2683cb3dd330a69dfb05978d30e7d7f35037b38a83dda700f7da7f8d3f0cc2e6

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 9.1MB
Sample260720-dnhelags4z
SHA256 2683cb3dd330a69dfb05978d30e7d7f35037b38a83dda700f7da7f8d3f0cc2e6
MD5 5365f7d96ff8c96a2cdd97b1ec5d1be2
SHA1 683d16a32710eea65a486ccbda691078999da572
SHA512 48d985223a1aff9b8b0bfce336e6b39355f47b358fbe0b65c86d4646b3f3f4b811a9d2da29662dd4a057e8d55312e24788aa7de1e7a226b6a3733fd726787dfa
SSDEEP 98304:77IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTZ:ktUvliKmd0iWyZ/K0ttYVAATZ
TLSH
T181A67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
4900	UpdatAuto.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\dayget.dat	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6088	sc.exe
1192	sc.exe
1912	sc.exe
2300	sc.exe
5048	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1312	cmd.exe
1692	cmd.exe
4612	cmd.exe
936	cmd.exe
2792	cmd.exe
3936	cmd.exe
4928	cmd.exe
5452	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4948	WINWORD.EXE
4948	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1304	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4900	UpdatAuto.exe
4948	WINWORD.EXE
4948	WINWORD.EXE
4948	WINWORD.EXE
4948	WINWORD.EXE
4948	WINWORD.EXE
4948	WINWORD.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 3936	1304	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 1304 wrote to memory of 4900	1304	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	91
PID 4900 wrote to memory of 4928	4900	UpdatAuto.exe	92
PID 1304 wrote to memory of 4948	1304	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 1304 wrote to memory of 4996	1304	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	95
PID 1304 wrote to memory of 5452	1304	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	96
PID 1304 wrote to memory of 2792	1304	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	97
PID 1304 wrote to memory of 936	1304	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	98
PID 1304 wrote to memory of 4612	1304	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	99
PID 1304 wrote to memory of 1692	1304	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	100
PID 1304 wrote to memory of 1312	1304	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	101
PID 1304 wrote to memory of 6088	1304	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	109
PID 1304 wrote to memory of 5048	1304	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	110
PID 1304 wrote to memory of 2300	1304	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	111
PID 1304 wrote to memory of 1912	1304	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	112
PID 1304 wrote to memory of 1192	1304	2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	113
PID 5452 wrote to memory of 628	5452	cmd.exe	119
PID 4612 wrote to memory of 3576	4612	cmd.exe	120
PID 1312 wrote to memory of 6080	1312	cmd.exe	121
PID 1692 wrote to memory of 5664	1692	cmd.exe	122
PID 4996 wrote to memory of 5648	4996	cmd.exe	123
PID 2792 wrote to memory of 5624	2792	cmd.exe	124
PID 936 wrote to memory of 5488	936	cmd.exe	125
PID 3576 wrote to memory of 856	3576	net.exe	126
PID 628 wrote to memory of 4912	628	net.exe	127
PID 6080 wrote to memory of 3416	6080	net.exe	128
PID 5488 wrote to memory of 2804	5488	net.exe	130
PID 5648 wrote to memory of 2260	5648	net.exe	129
PID 5624 wrote to memory of 5616	5624	net.exe	131
PID 5664 wrote to memory of 5548	5664	net.exe	132

C:\Users\Admin\AppData\Local\Temp\2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3936
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4928
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\system32\drivers\2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5648
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:2260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:4912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5624
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:5616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:2804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3576
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5664
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:5548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6080
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:3416
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:6088
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5048
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2300
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1912
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 9.6MB
SHA256 f873a636e5e26b5e6029f9637a1ba0410abad617c91e247ccd3b9a2d37d08e9c
MD5 0e3bb6e7714b5b9b9a31d102bd1c419a
SHA1 ff993747084a828427779f93ebdcd80652bf2966
SHA512 222bc4c745ed84df1fead6a35bec7977c1bb1b4594baca3fa4a25489228623fbde474b2e071ffb0c76d17e0299fcc6494ea9947b63a746dbd24495acf25267cb
SSDEEP 98304:37IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTpjo:QtUvliKmd0iWyZ/K0ttYVAATdo
TLSH
T18EA67D03F6A401E9E06AD174DE628232EB727C5947F1A5EF329076D52E73AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 10.0MB
SHA256 894f9e34e92fead003a48e11775b4a316fe8fde25ad37bcb3f38256ceb302231
MD5 301b9c42f11ecda37cb91991ce634daf
SHA1 0633ba329804db56287ddef1bb91f3cdbb2dea13
SHA512 baf11fb1861d710ea879f25be8d05224c1c9f63dac17316067d63cecebdcd6ab4a293501e9103e9e1a463fdf5ee62173959aa251d7f23d3c827bde54abbff4ee
SSDEEP 98304:37IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTiezSC6v2XMH:QtUvliKmd0iWyZ/K0ttYVAATJ
TLSH
T1D6B66C03F6A441E9E06AD174CE629632EB727C4947F1A5EF228077D52E33AD07B38725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 9.8MB
SHA256 5ad57a6a8d9126d468d12717e4044d37605f5d5d8446fa326903631791dd3842
MD5 51730e0ef864fc3caa99812be89ff48a
SHA1 6a7fd26bd94a9a7035aa7eea8d6c016b27a194d7
SHA512 0c4993fdefccbccedf66538c470b240dc8ef20c732ffdd4f219b6b312b032b3c611eaa6ed880daa7aab636c6a8408d77d8be89578d8f5cbc41cf3e5622b1dc2c
SSDEEP 98304:A7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTe/h1+:NtUvliKmd0iWyZ/K0ttYVAATe/h1+
TLSH
T17DA67C03F6A441E9E06AD174DE628232EB727C5947F1A5EF328076D52E73AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 9.1MB
SHA256 f54e35ef29ca2887df9e49190ceb219644a4c65cd55245d6b7e2f6ce93e34623
MD5 9a29f81cfcc5528f567a921761fd1724
SHA1 1da2a079552e1484567775ab4bcfa8159fecf4a4
SHA512 52e8c91bd1653b697e1744707aff93a97bf6531a17eee4cb9cb2deab743d5c9210f49f62aba66ad6c8f23e9fd1d58b83ac850d65b4898f156dd6b6f53060b786
SSDEEP 98304:37IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCT:QtUvliKmd0iWyZ/K0ttYVAAT
TLSH
T1FCA67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 15.1MB
SHA256 2c902507d3dfba0abf976ea88ee024eb04b259fbee53069a33ea37a8086dc1e5
MD5 f17baa9e8cb33096453aac4d42ba87f4
SHA1 4fa0ec2fbca6024f165c6beeea9fdfe09f924a44
SHA512 2964b981f1d5385807f8d46663805149837e5d62aae4b1bc52742f62629b1cadfd28e252e34ea558d8e3fa3153c41d27c5f972206ad8b428483e0039b4eabdf3
SSDEEP 196608:ctUvliKmd0iWyZ/K0ttYVAATmQyiKaUX+PNo:ctUvltqkyZ/K0ttYZTmQsas+PS
TLSH
T17EF67D03F2A501E9E05AD574DF3592329B717C4A47F1A2EF329436E52E72AD07B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 10.8MB
SHA256 f3896d1bb0631345cfe737aac22c81957993bc71971f591ad4a3e70576f54b0f
MD5 473ef9164530f9b3ed983108da95adac
SHA1 7fb12805d1ffda234fd9aad933ab6d293e1b5d90
SHA512 0d54d97ef603b5031595f2a50d27c2d75fc402a4daaa2ba36ea16185fa4745e01a4df3cced85433caf0f44f4860d904912a1daebb5dbd458f4788be2433d0e69
SSDEEP 98304:v7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTGthHRc/Q:ItUvliKmd0iWyZ/K0ttYVAATGthHf
TLSH
T169B66B13F2E500E9D05AD174DF268232DBA27C598BF1A6EF229076D52F72AD03B38715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 12.5MB
SHA256 8fe0ca1215c6787162331cbe9ae002f2293d027b445584ec35e9f68b9253d63d
MD5 041189474e111e7c0a04bd9f22f272b9
SHA1 98032cc5a70bbee60cf659cffe76c79dcc686dad
SHA512 590aed3a9e619d1320b343fe92af5850cc2eef2875dfcbf0eaccdd431b69c6ca7a58ae6632c75b156a5ac793056f2a511bd943c742afadfec5a7176bcfcf5bc1
SSDEEP 98304:T7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTxy5112gYy5aze:ctUvliKmd0iWyZ/K0ttYVAATMLIHuWhs
TLSH
T114D67C03F29900E9D05AD178DB668232EB727C5A4BF1A5EF229077D52E77AD03B38711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 11.3MB
SHA256 0c753a484255db340bc05bf08d444f6abd2f9f75fa73e135ea4a41d55bf3db00
MD5 a54130248e7f671ac2d39735e4778cfa
SHA1 fcc6080b33a7ab766bf5a32166bb351e06999640
SHA512 97c1730f7e1c49199dd7e3d92ad549bb6e37efe625938acc06ba1b3f6c906a421bff60641e6d28c89bb27a8641f5478e94b580ff2622e8cf0ffd01f998a892d9
SSDEEP 98304:T7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTXu6Jm0xd2d3:ctUvliKmd0iWyZ/K0ttYVAATe6Jm0G
TLSH
T1BAC67C03F29500E9E06AD178DF668232EB727C594BF1A5EF229076D52E77AD03B38711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 10.7MB
SHA256 5e7d3baa63a3f999326a9bd23d13dbaa33a6e43a557a0d88023e957356407aee
MD5 251abbe380f6b4cf273d85aa893346bc
SHA1 f7d480f8be196dcc0f59ee81f94590b665d831c4
SHA512 af5ed54670d4c43b3d8f80e1e6d25c980b5327246ada5c2a09578215f1843fb9ff9121911b76733a6d20ebe3becd457de75aa9a35633254aa84f48d86c571d98
SSDEEP 98304:T7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCThmifP5R7:ctUvliKmd0iWyZ/K0ttYVAATRfPf
TLSH
T196B67C03F29500E9E06AD178DF668232EB727C594BF1A5EF229076D52E77AD03B38711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 10.9MB
SHA256 03b11d6ea70ab3a3f867b5fa22b1f08aba93dd28ab0c281964fce92b5d475565
MD5 08cb65b34187be77feb196475d04464b
SHA1 94f73901b8a522a3f312b083f9513760387be90b
SHA512 1a2068fdf999ac2369688a612f5bc71f2cbe549e5028d6899e27056610cb5215b82fce5c11bab022909de6be232539e6af7be73cb86568efc5a1f8b7f650b81e
SSDEEP 98304:T7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTy5dKCi616:ctUvliKmd0iWyZ/K0ttYVAAT4dKC16
TLSH
T18FB67D03F29500E9E0AAD174DF668232EB727C594BF1A5EF229076D52E77AD03B38711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 12.1MB
SHA256 eb6e011f379b99d31a8b3ca6d50d9049d4cf9bf87147fb30d0299a5351a2e92b
MD5 6f54fdb461726967799510fe58048ace
SHA1 66a39aaaaf61ec7c6a9f35e7034850bdc0e9796c
SHA512 7ac2857fff556e0c90e37a775c2aba8fc7a38c9ebfa8143c12c22cd282605618a39daf6f0a7436ebe65374cfa74b948d07cbfb24cc5afb47f3eba923a0cc9879
SSDEEP 98304:v7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTYm7vj1BDlZG:ItUvliKmd0iWyZ/K0ttYVAATFjnDO
TLSH
T18DD67C03F29900E9E05AD178DF668232EB727C594BF1A5EF229076D52E77AD03B38711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 10.5MB
SHA256 07b4f271d681cb81ead74ee2754a66da6f74ea9a20686dbcad2db629882c7e74
MD5 5da7b9385d20202aaeaec0fef50b7840
SHA1 3bdd8f74a84c2380799e72faccead7e0fc2951b0
SHA512 37f5d44203417cd31234959f20926a1aac450c007271b9a6649242158c4fafe2565182a4121f5f0934c24698b669909b191818afa64ab028d8e8744406fb1bd1
SSDEEP 98304:T7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTzX2iwphX:ctUvliKmd0iWyZ/K0ttYVAATr2iw3
TLSH
T1B6B67C03F29500E9E06AD178DF668232EB727C594BF1A5EF229076D52E77AD03B38711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 9.1MB
SHA256 cf7c6fa74e705a4632720138c50caa9e136792f60f10ff355b7ae3037e0d4fe7
MD5 9ec294042b1a10cf1856ce870535c8ae
SHA1 b40ed1885c3b75aacccc9b4ed5b19291b4b2c97b
SHA512 a70b7bc66c6b5ed3e46155f69a929efb57d4f1b8e9f90562446a8c9e5b74f860dca067ad64b8b3b34d780a4e53f0a60e8eef81b18cca7e2cca784cee6cca599a
SSDEEP 98304:T7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTW:ctUvliKmd0iWyZ/K0ttYVAATW
TLSH
T120A67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 9.1MB
SHA256 a5f15ccdb5dcd7601a2e49c4a63b7bd3419ce87a9f6e7e8d4b53d9d3b1de9685
MD5 19269a0a01ef2c81e743b9e5883e2b6c
SHA1 da65bd22cfe0dfb75e60df047535d72d06fb3351
SHA512 8851ff59d117a32be235414b609bbe727ad65b297902a94ab45596657e1d6389b1fdfaa5859cea0882f866cbc51bbac79cec24cc37f165c67f94b915881e2177
SSDEEP 98304:T7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTy:ctUvliKmd0iWyZ/K0ttYVAATy
TLSH
T1C9A67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 9.1MB
SHA256 a96b3fd3808e25eadae7b98e3efeb30deb727f54580e2a4dd0b3219ae3b0e0fe
MD5 b5d24901567d819f73f29ab362afb064
SHA1 9b95ba234e7fd347f51e870aff88a4acb47700b7
SHA512 fbff520ef6797311c12338f9338d80b27cc34127988576c6eaf2d44b791577aa31b4b42f5b187cf4510220bd89f94bb84d76d1989edeaaf37c25b127975dc0bc
SSDEEP 98304:T7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTd:ctUvliKmd0iWyZ/K0ttYVAATd
TLSH
T159A67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 9.1MB
SHA256 bb07efb780c4a8d8beb02fa7c4cdc9a2b9186b39c0d8f32626d16efc233ef72c
MD5 225b458a4cbbc91836e6c906c85f204c
SHA1 d55c69cf1adf706f4f30d9fc8224f5d7d093535e
SHA512 9c2566cb6a22e8e01ef4e64bda7534a499ccdf4ac358e89bc33e5109114aba414848a70ec8a73f08510a1fd1b6ba4ee5cf457a2bdc33f8d1f495f832600ba3a8
SSDEEP 98304:D7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCT4:MtUvliKmd0iWyZ/K0ttYVAAT4
TLSH
T1D5A67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 9.1MB
SHA256 bab3e8474db9451046cfdeb364aa82c10934b855692259a5777893c5383c590c
MD5 003f8e223eb3c84229911b5ae2c28a3e
SHA1 8b081d94dbe0fc1b84ac3d847311640b8daae3e1
SHA512 dff9bf27b234584983d74e169f63ee91e699fadc8599c513a8185bf568ab0399404af1887c65bfde79a12b19622eb3236fba388035265c2b2e5a98aa5ab93c5a
SSDEEP 98304:T7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTV:ctUvliKmd0iWyZ/K0ttYVAATV
TLSH
T1D9A67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 9.1MB
SHA256 f35cb5444b9a37c45dfb1355ac1b6c11923f72fc0eb18290685854615684eae9
MD5 24355ec478e37a4dd77b296bebc8d1ba
SHA1 408ddad005139cdd6695d8090dc99e0ef4119f02
SHA512 a37080763d15e4661c64aeaacb7a09d513668cf9917d1a8a9e1c2f949a6601873cfb588995a416dbb3a186afbe090898695d00240de39b157cfcdac3a93da8d6
SSDEEP 98304:T7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTq:ctUvliKmd0iWyZ/K0ttYVAATq
TLSH
T1A2A67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 9.1MB
SHA256 0bc2ca7715ce5d352a8fc6c0c52a9f1753c25ff1d84d280b3074e186ae094b18
MD5 2404831f1da99691dce99b496027cb99
SHA1 0290608911c22dd755d4310290800f79abb912ee
SHA512 66492fcfbc826521adab998fbd97fe01ae0a4f79a321b6fca3824dd1eae2f4795babbf3435d4d96cd1f92f458d551419085a7b94f11eec43ca9f1c91b7d6f122
SSDEEP 98304:T7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTl:ctUvliKmd0iWyZ/K0ttYVAATl
TLSH
T11FA67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 9.2MB
SHA256 99bb95e6482bd9039f4358b5e5257526bb6eb9125a30b68548fc8afe9d7cb4f8
MD5 bfac995942baa91dc198cfd7842919d9
SHA1 662c6d21b1fc7729d4b94e0cfb055402bb77ab0e
SHA512 204dfd385bd3f27401fad4969c3ff0aeb0787d52cebf3e5a669bf0f0cadfbf4b62bc09b8d5f175e0d422842b7ebad49411920a111dd7c624a75780bc7dbe9c75
SSDEEP 98304:37IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTq:QtUvliKmd0iWyZ/K0ttYVAATq
TLSH
T197A65B03F69501E9E05AD174DF628232AB727C5947F1A5EF329076E92F72AD03B38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 9.1MB
SHA256 29c069c33d97d4ddac8f4c46d68085231475ed4d6528fd0083e29b89eb8a6e06
MD5 c88a2cf462c54a50d050a38b6bcd1f5c
SHA1 cebae5c75724de2d37f6024e1a1b3cc95f63458e
SHA512 2c3a9fcd7fc3185f4d4fb61166c97b283614c56895cd8044b16f56e82f232245bda9ca979cbad62607dda4e26d399bf33981b0cd5e5d22a8405c63d71a8e3251
SSDEEP 98304:T7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTi:ctUvliKmd0iWyZ/K0ttYVAATi
TLSH
T193A67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 9.1MB
SHA256 de03dc7c09c5128e543d77557f4735a0e24c9e795f019092aa8f8b64ee3ea222
MD5 06d585e34ea6cc34d6644828e1470313
SHA1 b72d63d7bd47753e9f42268135b90d4f58e1b565
SHA512 0d2e59b52ee5a66a67b1e2f15c223f565e69477f27143eab7d8b24978018bd5623427dc8163750ca52cccf2720f384f8a78a4a12b48a06194e8e891aa1d20c17
SSDEEP 98304:T7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTyj:ctUvliKmd0iWyZ/K0ttYVAATyj
TLSH
T142A67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 9.1MB
SHA256 a2f47b3b138f00132d6c3f247d91c9029bed78e86f99c706482c0948b6e12b28
MD5 d7d5923add73523b6a523c90c351634c
SHA1 fe59767f27be94559114320112d6197f4cba9346
SHA512 82bb84941ea36174579e34deec12f7a80e0cedafdc60705861473b0f2c8f06652922f63bd7dbe7ba63889d2883d0f7b2455f78a84d541be585054ff546fc7292
SSDEEP 98304:v7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCToD:ItUvliKmd0iWyZ/K0ttYVAAToD
TLSH
T11AA67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 a1fe754fa7249118ff791702e4a6b813f3c96f0f1f6fd238e07c5f338f8a2c22
MD5 df4fa382411428a0834698195bda6b8b
SHA1 0f57d3fa51f53bb2534d3394a2aa0d40f6c61d7d
SHA512 3fe8b8fbd68ca4e1d842c73bb2f19109d6b2d9cc408dfaf76fe3f4802b9c157b3763c4b33a432cbe6def30060d737a6679f3a1ce713ed6560622d54225201c25
TLSH
T17BE0C2113BF80204E9B30A3C7973AD895A367327AF01CADE1B35008D2C25F91883671D
MD5 SHA1 SHA512 TLSH

Submit Download

sist02.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCDA6BE.tmp\sist02.xsl
Size 245KB
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
TLSH
T15B346895A6DACF144B71F23FD8B53492EA1DC87B29342D41F1DC733717AE948822B622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc

Path C:\Windows\SysWOW64\Drivers\2026-07-20_5365f7d96ff8c96a2cdd97b1ec5d1be2_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc
Size 7KB
SHA256 049c264c462d500a985f016666cee6bbaa00f3e1d34c8deec739054c1c92fb92
MD5 87f4ba7f165cb8f4b85834e0062323a0
SHA1 82be03509079849db85166d0e62e74265454a758
SHA512 61d8ecd1c16c67ba8737e9a3e1d262a69b00404fb43b7ec08db3e54624a49d6e840713d34a2e667a676995ba6026afd93b6aca027ecf6c44e5c4283fac469b86
SSDEEP 192:Zbybybybybybybybybybybybybybybybybybybybybybybybybybybybybybyby+:ZOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOh
TLSH
T12CE12228DB098082D01BC1831008C233C5938882020EAB0100325939532030E1415BC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 9.1MB
SHA256 c0d053ded9b3a29934358201437b5a4202d3b561b403fc045e0982fe1ce51596
MD5 79b0ff36debbd85be6787d885db787bd
SHA1 6ec24c068d0be1f8ae4f260ee7a20e30eb94d4e8
SHA512 cacde742163e441bde83be30aa97f1f8e1ff02ed44f0bc3c20fa2f5038b93ff3bdc7c100386f49a30e2a38cd18ec9565ed73c01754fc068e0d316d02c6832bf5
SSDEEP 98304:77IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTA:ktUvliKmd0iWyZ/K0ttYVAATA
TLSH
T1F6A67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 9.1MB
SHA256 794b1c7f0215d0a12e816601cb8d13da7ba8cc11e68b45cf3ac6c6e51e9f27b3
MD5 2259ea518f50fd32064d28565280cbef
SHA1 74eb29ce7fe2b4faa912d84a6b835798a08bf90e
SHA512 5eea1c0f87ca0c9a02fc28f12afe1afc15a079002befce881e258e901a7007f1d637704f70a96de31331bea2ea7397a8dc07fe5e8e5f4266c8b5efa7610427c6
SSDEEP 98304:v7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTA:ItUvliKmd0iWyZ/K0ttYVAATA
TLSH
T132A67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 9.1MB
SHA256 0173305a9d0647c5ddd2f88d6eca80b901690f403783ad54c540d6c75659770a
MD5 6279ab3d7f9ab54bae740db6053dce60
SHA1 ba19406e0f985041c3ac04c548b92e76c288f497
SHA512 65fba4ed91ffb42be887279a200ee78caa6acaedb4201c7c7829f1ddfb9b17f3af612d57d9771d0cb16394f77714dfdac1c757cc4a29b0dd66959cd4e0d16c66
SSDEEP 98304:D7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTA:MtUvliKmd0iWyZ/K0ttYVAATA
TLSH
T1AEA67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 9.1MB
SHA256 4d66eca354b7599cbf02f04103fe2df9f55a114ab5e4e490fe3565b0f495482c
MD5 94ca195ec7be13a58948993403f337de
SHA1 f4204ec32cf3fec149845ad250709123a08e96e6
SHA512 cf5ebaf81a10ae1b90d7eedcfe7eb60bb5c531a43f9755d50e3b55fa65996eb7f671d9e157268df640ac10acce988a09af1fbeef91679585e48ff7bf92437cfb
SSDEEP 98304:37IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTA:QtUvliKmd0iWyZ/K0ttYVAATA
TLSH
T1EBA67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 9.1MB
SHA256 e67e92e81f3bed183518d482333916898f89ca779eac6be9532361b059e17346
MD5 0dbb752852dfdd606887f92df6385706
SHA1 704af3ee3f28a32417ab0e0cfdd89ffff1ef7f56
SHA512 f3dcd23910966af287262d1d5c413a56f00927cb14528e657727eaaace295ab76f184913ca4a02dd3e74ea7a814c0bbf70daea1a4517f2d59cd5eb2b50428631
SSDEEP 98304:O7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTA:3tUvliKmd0iWyZ/K0ttYVAATA
TLSH
T14DA67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 9.1MB
SHA256 5333e1b7e18b584de256d859afa891576fadaedb86712b2a724655e27a6aaeaa
MD5 35361ae4daa2bf13c8175ae4fa2f8ca6
SHA1 6af0b5e634e801519251cb3267bed2a765a79ac0
SHA512 8bde0366a41b5200d07f7c721096b2aecc907da7cdd5685d7b482a2def1765c4d45355c38682af2357dd8b1b43ae724919280b6fef85be8cbd7d7c274847a70f
SSDEEP 98304:37IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTA:QtUvliKmd0iWyZ/K0ttYVAATA
TLSH
T1F5A67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 9.1MB
SHA256 e47ff220b13bbe83e8075e74954c18d223555c2e83de881bb54bf7b46814a4ff
MD5 bed1524685d9add0a70b8243a56d8090
SHA1 eac7dd8fa29add8e59ef07a4357bca669ebcd5d9
SHA512 eb710de02b6ef6f320aca071a419b29a28bc6dce5c7a03a70683313dccab28dab0ea86fefdffad2636293737e73b11a644fa090457c0c1743a8f35e253c888bd
SSDEEP 98304:A7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTA:NtUvliKmd0iWyZ/K0ttYVAATA
TLSH
T14DA67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 9.1MB
SHA256 9faa831985f5a9abad9f2d20a92255f1eadd6c1773bb9798165813d993c52552
MD5 7dc2bfbbd93c27a676b5e9330e9ca0d7
SHA1 d0cec352dc25cfb6b5a46db2ba7b0ebb4aa72ab6
SHA512 fc5201aae0507f3d2e4eb854b642e24310886e60cad16adbc64395fe8665e0dc9856b23132d4aa237821e8bfce63753498bfebb50977c3521cfe1b53fa933700
SSDEEP 98304:T7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTA:ctUvliKmd0iWyZ/K0ttYVAATA
TLSH
T182A67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 9.1MB
SHA256 b034e430018d046b0aa964775f1af9fa840ed37a5cdf6df1ea57f2b7563c4cb2
MD5 447b02516991a2a3e073cdb9be9a2d3c
SHA1 8e7201a4e5ac6b549af669d305d9a29d65a0bb4e
SHA512 688956acdd0f07533e55c4db1b2cc5f1bcc6926d1d513e309cc3996322b927bc5ad0ab900b9280921bfcbf9017ae3e5fbee139602a74650d702ddf715f384aca
SSDEEP 98304:v7IwX7Iw4tUvlt0oAaldmdmnpn6d2gdWQtZ/K0tGOFWVRuLftCTA:ItUvliKmd0iWyZ/K0ttYVAATA
TLSH
T1CBA67C03F69500E9E06AD178DE628232EB727C594BF1A5EF329076D52E73AD03B38751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4948-47-0x00007FFCFD180000-0x00007FFCFD190000-memory.dmp

Download

memory/4948-45-0x00007FFCFD180000-0x00007FFCFD190000-memory.dmp

Download

memory/4948-44-0x00007FFCFD180000-0x00007FFCFD190000-memory.dmp

Download

memory/4948-48-0x00007FFCFD180000-0x00007FFCFD190000-memory.dmp

Download

memory/4948-43-0x00007FFCFD180000-0x00007FFCFD190000-memory.dmp

Download

memory/4948-50-0x00007FFCFAD60000-0x00007FFCFAD70000-memory.dmp

Download

memory/4948-51-0x00007FFCFAD60000-0x00007FFCFAD70000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads