Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/07/2026, 00:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_a2989e237c4394645cb34777206a4bd6_amadey_cloudeye_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-19_a2989e237c4394645cb34777206a4bd6_amadey_cloudeye_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
- Size 2.3MB
- Sample260720-a78jcads21
- SHA256 d15bfb7b7819f180fffe9424d55870925ff395fc2ffe64f8e23eec4956f3230b
- MD5 a2989e237c4394645cb34777206a4bd6
- SHA1 77a4fd12282b51a705b2ce8809633ca5582df1f0
- SHA512 bbab63a8fc9c47338c30c36f6de4742cf38ffccdac9b4aafd76bce219bd0c437790947b71ac7798d380b2833e3c2a3650fb2bc7b15bdcf0a663be2633c3d4437
- SSDEEP 49152:wabH/OYabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQT+9TI:dC1Cb28807
- TLSH T167B57D21B780D866E866897078B9C6166B35BDB11B90C97B7385B74C1E33393B8B430F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4024 UpdatAuto.exe 728 2026-07-19_a2989e237c4394645cb34777206a4bd6_amadey_cloudeye_elex_hijackloader_icedid_luca-stealer_njrat_vidar~4.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\Option.bat 2026-07-19_a2989e237c4394645cb34777206a4bd6_amadey_cloudeye_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\UpdatAuto.exe 2026-07-19_a2989e237c4394645cb34777206a4bd6_amadey_cloudeye_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\Option.bat UpdatAuto.exe File opened for modification C:\Windows\SysWOW64\UpdatAuto.exe UpdatAuto.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe UpdatAuto.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe UpdatAuto.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe UpdatAuto.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe UpdatAuto.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe UpdatAuto.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe UpdatAuto.exe File opened for modification C:\Program Files\7-Zip\7zG.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe UpdatAuto.exe File opened for modification C:\Program Files\7-Zip\7z.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe UpdatAuto.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe UpdatAuto.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe UpdatAuto.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe UpdatAuto.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe UpdatAuto.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe UpdatAuto.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe UpdatAuto.exe File opened for modification C:\Program Files\dotnet\dotnet.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe UpdatAuto.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4644 cmd.exe 1356 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_a2989e237c4394645cb34777206a4bd6_amadey_cloudeye_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UpdatAuto.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_a2989e237c4394645cb34777206a4bd6_amadey_cloudeye_elex_hijackloader_icedid_luca-stealer_njrat_vidar~4.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1472 2026-07-19_a2989e237c4394645cb34777206a4bd6_amadey_cloudeye_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe 4024 UpdatAuto.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1472 wrote to memory of 4644 1472 2026-07-19_a2989e237c4394645cb34777206a4bd6_amadey_cloudeye_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe 85 PID 1472 wrote to memory of 4024 1472 2026-07-19_a2989e237c4394645cb34777206a4bd6_amadey_cloudeye_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe 87 PID 4024 wrote to memory of 1356 4024 UpdatAuto.exe 88 PID 1472 wrote to memory of 728 1472 2026-07-19_a2989e237c4394645cb34777206a4bd6_amadey_cloudeye_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_a2989e237c4394645cb34777206a4bd6_amadey_cloudeye_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_a2989e237c4394645cb34777206a4bd6_amadey_cloudeye_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4644
-
-
C:\Windows\SysWOW64\UpdatAuto.exeC:\Windows\system32\UpdatAuto.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1356
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_a2989e237c4394645cb34777206a4bd6_amadey_cloudeye_elex_hijackloader_icedid_luca-stealer_njrat_vidar~4.exe2026-07-19_a2989e237c4394645cb34777206a4bd6_amadey_cloudeye_elex_hijackloader_icedid_luca-stealer_njrat_vidar~4.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:728
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-07-19_a2989e237c4394645cb34777206a4bd6_amadey_cloudeye_elex_hijackloader_icedid_luca-stealer_njrat_vidar~4.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-19_a2989e237c4394645cb34777206a4bd6_amadey_cloudeye_elex_hijackloader_icedid_luca-stealer_njrat_vidar~4.exe
- Size 140KB
- SHA256 ba9244cca178edcb3247993c7211e884cbab9d034c5ed7f155f9db5dc3a8574e
- MD5 ac4d1d9148d342baeb0dbc30697e642e
- SHA1 3860f8f2ebae1e9c58a4f6f0c27c5467031ce526
- SHA512 b1ec1a69c6d52bccb3d4c698ac0d0d3a23d8b5cefdc6fa3b4748998a0326b068522d5e28173d9b66d1f77e277ad6e0f4689ca30b13cd14accdbc68caf8746390
- SSDEEP 3072:1JEXiJu7COG12zuf9AxnPKiadKSUoxzWCtnRPF9EVnb43jaI5grI2v0:0K9J2JPT/SUxCtnRPF9cCGrI2v
- TLSH T1F7E3AF13BAC1D475F671083428769A91CA3FFC815F615EAB3B98357A4F342C09932EA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Option.bat
- Size 53B
- SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
- MD5 1d04abf39e9df55eed1d04430cc21eb8
- SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
- SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
- TLSH T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\UpdatAuto.exe
- Size 2.2MB
- SHA256 3bbbd4ec5343917251b688576a3c1ebb8b2fab75b14eb15175a390b37b888a8a
- MD5 714992e5eb3202ab0ca956efe1b41b1b
- SHA1 8812f2769d21fe08b03970c837ce213fdc209569
- SHA512 81eb497ed2163c8d6c58a67df26f6c5eafd36e4b58ff7b8ebdbc73f430f7460cdb9565179c9150ee9702431e31d7333c200c41989b4bb33a031e0261f233fade
- SSDEEP 49152:wabH/OYabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTU:dC1Cb2880L
- TLSH T1A5B57D11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
- MD5 SHA1 SHA512 SSDEEP TLSH