d1e76988fcd9357236f1fd2ff35e659022a32cb76ebfbde6995c95c96a4c63a5

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 332KB
Sample260721-rt82dsxhkh
SHA256 d1e76988fcd9357236f1fd2ff35e659022a32cb76ebfbde6995c95c96a4c63a5
MD5 e0239ebfb2a6ca7b0a17501e148cad51
SHA1 52d80b3a407f6212d1f4a4b357123ec0f721fad5
SHA512 aa225e409f77fbd9fceb89576aa5861192c8dc88ff67c52164e89c5ac4c00f3e411b369318ee560fb6a098d25a822c27ee22612e92f32f619f8f9a2d3c6d3aed
SSDEEP 6144:WXqoEu626XDpvPoYMT/DTqjgMSKfLJ7olgtlhns:JXDBAZzP/w24lhns
TLSH
T1A7743929B79C7BF9DCE681788DAEF521ED317C200B21DADB639446291E232C06E3D751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe

Executes dropped EXE 3 IoCs

pid	Process
260	Logo1_.exe
2420	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5740	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXAE0.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\RCXDBC.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX1C5.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\RCXDEE.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXE5F.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WriteConfirm.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.Exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXDAB.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\MpCmdRun.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX9ED.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe.Exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe
File created	C:\Windows\uninstall\rundl132.exe	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
52	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe
260	Logo1_.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5596 wrote to memory of 1836	5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe	89
PID 1836 wrote to memory of 4908	1836	net.exe	91
PID 5596 wrote to memory of 52	5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe	93
PID 5596 wrote to memory of 260	5596	2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe	95
PID 260 wrote to memory of 4568	260	Logo1_.exe	96
PID 4568 wrote to memory of 5880	4568	net.exe	98
PID 52 wrote to memory of 2420	52	cmd.exe	99
PID 260 wrote to memory of 4136	260	Logo1_.exe	102
PID 4136 wrote to memory of 2856	4136	net.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5596
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F4A.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:52
- - C:\Users\Admin\AppData\Local\Temp\2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe"
    3⤵
    - Executes dropped EXE
    PID:2420
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:260
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5880
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4136
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2856

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX74A.tmp

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX74A.tmp
Size 156KB
SHA256 85d1153885e798608e7be874dbf327886d29ef32b2b75ff000e113cbd6781c44
MD5 d608b6030ca18f668270642ddff5c3a0
SHA1 b4df50de5e23931446be15d1302dc0ed14c9c730
SHA512 259844347f10c3cdc6d4a8593aa0f0ffb402f0eea141ffd69a1a117d3c988bd31e389e69dc29e7124059e92f3ca9a05ecf0c1548ceae19ff477406127b9303a1
SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6fNz:hCSjGoLpWM6VsBEjx5ZdyZ
TLSH
T1BBF3B32EB18FB3F6D3E159BC8D1CF295ED28FE20CE19285B75993B0E9A760C35508191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX9ED.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX9ED.tmp
Size 94KB
SHA256 4aa0a1ad48283c6e3110377a785583fbdcfcd2b59d7ffcbb50fb549f6ef160d8
MD5 4410ecec539d49d88d5705e16e07873a
SHA1 bfb7959ab4005c022180e263217c18ffb1271283
SHA512 5896700fc3d02811f88e60c1aad2a4f641740c4dc687aee6080824ead4d55fe5ee7830e1625db13776226c83d54f1104edc209e56e96965282e740408a567612
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6YND:gCSjGoLpWM6VsBEjx+Zdpp
TLSH
T15E93295AB18CB376D0E199BC8D0FF2E5BD297E200E1D589FB59A2F0DEE760C1590C285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe.Exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe.Exe
Size 3.5MB
SHA256 841a2b7d8a65e9c0f827493048d483b78de816cd8fd14c8768957e40d3cfe807
MD5 f66ca16d4a5b80f7d635ce96e8f7342f
SHA1 3a820c411b6d4fd8c263a2efbe96fb3e56bd3a1a
SHA512 905ce73c10186cdcaba7ab875e62361fa755c17402b2e5f672e9a118edbf0fd6d70592d52dbfa6c449b17b14f5291134cae0646b3e179648799c7c66458467c3
SSDEEP 49152:4S2aBW08mKqRXGPd39PyPvnkSN+EcrxA3vGCDlBYMO74U2y+PhC:vbN/ki+EcF0pDeN2y/
TLSH
T195063903A19922D8D099C174CF4AA632EF62BC8907F162EF365076D52E77AD03B3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXDAB.tmp

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXDAB.tmp
Size 91KB
SHA256 98add0db7c43b0ba137127b6ddb34ac1b12ebf974253924384b6d33ed556634c
MD5 dc1ce8a8316720190aa0fb637a928347
SHA1 5ed751b59815bfe8e33dc4141e8a4a77599c030e
SHA512 70805d4c9326af7043d408677b6adeab63db4e376ae57dc7b0a9a22c7972909c2c9822c96baeb07e41bedff9d0aad78df1a7e0aadc48c83e5d73ee0532989a61
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6/NT:YCSjGoLpWM6VsBEjxZZdy5
TLSH
T1F9935C5AB28DB376D0F299B88E0DF2E5BD397E301E19185FB59E2F0DDA760C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB10.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXB10.tmp
Size 118KB
SHA256 44286cb468b055d4eee9c011b68e9505dde1f87baebb90d9d005e50238868538
MD5 d1bffd92a5cfd05e786a18ff42b399a1
SHA1 678cd6d85522988dab11c63a47b10b72fed2e59f
SHA512 9022d9001badc5c376bc766264aa6c838d9c4429191817937beccaa8a0e9002291663f5c71c93e31cfd0bf4bfa0332adb5cd4be01841cd53e333199caa46ea37
SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6x4GZjzQwK5WW7VCnE:JCSjGoLpWM6VsBEjxZZdQe5BV0IH
TLSH
T1EFC3AE59B68CF377C0E299B84E0DF2E5BD697E300E19085FB59A2F0DCA7B5C1590C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXFCE5.tmp

Path C:\Program Files\7-Zip\RCXFCE5.tmp
Size 91KB
SHA256 8314374dfe60e6ee206f2b2cb75f5fa7299892889fde7070c498fae96021d809
MD5 de8265de06ebd6908c1710022668ccf7
SHA1 46d9d3451b1c48a9bbe766f1b15eba31695442dc
SHA512 7ef76a0a9cc3b1fa90d913c69795457df11ad446e5e0d95327c1f81b8b354e767e77854df4373714ce51c6424c96489bf0a23efe98cf19ab2764cb3a7eab74ee
SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6kNb:QCSjGoLpWM6VsBEjxGZdRB
TLSH
T1DA935B5AB28DB376D0F299B88E0DF2E5BD387E301E19185FB59E2F0DDA761C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX1C4.tmp

Path C:\Program Files\Mozilla Firefox\RCX1C4.tmp
Size 91KB
SHA256 3568434773f17e9232d6736021d3fb73be45a6d566f1b618949150aa59eac2aa
MD5 c8737d20a3b1481127db89066598a373
SHA1 501c2272e969ffd0204284b842526b767304b2c8
SHA512 d34e65bcf6979e0aae5c907938d24f23f40453f2803637bddfa13811b837fd9e5033bb3f3ce4ed6ffad3b95caf2b24b449952c782dad711cdf041b440c49b604
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6NNL:YCSjGoLpWM6VsBEjxmZdEx
TLSH
T1C7935C59B28CB376D0F259B88D0DF2E5BD297E300E1A185FB5EE2F0DDA7A1C11A0C191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX1D6.tmp

Path C:\Program Files\Mozilla Firefox\uninstall\RCX1D6.tmp
Size 100KB
SHA256 b58042eb545761dea7c1aeacd827b52ea63ea54d8e8aa91893435c0a26a828ab
MD5 ce767b17879b7df460f690d75e99e052
SHA1 627b0a9378a5f4fc39d6743301613e91a25be00a
SHA512 a28b1d9ffc6509620e93641ad76d89cd2ccd111be996d650d42a1a76607717950d3adf88b5f88d692b101f1693425e444eaf2640f7e35eb47d56fa198f6a590e
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3nNj:oCSjGoLpWM6VsBEjxQZdJUnJ
TLSH
T1E3A35C5AB68CB3B2D0F189B89D0DF3E5BD397E300E59185FB2AD3B1D9A77081190C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX13F6.tmp

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCX13F6.tmp
Size 92KB
SHA256 ec0684a4d07b79448aef1779e5e158a78a1d371dda5ab8cd5260fa5e510292b0
MD5 8a267ce4c17083deb6e145e4f747c81f
SHA1 3238cd91d3dcf41f98ce17875006eb23dc3dd7ea
SHA512 df9daac6023d652d9e7a9287c9cfd1b6c743d00646622dd90d2890e4b23db36d943526b7cbb231ff8adb4b51f0ef2c8b2031447bce5d28588736ae31148a1656
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CqND:YCSjGoLpWM6VsBEjx+ZdDqp
TLSH
T1CB935B6AF28CB776D0F199B88E0DF2E5BC297E304E29185B759E2F0DDA770C1590C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a6F4A.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a6F4A.bat
Size 824B
SHA256 776f55e2271c9440bf197a633f2326b33d2d0df241f8e2d99a7761f8381aee16
MD5 f7722ad0b531ee167eacb9715c5d6b9f
SHA1 b23aeecb1077929b932d57ee84f3aac9a36f9bd2
SHA512 626a083a803ca30458c241c54e35e71bf99ddb5417f3922b766ce63386bdb5706435b0cab191cf9ac40340f3e8faee8068828fed771ae7f7ba2170cddfac83f8
TLSH
T1E5010802C1FACF540120301306DA0CEACAE5287C6B0D722AEF99C54D24D746CA9BA77B
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-21_e0239ebfb2a6ca7b0a17501e148cad51_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 239KB
SHA256 fcd3a002ebe8f18615a8fd6bcf561b54276a9e8952a3cc683bbe95843fcc37e5
MD5 8af4b7f9fcabf7fe2ba30bb74e825574
SHA1 541c90a14a81121402aa6ad382185668a0bbecf2
SHA512 7e6576de0712f9011e7cd150c8529a5fd9602373eba6a3b51f32f21a6c4a8a2983583da5d17b4429f258fb14f786d66fc3a4b9e7346906f7589d068a050bc729
SSDEEP 6144:G26XDpvPoYMT/DTqjgMSKfLJ7olgtlhns:uXDBAZzP/w24lhns
TLSH
T1FE346C3AB79009F9EC67C27DC9F2C522E67278650360EADB039486651F237C46E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 4008e2fc16af6003a6fb4e03d7fb68cca1c6089a24d24c7eeb9fa4bcd5a28706
MD5 46ac2102ce799cc17353b1e59c7baa06
SHA1 3d2e2945b0288ab008db6e9fcdfbafcd1b5bd35a
SHA512 4990afa32a99119b1ae9783e5357232ac27916d00d448799a85fba253a804a61f1ace2f894df1b466c8e5ad62de29465153f0957b0b478e8e4a2e5bb41abbe74
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t65N8u:gCSjGoLpWM6VsBEjxeZdMqu
TLSH
T168934B5AB28CB377D0E659B88E0DF2E5BD697E300F19186BB1AE2F0DDA770C1190C195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/260-902-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/260-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/260-1267-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5596-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5596-12-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5740-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download