47ead43c943df27136c6da0b085fb9c5a92f141734ab1252bd0149fb40eea1c1

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
Size 243KB
Sample260719-2hheeag18x
SHA256 47ead43c943df27136c6da0b085fb9c5a92f141734ab1252bd0149fb40eea1c1
MD5 593ce7da79a46a50238f75106f2c3288
SHA1 7c06d8cff52c0f5be7a5294ddd364e8eb5749705
SHA512 d62b096353ad5410607bdf16dd243b810571fe54ff42a1a4e94eae0dec549ae5c98a117c2287d5f7d967a9e74dad347d45a33f3c5e852d500052825a4627e357
SSDEEP 3072:ACSjGoLpWM6VbBgjxzxi3MpskoaZzgXftbxm3sHLzJUIioULXV/JVs6MXL+:2Xq1gbi3VueUcHLWIn6aS
TLSH
T12A346B1B729C37F6E0F285788D1DB586EF357C300B2586AF22A8072D5F672819D2DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (256) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 3 IoCs

pid	Process
4604	Logo1_.exe
1476	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1232	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe.Exe	Logo1_.exe
File created	C:\Program Files\7-Zip\7zG.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\RCXC993.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCXBDDA.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe.Exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\RCXC6D1.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXC60D.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXC740.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXC9C6.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCXBDC9.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe
File created	C:\Windows\uninstall\rundl132.exe	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
File created	C:\Windows\Logo1_.exe	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4800	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe
4604	Logo1_.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 5388	1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe	89
PID 5388 wrote to memory of 1720	5388	net.exe	91
PID 1504 wrote to memory of 4800	1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe	92
PID 1504 wrote to memory of 4604	1504	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe	94
PID 4604 wrote to memory of 852	4604	Logo1_.exe	95
PID 852 wrote to memory of 2112	852	net.exe	97
PID 4800 wrote to memory of 1476	4800	cmd.exe	98
PID 1476 wrote to memory of 4660	1476	2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe	99
PID 4604 wrote to memory of 4672	4604	Logo1_.exe	102
PID 4672 wrote to memory of 2084	4672	net.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5388
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B2D.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Users\Admin\AppData\Local\Temp\2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Program Files\Java\jdk-1.8\bin\java.exe
      "C:\Program Files\Java\jdk-1.8\bin\java.exe" -Xmx256M "-Djavafx.home=C:\Users\Admin\AppData\Local\Temp" -classpath "C:\Users\Admin\AppData\Local\Temp\..\lib\ant-javafx.jar;" com.sun.javafx.tools.packager.Main
      4⤵
      PID:4660
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:852
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2112
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2084

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXC61E.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXC61E.tmp
Size 94KB
SHA256 b6db153f74e724258b8173fbae7a465667f44db18e62afca6e7c45ee83ba7a62
MD5 ba02bfe0002c581036b4904c5a67e5ff
SHA1 649aa8c38a4b4371859da0a6342ed829e2b21f83
SHA512 f6c67ef66a77020b8aaae0844c0ff2bc11e5a33f60c99b62ea289540455597496248356d3fd90313181a79091b8a752ce4c475a1c82667bdd381829f35805f43
SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxw8m3G5QGPML7ND:ACSjGoLpWM6VbBgjxwxi3Mvp
TLSH
T194932A5AB28CB376C0F199BC8E0FF2E5AD757E201E2D089BB1992F0DDE7A1C1591C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC8CF.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXC8CF.tmp
Size 103KB
SHA256 6f8c53553a053b425b1c15dfb2fea7563c89495018ccd1ac716075097127ca02
MD5 38e90e2a9d01a6be0e830c7de0a37465
SHA1 8a84e8f07470be07ac1b61845b469ec5db871c84
SHA512 bf96086bd4f2b87d61fb4d9bacb9c3dac89b91b417209621bd62d0d5b7861d8b51be87aaffd20e3d80e84d39f323c91117ebc60ea47a532bcdd4a3c0e6cd9b52
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxp8m3G5QGPMLM1XkSPsULMHipNQ:YCSjGoLpWM6VbBgjxpxi3MAdtPlLqMu
TLSH
T169A37C1AB28DB776C0F199BC8E0DF2E5BD397D200F2A182BB19D1F0D9A775C2590C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC760.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXC760.tmp
Size 118KB
SHA256 b2f0a03347f7731c37955767fbb9c7c641f493bb4906fc64611d8d7e7fb1e425
MD5 2721d937c0a9ae0989ffae1b5a421d1f
SHA1 80368bb47a21c37cc7c26c7ee833d9b279910062
SHA512 359ca6c054bd3b03d02b6403a0abdf6676b6f33505cf19a7147790858084e9b9117d6d04e253ffa81da0058ddb48e4dd718667ad618507f20f4a72e2cfda8fed
SSDEEP 1536:M7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxz8m3G5QGPMLx4GZjzQwK5WW7VCr:FCSjGoLpWM6VbBgjxzxi3Mje5BV0LH
TLSH
T1E0C39E5AB28CB377C0F199B88E0DF2E5BD797E201E2D085BB5992F0DCA7B5C1590C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXCAE5.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXCAE5.tmp
Size 100KB
SHA256 495a563ba550acf5589cb0a83aaae36425bf72afff581d52b9445133aa00a521
MD5 03125cdf5798207eb17d54e5d75df99d
SHA1 e7c3747e3dd9cc7e07dd6448d9438d41a5c20d3e
SHA512 ea5843ee92edc0d4b82d5a240b4d3eb0a602c9aae9b9856e1fe62833624fec156bf39aaa614f15b533d4a9206590924a1c3201cadff26a1cb6e7203bf867fb25
SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxO8m3G5QGPMLeqkSZZZ34Nj:4CSjGoLpWM6VbBgjxOxi3M0U4J
TLSH
T1E9A36B1AB68CB3B6D0F189B88E0DF3E5BD357D300E69181BB29D3B0D9A771C2551C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB8E8.tmp

Path C:\Program Files\7-Zip\RCXB8E8.tmp
Size 91KB
SHA256 ff80e7b5717f02901f7642e1b12b633873f2b09a65f114bbdc5e96ab64dd96d4
MD5 30e25485f995c6ea22da3b2dd4b791e2
SHA1 289f0fa0dbb49dca3a7a87680a8aa8f1c6cd7ea0
SHA512 03e3ff3e44746433d25a61287ffd58575f4557487f9c6ea09ae18f2ec6ebd1a5efc95f29092fe1c9e4d392ffc2d56e8d1661191e60acceaabb838c21c98ed2cb
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxo8m3G5QGPMLENb:oCSjGoLpWM6VbBgjxoxi3MIB
TLSH
T1CC934B5AB28CB376D0F199B88E0DF2E5BD793E301E29185FB19D2F0D9A7B1C1590C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXBA76.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCXBA76.tmp
Size 92KB
SHA256 c99dd42c90365645c3c3cb7fbac5aea393bd55aad9e1a477b3b8abd580b44c5f
MD5 2ba8f1af2e14a221e10dcd378c5d723d
SHA1 5e3563969c69f76734132c03349f33f123669a5f
SHA512 5865830cd2ba9e02f3e33ef875d39d970aaf08ded92d3d51d0860f607024f7951ee381e11f00e10d114573644a02671ab1e2b0ebac8653462c8c57887a9e279f
SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxQ8m3G5QGPMLJNL:wCSjGoLpWM6VbBgjxQxi3MFx
TLSH
T138934C5AB28CB776C0F199B88E0DF2E5BD757E301E29086BB1AD3F0D997B1C1590C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe.Exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe
Size 4.3MB
SHA256 bd4e5a3c6deef5a247fe55eb7212333a3e20b104ee6696189c13a4c3c6f093bf
MD5 4b5224d42e0d2fe70ae7e75ea1846ee5
SHA1 9d5186c5343cad4aadffc97b30e3b041c53fd808
SHA512 15f7d79dc9d38965cd87720338fc126d881ec1c8be0d25786d030989208f03f3d7f65f5c61e573fc43150d8408bb645c29d8928f3911a80dc40cd6459ae9c681
SSDEEP 49152:IoQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3Tf:ZQvGAdlCEL8c/bRNw5CO
TLSH
T156263A656BEC91F5E0E7D134897A95B2FB7A7C020D32EB4B0151CA2F2F336904D29729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXBD78.tmp

Path C:\Program Files\Mozilla Firefox\RCXBD78.tmp
Size 91KB
SHA256 bb193edd9e39d9b23db1d83734e90ba6f80066dc8b9c9378c4bd445b237351b2
MD5 17884c941e886916373894a6274d60a8
SHA1 01c690c86b62906ed149978d73cf79e70db92b27
SHA512 09fd096b0fd32f9a51f1a885acec31afbc3704bfb5bb868228f96320c91a7ab809c0a72364626fe32c03587775b895a3f8994e1658f134a335f8161a8961e993
SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxI8m3G5QGPMLyNL:wCSjGoLpWM6VbBgjxIxi3MGx
TLSH
T1D1933B5AB28CB776C0F1A9B88E0DF2E5BD697E300E2D185BB19D1F0DD97B1C1590C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXCFAA.tmp

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXCFAA.tmp
Size 92KB
SHA256 73a0242dae570489f10913a751988b95af7a6ab769ebdca2bec2cb9bbedeb775
MD5 5b16bc3ff67b9e4e005af1efc2b5f3ed
SHA1 a983e98a420df120e3341b9513d0064714c3ee26
SHA512 c21967ab6bfe6bb8277fc5caeb48e2d0e309b3e07451f07e2df54b0068fbf3392152556fc7be37d48b3c649896aeca46240e6ad0fb974079cbff233308a3acb9
SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxw8m3G5QGPMLCZND:4CSjGoLpWM6VbBgjxwxi3MWZp
TLSH
T168934B6AF28CB776C0F199B88E0DF2E5BC397D204E2D186B719D2F0D9A7B5C1590C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a2B2D.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a2B2D.bat
Size 740B
SHA256 36ae3bb83b9d4690ed0583f7d3cfa6c9bc9cb44c657a29681077d22e44a867b1
MD5 dcdea017806771dbfbef5c49bb2e8118
SHA1 f4660fb33fb926447791ed156c556d25cdb7728b
SHA512 5c82a9861c2c300879f3e66347364af012eed67e043446ad306ee5aee92329434d9aa31a3f363438cbe1bd33f8a22d5ddfe0172a71576f1d9bd1e91735efbfe8
TLSH
T182018D75C2AFDADD4A24302309FE4E9DC453792A6FA92325AB3DCCD922C141EBCD6750
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-19_593ce7da79a46a50238f75106f2c3288_elex_icedid_njrat_vidar.exe.exe
Size 150KB
SHA256 683d32841b590f543e6d3c2e34a722cb18090383d6e568348112639cbc79662c
MD5 3e9adb734aa6ad45fddeb270cc9a3f18
SHA1 a3d1f88f5f8a8d1ada0ca2f2ceb8662603ca484f
SHA512 b7129d8e642ed0b9e3928b40cc99bb17f4b0d6bcef162710b7f7dc2e390be37273cafb454804b11716ca8b30ceabe803db163f4786f7b99b5c7c636052054b52
SSDEEP 3072:6koaZzgXftbxm3sHLzJUIioULXV/JVs6MXL+:6ueUcHLWIn6aS
TLSH
T180E37B5B73A534F9E0778578C8911A46E77278361721CBAF03A4427A2F67291DE3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 371a012300b83f88e4497daab7ae04baaa8fa1b230a79d8ef9d74a22e27412f2
MD5 ac9f3a2d110ffd0bbae54d66b3263c10
SHA1 bb646fec6331d83465caf7136324497aeed993e3
SHA512 d768808f60ea0179a0a6ea6d3b303a620723746f064ad21729f0bde482c7cc9f5c039a6019e4f9357d0e3ce9d9f8cf9c97525c3b06140ca39e120074109fe605
SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxz8m3G5QGPMLlN3:ACSjGoLpWM6VbBgjxzxi3Mpl
TLSH
T1E2935B5AB29CB376D0F299B88E0DF2E5BD793D301E29086FB19D1F0D9A771C1590C292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1232-29-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1504-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4604-34-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4604-1096-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4604-1270-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4660-18-0x00000285B4210000-0x00000285B4480000-memory.dmp

Download

memory/4660-32-0x00000285B4210000-0x00000285B4480000-memory.dmp

Download

memory/4660-31-0x00000285B2910000-0x00000285B2911000-memory.dmp

Download