f23bc09058fbea309a82368ab8d764
MD5 6626af86f4ea7ed46db433394a97e468
SHA1 7d7507e0af657dbedd3920f2c7241fc2d1acb414
SHA512 72a1d898d9bc1d93cfcf132a657de6d84ad566911089c5ad2f2f5a882a244f82ccc5b6634126de6c81e47927425b9d1eebc6600e47273be5c561dfaa632edd39
SSDEEP 49152:PabH/JuYScerPrgjI45TMwwapIgT21hpsNoJpF1A6GU44CwH7R4xu:GWr9LapILmifP5R7
TLSH
T1A9164B23B1A100A9F059D976CF06A321A7E17C694FF193EFA64472C91F76AE03B39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 4.4MB
SHA256 71f1a50516c538056e3092eda3b017ee83e5006f375b66ba3038cef13b3514b7
MD5 b9843d9992530eae28322723e33b8b17
SHA1 4382b0d2bc1f1c526f78952a160914c4fdc0ae56
SHA512 540d95da74853f7d11747be50b0055c45418f79370a27c02d21da4485851d17e759732e4f7e8c1a9925ffe8aa7f7b62427663d2baca7bd1b5ffa3822dc2aa125
SSDEEP 49152:PabH/JuYScerPrgjI45TMwwapIgTfSuZQIY0Be2K8RVtOnks6NMHq6:GWr9LapIY5dKCi616
TLSH
T1DB264B23B1E20099F059D971CF56A321A7E17C694FF092EFA24472C91F72AE07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 5.6MB
SHA256 e075dd826cc4192161cb19e25ed591764477e8e0ae45fb6efc0a528b31598721
MD5 79ebfca70a87bc9738c2a68c4ff5e0a5
SHA1 47320bd50c67bd902156cf0b11387a529add6f7a
SHA512 1e5e98ea1a9b9db14a97ba656fa4c263bb22e46d3ebe45a19e1fd56770f9385dfcdbc41c6296c6fbdc51879f0e5ff309f0a06273e8967915f78ce0cc71bb442e
SSDEEP 49152:PabH/UuYScerPrgjI45TMwwapIgToyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQZ:XWr9LapI6m7vj1BDlZG
TLSH
T12D466B23B1A200D9F049D435CF4AA331E7A17C698BF192EF6644B6D52F76AE03B39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 3.9MB
SHA256 7c4f10d3175f97a66adcfc5011263c85271be452a801c15f3366a89f5943bd7e
MD5 a6afeb1cb18249b34a17530d512c738a
SHA1 1392c5391dad0f5ae410e5a6c3b53921a325823c
SHA512 b2bd6c6bbb271e14e4045cd8f206b454a48f1f36226afee08288614e1069061bd4db1243cd2e1acfe899098a6042722882467a0a8cd6e53f13ec6941897b0378
SSDEEP 49152:PabH/JuYScerPrgjI45TMwwapIgTRhtSn8EApI0fig1giDn0AP5w2:GWr9LapIFX2iwphX
TLSH
T139164A23B1A20099F059D872CF06A731A7E17C694FF196EFA64472C91F76AE03B39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 2.5MB
SHA256 ed81426aa7cb9aca65927cf315b9d778ef7ec7ff6982f813806074654df172ed
MD5 22dad17c20981306099018918cf11f6a
SHA1 4742e45d6959a2e92d63e5a1b4d526f2ec287bd9
SHA512 703b59ed0aab10537d92661c2df567cd1e7ded00114411ca0c2a914b1dec524ac99aad534592fcfdcd302be725d40a0ba0798df83f14fe5b2f4a15011ee32f24
SSDEEP 24576:P4R5CIH/7eGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJt7:PabH/JuYScerPrgjI45TMwwapIgTh
TLSH
T166C5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 2.5MB
SHA256 8b8fd510f51d55810dbb12923624cceaaf456c21ab0b75ffbf6195ebeff84f44
MD5 6e4476d2c9588ae007c5b27256c8e38a
SHA1 347738ce24c4a5475768665bb030def458ca9ea0
SHA512 defc42d95c321f0a5eeea380d22ad03152f06427bb0e2171f9641c5fcdbd4ebac0fe9f83d5b3e6ffed2efd579df15b6111dbde9845333d7f2572fbc2eccdda4c
SSDEEP 24576:P4R5CIH/7eGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJ7x:PabH/JuYScerPrgjI45TMwwapIgTl
TLSH
T139C5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 2.5MB
SHA256 b697516d03a10dbec28bba060f1851463594b13733f09100fc67040544d7d37b
MD5 e246c90178dcf069dc3bd493605c1ba2
SHA1 3bbc4faee56cbb4759bffcce5a70c0ffbb55db17
SHA512 b392730c0b02566b5a884e14437ca22343a0b0bf9ac0aad201e3468df44ce0bd2fc5244a0ece854f59949bf01ccfccdfc7ebe5ae2509474dca0a59047d2870bb
SSDEEP 24576:P4R5CIH/7eGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJ9s:PabH/JuYScerPrgjI45TMwwapIgTW
TLSH
T11DC5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 2.6MB
SHA256 e6fff0ef51c1924b5bddb81603890004718ca60bbfbeaa22eed49af03fcac629
MD5 be4c647347f1f2d9043f73fd2802dbb7
SHA1 1c6bd4014c1204b1daff5264ed5c098363b84ff9
SHA512 9359d506b33aaab9e71ff475e735aa66c22e0ea12a807f2f11738e0a5b78257454acf911416964ffa33747524f3294f21af83fe950b17893de598296099b9a0c
SSDEEP 24576:P4R5CIH/7OGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJj:PabH/5uYScerPrgjI45TMwwapIgTT
TLSH
T106C5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 2.5MB
SHA256 e02edc6f819c9a5e59dff01af0da6c9414c8f84ae4aa1195363c45c5a5916f0b
MD5 30b2be1b113fd4aa52ad048d07655022
SHA1 d4b0985a55afd39abfe95eeba6844f2eacf3e3b0
SHA512 f83a5bb47ee154e87eb1e19ac8839fbfb0d4df410a25a78a073598aadc780f6db7f13c7b9a24eb98493dd5a9fcfe14eae8e9adc6c9bb1d2203f02128723ec291
SSDEEP 24576:P4R5CIH/7eGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJkZ:PabH/JuYScerPrgjI45TMwwapIgTW
TLSH
T16AC5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 2.5MB
SHA256 5194400afb9b36972acb68dc0ac8c1470de9d6af7ada894ffce94f68012852e6
MD5 9e360b46eade950b797fa13016702368
SHA1 65e92e353b330f37b536aac443ce6b3595429689
SHA512 73d086b90be95e5b0c7a5c9c487531bf69a13c3d52116162f319e9746cd9083c85a6f4dd54b400aff3ba8fd97c5611c3dd32f85c2ca329746eb7664c09f8f160
SSDEEP 24576:P4R5CIH/7eGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJr1:PabH/JuYScerPrgjI45TMwwapIgTx
TLSH
T19AC5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 2.7MB
SHA256 612b762358880b8fabcb9c1ee0bbbd18773d85f706cdc67c21b9f3d606cdbc3b
MD5 503e4d449f8aac89c59a5ee1d38e5899
SHA1 845442e2d7f1b309718cdd57fb4ba40ef7c241e3
SHA512 0c12d664f3203c28fa20a8ee953f11926fc9b85c90acb790608796eecdccc90108ceee47b8c9a881d1c881013b7268abf23dca627ffd839fddcc08d26f18514d
SSDEEP 24576:P4R5CIH/7VGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJdD:PabH/cuYScerPrgjI45TMwwapIgTd
TLSH
T1D8D5F822B1A20459F55D9932CF06A324B7D23C698FF182EFF185B2ED1B715E03A7560B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 2.6MB
SHA256 8ad27f146d3b5a3790761f1cc7a714447ced7458560b05f439949d313abec7b8
MD5 000867ee20cccb420a713326c2b3b90f
SHA1 6d8f8a62739ff1a99ba650882d0c01ce1adfe4ec
SHA512 35d4e61004032d6fde594c21587066a20f10da8dc43c01e7c2615c2ef5c229a052c6867338b5af08522d3cb5faaad46030bc49941a82f4ad9397805ac5799111
SSDEEP 24576:P4R5CIH/7hGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJJ:PabH/IuYScerPrgjI45TMwwapIgTZ
TLSH
T18EC50A2271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 2.6MB
SHA256 3de8b84f1c06915ec68b2f030aa8c86708b3eaba8d4055da1c13e0c782342221
MD5 e1a7d63b7ab4cfa53b0b14632711c9d3
SHA1 51908210581d08cdac02bdf940e9a2a6c0b306aa
SHA512 5c128e76e4b5fdc37bb1fc30ec59f6e995975cb55b0103cef0da0504659ba4cd2216327de77a3a9b8dcd2592b4b7e0d43691e20e0db5c5939f261bc5c202d632
SSDEEP 24576:P4R5CIH/7eGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJLj:PabH/JuYScerPrgjI45TMwwapIgT7j
TLSH
T11BC50A2271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 2.6MB
SHA256 ebc3e884320534bad080c522104b60cd14a2fa24f379257ded0061f971e6ad79
MD5 8fc5275e1208e4663c32bc40402f6790
SHA1 c13af99021a69fb59c7bf397db1b644844f0cb03
SHA512 1d12650a4484a1db4970fa82047413397ef06fbdae5ecf5083e74b262d602f5c87359bd4390becfd2c98f54d5c3c5321a6957039e06cf1dfac4760b45d1ddc4a
SSDEEP 24576:P4R5CIH/7tGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJJjv:PabH/UuYScerPrgjI45TMwwapIgT5D
TLSH
T105C51A2271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.xls

Path C:\Windows\SysWOW64\Drivers\2026-07-17_d44dcc2cc17c5c556cc27defc343fe99_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.xls
Size 5KB
SHA256 4fb9bb42df7db6cc64d8f6019016a427fe2241bd331deec9176e14504ddafc8f
MD5 d37c7e760b7d4f7bb58e4510bae38b8d
SHA1 8f0c618960102f25fcfee114336caa4abde55526
SHA512 4f23b3db055f83fd6a4324b17aec59d7223e5c7f70e608a45f83be4379fa9ee898d09464a30124b5b555b25ead0136d98cd858325545ce0eafbff4af24eb805e
SSDEEP 96:R49jdE49jdE49jdE49jdE49jdE49jdE49jdE49jdE49jdE49jdE49jdE49jdE49k:RYEYEYEYEYEYEYEYEYEYEYEYEYEYEYEL
TLSH
T1BAC18C8D903157ED4ACE01354CBE00300300120593DCFB13685EE674766CFCD106880B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 2.5MB
SHA256 681d96ffed7e74d2a0da7d6654f6d976e871e811c44e83c33a21fa7387d5e64f
MD5 69efd99f6ef14b7bb2a92f1020a87342
SHA1 251e37571d343f14187d22f5741199c3c0d64f1c
SHA512 11e52b06d8b9d02782898d59e13fdcf0f43733aa9c4079429f9ce0d21ad8d6f5bbe5597dbf069fcd10ef76b2725f474772c5fd3f81d17b2f15978518551ed24d
SSDEEP 24576:P4R5CIH/7JGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJN:PabH/wuYScerPrgjI45TMwwapIgT9
TLSH
T165C5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.5MB
SHA256 ded9d487a06b4295439bd144f9fa13433b94eedea4a88ff14345214046711f46
MD5 2f8a53508a0a1588081e16f644a237d0
SHA1 c64a70fd7245e86a81aa96e25fcb558455aca1bc
SHA512 b08c764cc99e7ef6cc3f95de3eae4af5a9d7e05b3cb47589844630c52934d8b1ce4e3c2a9926aa6b92df97404ea770d402d7ec48c9df2c925f9d90dcaef2bbbc
SSDEEP 24576:P4R5CIH/7hGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJN:PabH/IuYScerPrgjI45TMwwapIgT9
TLSH
T11BC5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.5MB
SHA256 7ae80e8109da6f1436791380734d851704cc5bef5b1390d906c229803b21700c
MD5 c13649e4587e6234f0915c7960fb0cd8
SHA1 d9a11655d55c08a6a0dfadfa8994b25741a0e450
SHA512 e43f9c7a868f956dd7e29f2db8a1ec8d74984062409b647cff658f0e35f98b4b6c0fe098fffcce330502a65bebc81a4c54b1041a51aae5d6b6b9a7c45cf3f117
SSDEEP 24576:P4R5CIH/7tGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJN:PabH/UuYScerPrgjI45TMwwapIgT9
TLSH
T133C5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.5MB
SHA256 2bfccf2cd5bf3028b7b9fa890ddcc8b3234860970895e7c66e3ba557d1750073
MD5 8214f30320b6e538ba405babdf32ff26
SHA1 98382a5074122b1a28918e7187fbe70c974fe27f
SHA512 a4a33c42884ed4f8db25d643690f0fed9e9b595e0bf4980b7f37b501bfa02f1a55f63b2865ab6b7357eda282e47d2634740b6514ecac82a19afc7eb658faf389
SSDEEP 24576:P4R5CIH/7OGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJN:PabH/5uYScerPrgjI45TMwwapIgT9
TLSH
T118C5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.5MB
SHA256 105f9ef4075d18bbda5ae009ae8603cc0a186cbf4aa40a9656d6b9045e650598
MD5 ee452761b6d3bc9dcd42d99fbc182072
SHA1 177a603e3e1d7b9aeb21425ebdac4877306b431d
SHA512 cfcf2a0a178a371bdad4b4fbc128a83007bd82f498054fa66cad7d72bce11975155c75ad9742c7854ea03e61923d5c8edd25a80600a443ecf10e4219b2c7bb2c
SSDEEP 24576:P4R5CIH/7VGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJN:PabH/cuYScerPrgjI45TMwwapIgT9
TLSH
T112C5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.5MB
SHA256 48f931ca7ac492a9e54b98e339630bfade3664e5ee9e096b1b7e16fc9f79b626
MD5 3ccc969ec60e82bcf3fb85e64f454760
SHA1 3eb52171a18efd61165692c3710ae3a9ccb93256
SHA512 47d60bb77358096f3db7d71fe8734fb2ddec470ee34f8de5368fc841069f4eaddcfbf3548007f82e241521d388aace10e25faa114c47955433f95c1fe2b9f770
SSDEEP 24576:P4R5CIH/7GGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJN:PabH/RuYScerPrgjI45TMwwapIgT9
TLSH
T1CAC5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.5MB
SHA256 ca32a6115a89ddf102a25474b0a1bc6db8f0ee18a0668680261c43e28171120c
MD5 335b5c33cbd6dd6065fb7bb1c225d6de
SHA1 4c56d55b1ce2b523a2c20b2c8b5042e590174634
SHA512 eac1569fec23722811d58fa23a5e95e5147eb53c002119ee2c7ded4ab49fd6a9e3a07c36e993c404e42700ff25834f2ddb4a0ddef73dff30d47fb0ff5ecc78c8
SSDEEP 24576:P4R5CIH/7VGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJN:PabH/cuYScerPrgjI45TMwwapIgT9
TLSH
T125C5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.5MB
SHA256 821309011f950cf060aa0789bee4208973c157ff682835bd0c30bdba4ee303b7
MD5 a5e47de6f7660a88e264754e2279b499
SHA1 573ced2acbd874ae3cfd298d2322d27f3544c345
SHA512 0ef1b8ad48d84433b0f58fa9b9d115d7f4c9b46760b7c2ba7d856d03788ef29a9b88e6af9bb29c84fce59cd39e2e279fb5bf9e952b5b71fc4e8cea2a851535a6
SSDEEP 24576:P4R5CIH/7UGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJN:PabH/7uYScerPrgjI45TMwwapIgT9
TLSH
T1A5C5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.5MB
SHA256 be65740b775f8c0e93ca4151a9a9e1b0ac905e11791944d9b3404e964b31131a
MD5 6953f7291106fed824c7e34f90dc54cc
SHA1 bb97471cb2eec8107f1e13333148b6267f40970b
SHA512 4020eaab7c3b0eef286f630a25af15e1433a19bb8e819bca88df18023c0c677e40766a6583d99303f8ab435592ffd6051bc89f93f1aa1a48e2c09f9223eabaf2
SSDEEP 24576:P4R5CIH/7eGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJN:PabH/JuYScerPrgjI45TMwwapIgT9
TLSH
T177C5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.5MB
SHA256 bc386b13751fc1c60a8ee27cb54f37b7b444bbfdabf952175a1d2348d9fda455
MD5 436a1da688677f88580827ad7265e45a
SHA1 952463a9268ec55ea9a587c98723eee14c15307f
SHA512 ad2c0ba9a146d0f86ba2f4921ee9ef13cc9a3d315cda09e3120d69179254129d86f0092bed09dae2c1a8e825630de7480b10c6557bb95eb27a41db3af0556c4b
SSDEEP 24576:P4R5CIH/7tGu20GfLhcuQLRsverPEGgjI45bl9Mbonwap41+zzPTThwv3EJN:PabH/UuYScerPrgjI45TMwwapIgT9
TLSH
T1FAC5092271A2045AF559D972CF16A724A7D13C698FF183EFF10972C92B725F03A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1852-173-0x000001E767230000-0x000001E767500000-memory.dmp

Download

memory/1852-251-0x000001E766FA0000-0x000001E767223000-memory.dmp

Download

memory/1852-43-0x00007FFE49C80000-0x00007FFE49C90000-memory.dmp

Download

memory/1852-172-0x000001E766FA0000-0x000001E767223000-memory.dmp

Download

memory/1852-42-0x00007FFE49C80000-0x00007FFE49C90000-memory.dmp

Download

memory/1852-44-0x00007FFE49C80000-0x00007FFE49C90000-memory.dmp

Download

memory/1852-46-0x00007FFE49C80000-0x00007FFE49C90000-memory.dmp

Download

memory/1852-47-0x00007FFE47380000-0x00007FFE47390000-memory.dmp

Download

memory/1852-48-0x00007FFE47380000-0x00007FFE47390000-memory.dmp

Download

memory/1852-117-0x000001E767230000-0x000001E767500000-memory.dmp

Download

memory/1852-116-0x000001E766FA0000-0x000001E767223000-memory.dmp

Download

memory/1852-45-0x00007FFE49C80000-0x00007FFE49C90000-memory.dmp

Download

memory/1852-281-0x000001E766FA0000-0x000001E767223000-memory.dmp

Download

memory/1852-291-0x000001E766FA0000-0x000001E767223000-memory.dmp

Download

memory/1852-292-0x000001E767230000-0x000001E767500000-memory.dmp

Download

memory/1852-305-0x000001E766FA0000-0x000001E767223000-memory.dmp

Download

memory/1852-306-0x000001E767230000-0x000001E767500000-memory.dmp

Download

memory/1852-314-0x000001E766FA0000-0x000001E767223000-memory.dmp

Download

memory/1852-328-0x000001E766FA0000-0x000001E767223000-memory.dmp

Download

memory/1852-329-0x000001E767230000-0x000001E767500000-memory.dmp

Download

memory/1852-344-0x000001E767230000-0x000001E767500000-memory.dmp

Download

memory/1852-449-0x000001E767230000-0x000001E767500000-memory.dmp

Download

memory/1852-448-0x000001E766FA0000-0x000001E767223000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads