4796b4a18e17674c90e09d69b434287e319c5092fdd7e6af8be644dae3108bd3

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
Size 2.3MB
Sample260720-b83j6aev6w
SHA256 4796b4a18e17674c90e09d69b434287e319c5092fdd7e6af8be644dae3108bd3
MD5 15fba6b5902c34ee71e24ea28d586a7d
SHA1 a7275c109ce25ffcb8f035b9670b547175c6a60c
SHA512 5568037660eeeec5f145fe728458979d3966a14692783c49d85f1a05a7d79bf5d65ce23792efda5faed57a32f9acdc490f3a068d7e55a7b082e08815a10b7bc3
SSDEEP 49152:wabH/NYabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTN+Y:+C1Cb2880PY
TLSH
T1BAB57D11B740AC66E866897078B8C6166B35BDB11B90C97B7396B74C1E33393B8B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
5056	UpdatAuto.exe
3548	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar~4.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3316	sc.exe
5204	sc.exe
2468	sc.exe
5828	sc.exe
4704	sc.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2624	cmd.exe
4324	cmd.exe
476	cmd.exe
3940	cmd.exe
2724	cmd.exe
5948	cmd.exe
5264	cmd.exe
1180	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3304	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
5056	UpdatAuto.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 5264	3304	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe	88
PID 3304 wrote to memory of 5056	3304	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe	91
PID 5056 wrote to memory of 1180	5056	UpdatAuto.exe	92
PID 3304 wrote to memory of 3548	3304	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 3304 wrote to memory of 1496	3304	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe	95
PID 3304 wrote to memory of 5948	3304	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe	96
PID 3304 wrote to memory of 2724	3304	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe	97
PID 3304 wrote to memory of 3940	3304	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe	98
PID 3304 wrote to memory of 476	3304	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe	99
PID 3304 wrote to memory of 4324	3304	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe	100
PID 3304 wrote to memory of 2624	3304	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe	101
PID 3304 wrote to memory of 4704	3304	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe	102
PID 3304 wrote to memory of 5828	3304	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe	103
PID 3304 wrote to memory of 2468	3304	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe	104
PID 3304 wrote to memory of 5204	3304	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe	105
PID 3304 wrote to memory of 3316	3304	2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe	106
PID 3940 wrote to memory of 2788	3940	cmd.exe	119
PID 1496 wrote to memory of 4856	1496	cmd.exe	120
PID 4856 wrote to memory of 5260	4856	net.exe	121
PID 2788 wrote to memory of 760	2788	net.exe	122
PID 2624 wrote to memory of 4644	2624	cmd.exe	123
PID 476 wrote to memory of 488	476	cmd.exe	124
PID 4644 wrote to memory of 4712	4644	net.exe	125
PID 488 wrote to memory of 5892	488	net.exe	126
PID 4324 wrote to memory of 1924	4324	cmd.exe	127
PID 2724 wrote to memory of 1164	2724	cmd.exe	128
PID 5948 wrote to memory of 3508	5948	cmd.exe	129
PID 1924 wrote to memory of 5456	1924	net.exe	130
PID 1164 wrote to memory of 4504	1164	net.exe	131
PID 3508 wrote to memory of 5812	3508	net.exe	132

C:\Users\Admin\AppData\Local\Temp\2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5264
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1180
- C:\Users\Admin\AppData\Local\Temp\2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar~4.exe
  2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:5260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:5812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:476
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:5892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:5456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:4712
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4704
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5828
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2468
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5204
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.7MB
SHA256 98dd8aba8df75dd5c20a7352489c75a666144f32e182bf7329d2693d83acc499
MD5 845709c5b260accde0240794fb1d3891
SHA1 b9606f5a294c92cbc734c916946bea3c1046bfeb
SHA512 8c7c98e2e1b59c11f99710adb3a6ba58c8c4d5841c901de729b6e5b9d36570d42645446cfee4bf320c8c35246f448d5a29fe4829c2cfc19272b678977c3365e7
SSDEEP 49152:wabH/yYabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQT1Pji0Aj:pC1Cb2880wjo
TLSH
T160D58D21F7508932E477C470A8A5D70AAB317DA11B60C9BB6386B75C2E337D3A97431B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 3.1MB
SHA256 85bf8104df38b9178f8c8f0133531e8cde5bfb27f83d7f6f09753bc9d1119a11
MD5 e8879842633e2288ab2882a0837f344c
SHA1 1c1ab7943ae5e0fc73a225acfce73b677800adc2
SHA512 60415d9ea443e3da7190646a151d3a27ec33e2df0cb3d695afc9e699a12b51f0cd3e08ea0b3576c78e372d4201716ec0bd6c4c1c53aaecd44e4a3973e71e21e3
SSDEEP 49152:wabH/yYabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTS/ezSC6vUzPvMHjy:pC1Cb2880VezSC6v2XMH
TLSH
T13EE56C11F6648623D4B7C471E8E5961ABE317C921B20C9BB2346B75C2E337E2A53532F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.9MB
SHA256 51d15ea348ea276471f5f186bf16f6c1aaa2e3b4f1b03c21a3109bb832768f84
MD5 3a518334384f4c7ef0d8b56fd9c72758
SHA1 8a64b54a8ba24bc714c3a9fbd795223753a4e0bd
SHA512 e87436f23a91071d1204cc6986022068f05a8405c1a48938e26e2454a29f29d8d72539ed2cd6d462d59d192dcca87c64a5174192e3322c9ff74b2b4e3ead74de
SSDEEP 49152:wabH/nYabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTBVO88hXl+:YC1Cb2880V/h1+
TLSH
T140D58D21F750C522E477C470E8E5C61AAB317CA11B60C9BB6386B75C2E337D2A97532B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 2.2MB
SHA256 04329f0abba56dda4780c8f2b81435f62c447039b6fe4119fe46ab802f48170f
MD5 e1175ebbc362186e6b72e4d2e6148318
SHA1 4e22f642a65f622bb8323156e1fd53e5b8dd5b1c
SHA512 c400272a7df7450e13f0b5d420fbabc4866eb25817e643daf764f0b38cf25032c3c6eb1032774afea47c80cd21347aca6aeb2a57b8785ad8682f4a0b25043add
SSDEEP 49152:wabH/yYabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQT:pC1Cb2880
TLSH
T15FB57C11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 8.2MB
SHA256 46fcf6291aaa28cc48d1d909d899320f59fbb8a3f53fa596875e3d734213bccd
MD5 3fa6553023a01867bfd8822e8afb6271
SHA1 29127a577e7a6218045c7829d65feb78c4e0b35f
SHA512 2e3f56d84d12c2db496b23d05f4455f06824a673bda7479760419a61b628b584a5263bf94f090320cfccba80cbe5bddfdf75331cafe5d199331f4381c927b430
SSDEEP 98304:hC1Cb2880gQRQyi36YOcP+Lvw2gAf+PN34:Asb2XUQyiKaUX+PNo
TLSH
T19A968F13F3A441A5E05EC970DE3996229B357C5A4BB0D2FF229437E51E72AD07B38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.9MB
SHA256 ff96e64a3f2b17ad6ee7358085b67e64609f3082f363b559e76a4b98b52f7ecd
MD5 9e8367f75bf8d15ee72bf18260da1ea7
SHA1 070407d73440598ae4bd27327120929408e4ea78
SHA512 4c5b0cf50df147c28ca3a64afc1bf25109cae1d3ab922e67823b953ef1a134852e49eb882988091df4ac8fef32c298fb235a8088d53709860ab3a4e8c08230fc
SSDEEP 49152:wabH/6YabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTw68Qg55nhoeWu7PNUI:hC1Cb2880LthHRc/Q
TLSH
T19C165A23B2E140A5D45EC471AF668722A6E1BCB18FA0D7EB934173491F726D17A3930F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 5.7MB
SHA256 6b2112ebc007e2623ec2a4df7f230f3ad00d81901f0f3aa964097d45a94b1110
MD5 446a28873f5da4142b58b10d1a864c9c
SHA1 2d7b141598dbc6c3323979fda34fade23955e4f8
SHA512 d82100f7271aed3567c8639d6794ad32bf14a987fb47126e26c789a84d7436a56c5a7e4da8113973adf6020a0bfc44791318bcd47751250d978cdb51aea7ab6a
SSDEEP 98304:hC1Cb28802y5112gYy5azzVvf69nLKnhZO:Asb2X2LIHuWhs
TLSH
T159569D13F29440E9D05EC574AB5A8222FA71BC920B20E6EF175077592F73BE1AB3D316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 4.5MB
SHA256 a5f652ec03cbca1164d6143f54c46796d6bcfd387a8020cf6a1facfc65914930
MD5 0039ef488f7ccebf8acc654f9716a1a6
SHA1 206905a70e4a606b7c18d9013719c296f93d833d
SHA512 2c889dbba27c7582796b4111cfddc6358a0c508c6fab7d0bb9a2c2fc0add008372740dfee404d38289dd68b75639d92f88f5a45589efe5de6a0304cdf682ea42
SSDEEP 49152:wabH/6YabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQT1B+taZ3usBWOBr4tEg:hC1Cb28808u6Jm0xd2d3
TLSH
T1B126AE13F78040E5D06AC4706A69D623FA31BC651B20E6FF1791B3592E73BE1AA78317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 3.8MB
SHA256 7afc984c753f3e4a357158c66bde690e04250e00c69902e809a8152744a2c0f4
MD5 3ad42fd4d975f07c00628e909e233db2
SHA1 71d6cea1580fc8ac9e3a8a65c5be6bba74a4dd37
SHA512 367b0f3108935967035a93679d320d22e074e6c6261463b93c0f1de66ffb50fe60e79e028671d4110845ad095927c1e03cd51b28a9d228e7b9ccbc6c3fde93a3
SSDEEP 49152:wabH/6YabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTt1hpsNoJpF1A6GU44J:hC1Cb2880QmifP5R7
TLSH
T17C069E13F38084E5D46AC570A965C626BB31BCA50B60D6FF2381B74D1E73BE16A7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 5.3MB
SHA256 5e0564a0295a7cabcc7544e412cc050df0c026999de47d9f65765d6124b33ddc
MD5 cc2a12517c5836267328da586346501f
SHA1 d88f1bad88f6a93a301ec82d508cc6065dd11ba7
SHA512 19eef14be512a29f6f4724e047dc8a8c19d5e187c5daf7ad3db84d4b758d05918b59277c3366799fe86c51a8daad45d6ff585fe7ff704c6926dd9e7bbb158f82
SSDEEP 49152:wabH/6YabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTlyLSrJhMeJNvjLAE3a:hC1Cb2880Jm7vj1BDlZG
TLSH
T153469E13F39480E5D05AC470A665C632EA31BCA50B20D6FF2790B7592F73BE16B7931A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 3.6MB
SHA256 140c2c84fee78d2bf9ecebbebc3903473bb300db3dd269ea60f8b768842640c8
MD5 bbb7cf659378aeafb5ad789f36763f9c
SHA1 4161555edbe58bb7d697170f5d7b76eb048e37e5
SHA512 3d2bdb6c72c75b6096542886dcffa0d6db75d60042d7920bafdfdab1a9b6e74b456340c901e54c6fe56b2534414e649860afa942698bbb6e0340e7317310a84d
SSDEEP 49152:wabH/6YabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTmhtSn8EApI0fig1gi3:hC1Cb2880qX2iwphX
TLSH
T1D2069E13F78084E5D46AC570A965C627AB31BCA10B60DAFF2391B74D1E337E16A7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 2.2MB
SHA256 0ee08cb7af8dde858ad2db45ca9dc1d193633601dba27b1cbf262db68ee909c9
MD5 a574f053f5192720a03aec22ab07bf5a
SHA1 af09c7bc83b28d161c3a54e7fc1390bcdd114973
SHA512 004bd7f13412285a2f65c1caf52a2420825a21297907b6522968d83e6c8a4507ba24b99f616a1be3e51ff7ab3ec79c76ee553a23e2df1cc4a8e6f3d2ada6124c
SSDEEP 49152:wabH/2YabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTa:VC1Cb2880T
TLSH
T1CAB57D11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 2.2MB
SHA256 092f548d0e36edf208bc4b18b0a6283a8a8d56c0ab1d25b913db0a26f9ae42a7
MD5 8d60c9d4a8ce09c9cedd7f891bd7671f
SHA1 971f5f7c2bd01d20c911690bd619bc10a40f0cb3
SHA512 f9cd7717c9261d0ed338b5a41f1a4d88eddfb9c01508f3452b53f69484e6a20ed2cbc39220c0953f391e674d0845e90b4ffe50b03487d2f4b23f7bee64356776
SSDEEP 49152:wabH/2YabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQT2:VC1Cb2880T
TLSH
T119B57D11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 2.2MB
SHA256 35b5a68f6e873bd729abada9bb1b32af793016fce980b7a7308d2a6eb3936512
MD5 89cca0441559f233f6679fe0bd0e1f6c
SHA1 95ee86533a64caa5d91852ada36392b203630caf
SHA512 95c1216f9c442c279f51480b8a288eda9fa1651fe39555008152c2f8b0e55ff938e1aeeea3691c92e1dcdc54536621a40b4385632cddef9de62c1f2b6d137464
SSDEEP 49152:wabH/2YabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTh:VC1Cb2880U
TLSH
T175B57D11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 2.2MB
SHA256 a2adca6ce02b15e520d68376fb1bf9ca31f43a5faed4f7c69987fb4d2488d073
MD5 0fdb82fddb10a399dd018f93485516e4
SHA1 3a44c895ce7cd22d3ae96c11880fcb41f32d9787
SHA512 9cb11f4a70c5058d5de9a9d3933ed1e1af1d56ff3ed53e9af5f4d7cb962b55636d26b6f9f28530c28dd70e051d476f92bc12595ecab7c44faf82f1e63f4147eb
SSDEEP 49152:wabH/GYabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTU:lC1Cb2880F
TLSH
T1C0B57D11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 2.2MB
SHA256 8a8bc99701b721f0de657bb6e52e51bc10caecc617a89753833e5cb8c5d1801c
MD5 343740a69bf6da27b69d81772a121515
SHA1 60d3e314b6b6bc3af35bab553f241dd7f31af172
SHA512 b088fa9adb637cd488b762f538ad729312053bf4c0960fb2f18d8ac1c723bcae372f0b5dc6c2a0ac8c2cd74be0de43db691f4b320ff7b10a6a0221e96ee38316
SSDEEP 49152:wabH/2YabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTh:VC1Cb2880Q
TLSH
T133B57D11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 2.2MB
SHA256 b7fd4be87c02e4f9d68c6cdf90d4f5a684b69c119c318fc110731bf71352494a
MD5 585bdd5720dc1642c8936549308a9cc3
SHA1 ab59555292ef50a71eed08421e966250e345d171
SHA512 bd649c5abd584c80e2e90116c47b27d336940c5ba314b9573ecf33a474bfbc0d02836f3b35a0d0d7426d7e5cbeb0c3fb6fff4dc05f1c533dc58e6efc2787b412
SSDEEP 49152:wabH/2YabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQT2:VC1Cb2880H
TLSH
T13BB57D11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 2.2MB
SHA256 a766618b0033ffc0600ea2d7cfe0a052006581bddf235f63a7d611f146b55d55
MD5 94555be33796bf096dff9959e4760459
SHA1 724be9e8fa547e833267ae4f09c146aba848a1d0
SHA512 049bee7a2028a4c0b22fb9bc75b24ecb43316ba23aa3f1b88a40f83896ff906c4a0fc3bea6053f060315cef1067a310d8dd73bf503b19dcf1a4e934596661e8b
SSDEEP 49152:wabH/2YabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTh:VC1Cb28800
TLSH
T10FB57D11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 2.3MB
SHA256 7a87fb54b2bb88cecf6f5d4d43aba8db8211d9d6a8725421af1dbb3a66e53408
MD5 639489743284ae5fac4653637b82af1a
SHA1 3e39b6d4a29bd60c0ed980b7338eb14282763aaa
SHA512 859470541dd844ca71a8f9911cf47d51a0f6410189a9d5fc095cab0c269947e00542dae6605f9e7d0d2b1a10b5b13627c1769e28111751a27ffe696063862dd9
SSDEEP 49152:wabH/yYabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQT+:pC1Cb28803
TLSH
T16DB54A11E7409866E46E8970EA64C6167B37BDA11BD0C97B63C5F76C1F32392A8F430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 2.2MB
SHA256 79dfed233d2423a27631650e0380272238313e90da07f0367b38f856adbee688
MD5 d3f770665928464775759e9186a8af49
SHA1 99117294b29b9dd5f25b6fb7ea4ea74c4014b5d5
SHA512 d688ddfe6a4abc836f9579337c788fd40e93b7a60993f450b799dc03aa50712349481a0f958bd749736d5434723b8cf87902de65fdc0bc9b65a95e56b9324f32
SSDEEP 49152:wabH/2YabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTO:VC1Cb2880b
TLSH
T1B5B57C11B740D866E866897078B8C61A6B35BDB11B90C97B7396B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 2.3MB
SHA256 78d1382d1ad5be4f27c71e8fa49da2b27e3df2314e4fa69dbfb4e4aa4ba8b95d
MD5 3184d702e0e05df06301cca0d415f978
SHA1 a73245feeef59ec213e61256ab84e752de550543
SHA512 073b10cbeb6cc4b6833b2e8e55952b334a36443acd779d39cd8ce21b2e01704190c467163c6f7b200372f726681fa84d447a11d5ac49efdf0f244d21e989af51
SSDEEP 49152:wabH/2YabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTmj:VC1Cb2880Jj
TLSH
T173B57D11B7409866E86B897078B8C6166B35BDB11B90C97B7396B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 2.3MB
SHA256 281a09d7e0c3c08bf0e7165671de0a18e965a81245d886a6acdaeef45786ba2e
MD5 7982711c465b6e32f75a46cfb1d2f9f7
SHA1 72750aefdb1b09c216ec052c00e9ffc7dbb84b32
SHA512 d82844969235e44a8f14d43b8d0f0d40617266d87559a8707d8a15611e260aeeb55e0a20d10606bfc53a1d4b59fd97088a74cba8171e61808fefcd70fb2f4ef8
SSDEEP 49152:wabH/6YabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTkD:hC1Cb2880bD
TLSH
T189B57C11B740D866E866897078B9C61A6B35BDB11B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-19_15fba6b5902c34ee71e24ea28d586a7d_cloudeye_elex_hijackloader_icedid_njrat_vidar~4.exe
Size 102KB
SHA256 f1c2c4c7cc6a11055a19516be77e8de62b3b4efdab6f4c444b6625f210d47259
MD5 d4c7f603beb3b639e90b4ce6da0a75d5
SHA1 9fa7fbb9c808af1163946b56a260fc22a83577f1
SHA512 8f5ccccd19b56d671353e591810ac46b700ddd837cd59f87a1ca7e38c4bf2df0f82ce9f20f23f4d0837d52d215a4df33824886d08257a3284d8a88ed8febd1e3
SSDEEP 1536:1Zsn7CIxHHWMpdPa5wiE21M8kJIGFvb1CwX/l4sM8y+kR94fIW44DGr67:1Zs7BwMpdCq/IM8uIGfd/l4siW4I+c
TLSH
T15AA30841E62DBDCDE548D4314A75D4F25E24ED327680A11EB7F77F0628312A3FA0A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 2.2MB
SHA256 3f36fb2f08c6813f46e869d65295ff80e547b5920090dcc9eb52fd246f216fd4
MD5 fd072047fd2851baccf724aa4ecc97a7
SHA1 37e771f574363539032eee2c91057e841dda6bce
SHA512 4e67dc72b4e5867a1e08d8903d8209932a141a15b211c303a2a4c14fc55dee1fd9681b103743ab7e6465db65705404c0d8b43ac1392420101c9d3749c854c406
SSDEEP 49152:wabH/NYabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTU:+C1Cb2880L
TLSH
T106B57D11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.2MB
SHA256 848393de84f1cd53539f1363cb94ba5720745fa64225ef02b5f0a2cfbd7a5f07
MD5 b320ba125771b62d98be2d631abdf9ac
SHA1 92f2f4dc105a5115d1b419d88f8d46fe281af5af
SHA512 5fc51b0ce467f24740b4fc9730e8c750e7f5745d06871976e67c88419617c4eecf6edd6f6e5482cfcabb62485dd6d69f64cfc6a5bc89b4d398e87ecae8b3d6cf
SSDEEP 49152:wabH/6YabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTU:hC1Cb2880L
TLSH
T1B1B57D11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.2MB
SHA256 723f4e2ff51ff9fb69628f26efca0ebd2d9e98b044fb549583a54491ab06ad18
MD5 547b0e5ee6e09652bbfaa2a2207de833
SHA1 5fd9dd76d190bc48aa4464119866824642654ea8
SHA512 dafc5346ba5cdd9598776cff832d1138d013dcc60a16f70bfb20c7cd38e56dc641a3dc5da3f75b0d6faf85c6624f1360650119f3e37e6d903bf4c73c1e6e88fe
SSDEEP 49152:wabH/GYabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTU:lC1Cb2880L
TLSH
T11CB57D11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.2MB
SHA256 ab3ed5b6fc19227de268f2166e7e90623f26485cf9c7603f34343f7ead85fb5e
MD5 3fa715907a3d92fe89278cc2bd230383
SHA1 187061e612ad92e36a4ad2f032ae471ce579166a
SHA512 e6473180dfbe01f220f4866ddfea565c2debf2a7a96b08e5a8026c54a568ec88848caab33343f9c222bc9734559fbcf2087b7ed0316c7fa60177d9e5e297d986
SSDEEP 49152:wabH/yYabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTU:pC1Cb2880L
TLSH
T1F8B57D11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.2MB
SHA256 8cf23ecffde2db4fcffe5609b969ca426465bae000a6a71a877a343b8058d2dc
MD5 2186d5b36fdd9a6549882cd626d53afa
SHA1 88b3c0902d6526a950239665f64e8ee8516b3491
SHA512 0a812a53c0a78746a02706a3b1024a10a4a1eb4394a8f5f8e90be92670832e44f098966fe28b4ac28cd89b6eb47751bf186d78d423356f49d8cd713f93522f15
SSDEEP 49152:wabH/CYabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTU:ZC1Cb2880L
TLSH
T181B57D11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.2MB
SHA256 4d5a6797e570717e4f968653ce1a2fd107172674de1a1b967b823ce8abadb7de
MD5 f59b36ed380fa8b9dd87c4840a518801
SHA1 b4c6b00fc2dde8b6b69cb35ef85cde119ef15ba1
SHA512 7ba128fecb05a307f75b01ea2896a11d397d6dc680ad5ce67339bddee238b5521648f9c6d860bcf611cd8e6ccb7fdee7e400f1903ffad978860a47d39b5188d8
SSDEEP 49152:wabH/yYabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTU:pC1Cb2880L
TLSH
T1FBB57D11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.2MB
SHA256 d3d1d9c0887509b4d28b7c15600d5560db7807423309797a4754b37c4f10f380
MD5 e5fda1055b9dda7b397a9ab2f4337d57
SHA1 7ec5c080a6aadef50a9b38220a0a37b56b3b63b9
SHA512 29a3849ef86e60cad83cc15cf1e80a6caa2c56b16c5dbd11ced3c5c77d1ab856b9b36150cda7d7b55000b29787adb4b49b31a7d9eab5000601200d8968e14f66
SSDEEP 49152:wabH/nYabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTU:YC1Cb2880L
TLSH
T11EB57D11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.2MB
SHA256 79fa7b3c5c0ab6a2ed4bc451164ba300b56b368f0bf47c8e8ed51c4f6e13af80
MD5 71a4cce106b1d1996b8104a7335e5453
SHA1 fdca756740b3c561ae828053c56394980184358e
SHA512 ba80f9ab1af9accbb2c84d0d39fc2dbafb69ea1cf495bd7a0cb8fd6aeb80e6ef5ad915b3bd8cf8cde310e16ab3898a5dd631cc6476f4740388eec52b8814fe86
SSDEEP 49152:wabH/6YabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTU:hC1Cb2880L
TLSH
T104B57D11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.2MB
SHA256 e3a5ddbd9a6e2b00d5999feab62627ba483cffdbbbe3181ea05a6ec40c10a599
MD5 0bfd5c04e1d36b0df4c8f3ff624b8df1
SHA1 6df8f1407541d44d1fceab200db39589478b4cdf
SHA512 79abda1e462c5990bad0eadd2b9bda30f146af6d3767246783e0350f66eabe2176f7914dc128967e7d28fa4bad6bc15d654c24ce46422df372cd287cb4c5b54b
SSDEEP 49152:wabH/2YabH/w3NCLTYabH/FabH/w3NCLTXT28foh0Y1oQTU:VC1Cb2880L
TLSH
T107B57D11B740D866E866897078B8C61A6B35BDB51B90C97B7386B74C1E33793B8B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads