2a2c65610f83391c0c0080cfade1227664a792f710e0b8abaa3f5a9f16e4f40e

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 16:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 2.4MB
Sample260723-t77rlaca27
SHA256 2a2c65610f83391c0c0080cfade1227664a792f710e0b8abaa3f5a9f16e4f40e
MD5 e6497846e9f283b1a188f60738432a19
SHA1 eb51c1156cd2054ab805256c803257bd89024e4b
SHA512 bce59ea8f8e2258115f8382873a3089ec94e285195e0e39d869a5009f879d02db47008818a083d374bc458c3d72358d21ac6cda71d19e5ad5ba85b2417f74494
SSDEEP 24576:P4R5CIH/7Je4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFB:PabH/gabH/pgjI45TMwwapIgTP
TLSH
T16CC5F53272E2049AC6899071DF168635A7D13CB98FF197F7B24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
5444	UpdatAuto.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\dayget.dat	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\StepEnable.tmp	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1652	sc.exe
5972	sc.exe
4840	sc.exe
2852	sc.exe
1616	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5644	cmd.exe
4064	cmd.exe
5164	cmd.exe
4508	cmd.exe
248	cmd.exe
124	cmd.exe
384	cmd.exe
3444	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4100	WINWORD.EXE
4100	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2900	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5444	UpdatAuto.exe
4100	WINWORD.EXE
4100	WINWORD.EXE
4100	WINWORD.EXE
4100	WINWORD.EXE
4100	WINWORD.EXE
4100	WINWORD.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 3444	2900	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 2900 wrote to memory of 5444	2900	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	91
PID 5444 wrote to memory of 5644	5444	UpdatAuto.exe	92
PID 2900 wrote to memory of 4100	2900	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 2900 wrote to memory of 4180	2900	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	95
PID 2900 wrote to memory of 4064	2900	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	96
PID 2900 wrote to memory of 5164	2900	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	97
PID 2900 wrote to memory of 384	2900	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	98
PID 2900 wrote to memory of 124	2900	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	99
PID 2900 wrote to memory of 248	2900	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	100
PID 2900 wrote to memory of 4508	2900	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	101
PID 2900 wrote to memory of 1652	2900	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	108
PID 2900 wrote to memory of 1616	2900	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	109
PID 2900 wrote to memory of 2852	2900	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	110
PID 2900 wrote to memory of 4840	2900	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	111
PID 2900 wrote to memory of 5972	2900	2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	112
PID 4064 wrote to memory of 2256	4064	cmd.exe	119
PID 5164 wrote to memory of 2756	5164	cmd.exe	120
PID 2256 wrote to memory of 4604	2256	net.exe	121
PID 124 wrote to memory of 5172	124	cmd.exe	122
PID 384 wrote to memory of 3412	384	cmd.exe	123
PID 2756 wrote to memory of 4488	2756	net.exe	125
PID 4180 wrote to memory of 1112	4180	cmd.exe	126
PID 248 wrote to memory of 2204	248	cmd.exe	127
PID 5172 wrote to memory of 4052	5172	net.exe	128
PID 3412 wrote to memory of 2656	3412	net.exe	129
PID 1112 wrote to memory of 6096	1112	net.exe	130
PID 2204 wrote to memory of 1260	2204	net.exe	131
PID 4508 wrote to memory of 5284	4508	cmd.exe	132
PID 5284 wrote to memory of 1308	5284	net.exe	133

C:\Users\Admin\AppData\Local\Temp\2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3444
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5644
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\system32\drivers\2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:6096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:4604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5164
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:2656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:124
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5172
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:4052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2204
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:1260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5284
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:1308
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1652
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1616
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2852
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4840
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 3.0MB
SHA256 ca0b496b87ddd8dcc7069664edd66a1e10695d86a876aa354670f7a6a33c30ad
MD5 54ca6cc98c56a4889b5bfe17cf2173d6
SHA1 3c83ec5218808067d34f3269db724bfc8b40949e
SHA512 11016f04b95242db42d3a35375d3ff71c27c1e9f634e39dfdaa4cd7db2bda66297d00ff50d1d554050fe98037ff859dbe0dfa28079750a741bfc239237982fc0
SSDEEP 49152:PabH/kabH/pgjI45TMwwapIgTzPji0Aj:8LapIKjo
TLSH
T1DEE52822B1E2016AC19AC071CF568725A7E13C798FF086E7B245B3C92F726D1763971B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 3.4MB
SHA256 e6b5faa5f10162a87c5ef76ec5db4c3378504545fe1c33671c0e8dc1f9fa7911
MD5 386f609a65e3f21ced50a402bf81190f
SHA1 f5d7c1c77966fc67dcd44b045f12a3215c6878df
SHA512 b386e10e8458086520a75bd7d1eda4c39d63b311914f4cf73d420e953aec793f82d7292ae193d55c04723bb9bd65d0d81331115c7fcab5c0ebc43ad77731dd93
SSDEEP 49152:PabH/kabH/pgjI45TMwwapIgTg/ezSC6vUzPvMHjy:8LapIXezSC6v2XMH
TLSH
T1B3F52922B1B14266C0AAC071CF969725EBE13C698FF086E77245B3D82F336D1763571A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 3.1MB
SHA256 72ca2e93c838f833d87f3b6ed7015f968a9f0f35a0a4b264a0c1dcb928f26176
MD5 e30b146dbe46684d3869bd660b0255bb
SHA1 1438b2b4bb544f98f2f035f082d733398b741235
SHA512 55face6a61ed2385563385f488b0ec1103e8cf422f18f725d1b00041ab02574ce861fd95d5ec5fff6bd45a3bc321f0290427dc4cce78bfe8db6be3616a34a659
SSDEEP 49152:PabH/RabH/pgjI45TMwwapIgTTVO88hXl+:lLapIX/h1+
TLSH
T115E52832B1E14066C1AAC071CF528625A7E13C798FF186E7B245B3C92F726D1763A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 2.4MB
SHA256 e38934de451052d6d94c2e37e8bab7bb3a5ea7bfe9572e9260b86da82170b842
MD5 4a4a1b13207cf4923c3ced57dd799493
SHA1 50f0931b144a45eeb95a65f54f75db41f7a21b08
SHA512 726665eef1b307ca5716dbde47d3045b1c6b2e7b3607e3be913bb46262c099f38928b7197482af87b8d3e564cdc567f9e29befcfd22ca906258179f9307df4fa
SSDEEP 24576:P4R5CIH/7Ae4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFXa:PabH/TabH/pgjI45TMwwapIgT
TLSH
T10CC5F53271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 8.5MB
SHA256 863101daf1c3f59e9f95c8d27d0c405b94cbb54f6e1b0733adbdc7d8888694af
MD5 ca38e4752d109de510bf8f03974da616
SHA1 7810d1618fb10880906669fcd3583fec93cdfc70
SHA512 0154d4862f6a1a9d1b6926306242023ea7b91c643f22da0f26e36366076f3d3c25949ae32514ce91d87900f417fbecffd4d8976561dbf6b7d39ca91cbc72b0d5
SSDEEP 49152:PabH//abH/pgjI45TMwwapIgTej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAY:vLapI2QRQyi36YOcP+Lvw2gAf+PN34
TLSH
T17D966C13F2F500A9E05ED974CF2952329BA17C5A8BF093EF359436E51A729D07B38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 4.1MB
SHA256 7cf803bfc92c400d42e7468a7f5686fa2becaabd6713ef415c035dff868abc99
MD5 750ddc156d96b35e5b1621dc36e48e93
SHA1 cadd2d9324e755fcb15984fad9ac45d6a90d56f2
SHA512 eae4008e7b109fb1b65d61da778a7563ae82db90145535e74e03fd6292df9e2644d68668bc83000fbcf80a1c31df35e1704935724ac24322aa99983d28edaca1
SSDEEP 49152:PabH//abH/pgjI45TMwwapIgTW68Qg55nhoeWu7PNU3/Q:vLapIRthHRc/Q
TLSH
T11F16F633B1E20099D48D9072DF56872197D17C798FF1D3EBA24572CA2B729D07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 5.9MB
SHA256 daba9b8bb819e02b4ff6937839fd485fa92d1b6c8eea7e67d28d269fec76c0ed
MD5 b56fb91316c75d9c43ae38835552a4dc
SHA1 180d4b57d362d7eacdcb505af044c33511596793
SHA512 472ce6adb72caf88d91ccc40a88f90be177d6f5de5a6d8fcaf43ece24794f9f7468f0a11f887be605dc3521887ca5a03613815e3c24c2d2f0c8577ee9b5253d0
SSDEEP 49152:PabH//abH/pgjI45TMwwapIgT63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlQ:vLapIgy5112gYy5azzVvf69nLKnhZO
TLSH
T1BD564923B1A500D9D04DD075DF4A8232EBA17C6A8BF1A6EF264073C52F76AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 4.7MB
SHA256 bbb0cf861d9aaf15971e73f94b3d8480a5120fc21c2fc0044419749223e650a3
MD5 aa4b23cf1a604cba2a0d56d68592e00f
SHA1 da3f4302e094970166d68ea8e8ff6a93c8664b4c
SHA512 74a84f2428c571d30bafe6d45abeea7d63a9a1d067999e7eeeb4bf0bbae46eeb65df241f4c774b02f9e7bd1a39cbb67ec9df5a31521d96bd4e0997b8db8ad1f0
SSDEEP 49152:PabH//abH/pgjI45TMwwapIgTzB+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:vLapIKu6Jm0xd2d3
TLSH
T1A3365B23B1E200D9D09DD075DF069232A7E17C698FF1A6EB664073C52B72AD07B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 4.3MB
SHA256 bf1249d04a44cbf41069ccdde00b8b146f60eede7ef43415414f9ed5006989a6
MD5 8f469ba3db3c5282445894da34615bac
SHA1 833c6478ea3e7d76a1905e3953a4fddec1334756
SHA512 5302d987b01eac2ce2f233254d897e9e4b881490fdc71ce4a385aa564ac19bf8bd5ad2fd8c1b882ebf575e5a4721c9298ceb0daea76cf2a7b9f65d7575d4644c
SSDEEP 49152:PabH//abH/pgjI45TMwwapIgT2SuZQIY0Be2K8RVtOnks6NMHq6:vLapIx5dKCi616
TLSH
T175264A23B2E20099D19ED071DF558235A7E17C698FF096EF624072C92F72AD07B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 5.5MB
SHA256 f7229c623b0f6656c11084acb87fa586b624119830ee949b10eca6f337492852
MD5 f040bbdcf8ce3570e1093fc2f0e5179b
SHA1 27d56cf7473a1a390f0c0e4a68a3e2b2c6fed27d
SHA512 89080f0e94233a5eaef11495871de916681f82f51aad9db60bccf8fbdb5144279c4eae0703963a1444a891d1f8b99e02aa7b01cb57831fe71dd3becc429b6b9c
SSDEEP 49152:PabH/MabH/pgjI45TMwwapIgTzyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XS:ELapIbm7vj1BDlZG
TLSH
T191466C23B1E600D9D059C075DF468232E7E17C698BF196EB2680B7C52B73AD07B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 3.8MB
SHA256 73d051c0bc32b2d4cf97ca9cc436e4fd0c4f2abd1ea0a2d5026469ebf7fc9fb1
MD5 dd881a82030be5425a033d043006b074
SHA1 419870564a61876ff1ec1686ca0c1bf808830acd
SHA512 e9ad08bf74b34d3faeb5b3e2bfa8dc50c207add72b46ef465b2ce1305dc0730cd684436bdaeeaf3f97120471b7f95d51ed305706f3ecd5913678b00c6a410129
SSDEEP 49152:PabH//abH/pgjI45TMwwapIgTEhtSn8EApI0fig1giDn0AP5w2:vLapIcX2iwphX
TLSH
T127163923B2E20099D199D071DF168631A7E17C798FF196EB764072C92F72AD07B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 2.5MB
SHA256 676a7c6bb25310ed6999699b30e386e37ec65252218fa6f2fd8aaddf31e87fae
MD5 19ee3af4f523b2e2d63d649d5ae34620
SHA1 179f7d9997ab6c203dbcdf9fcdc147bbc0790572
SHA512 f0301d05d5f618b54b735bdbb7b08d68bfc464e65dce7ab6ffeb94ea1c70bed544184d4b2be05c60a763511d503aab2147b62cc0318f0eff85287a05e6f324da
SSDEEP 24576:P4R5CIH/7oe4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFk7:PabH/rabH/pgjI45TMwwapIgTI
TLSH
T1F4C5F53271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 2.5MB
SHA256 22b70ae2865f5277b0e5f6c330a0490a1bc1ce41f69e2fbe6d3749146163a2b0
MD5 ebbd858141005d18fbf86dc8216ff21a
SHA1 9a2f945b78284e511f082fba4cb2168700ab3818
SHA512 9ad70bb9f6c13c462506e2c71ebf48c3afda418dce7552bc4cf904cd3d3afcfa500fcd516ba1d45ea509ff426958acca10dda55ea88eeccd960e20812484f044
SSDEEP 24576:P4R5CIH/7oe4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFax:PabH/rabH/pgjI45TMwwapIgTQ
TLSH
T188C5F53271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 2.5MB
SHA256 048a28689afff7d30d10e81d880d0e6170346ace7eda84d486231d325a84fb8e
MD5 087a9e9f7896befb96983ac53984261d
SHA1 fdc52aed7b91e3531ed85a338f900acfcf4f6c9a
SHA512 a7d5be24b95e4d77f4fb525f3ac83c43dc10c6deef0e6a24c7bab24ef0124b86cbc9eaf3d75bd6458d2ad87fd645e6b4ba9af6abd9fb7a0073fa3d3c3792afde
SSDEEP 24576:P4R5CIH/7oe4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFAs:PabH/rabH/pgjI45TMwwapIgTb
TLSH
T1FFC5F53271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 2.5MB
SHA256 5db0979341853d9996f89f8fbbf36155824f28df871886ca395d488a5ca8947b
MD5 0cbebe4401b065d6ae65d4851bf49c05
SHA1 f88af5bd4f82c277b21c904a1fb16670d5953f12
SHA512 5afd84f8095ff3f21ab7da24422b25f454b0e318e5c0fffe506d51dc531f9602d1cd5d7b88f370c69a23701988d0e37a5376ff1bf0d8321d739071618945b08a
SSDEEP 24576:P4R5CIH/7Ye4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFc:PabH/7abH/pgjI45TMwwapIgTC
TLSH
T18DC5F63271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 2.5MB
SHA256 9c830ad11510fd875f3ef98e13c4ce07ac4db1702c4e90ce2765816282a36a4a
MD5 691d081290d64220f140cb829531e7a7
SHA1 ebcf4bbe951b37704e25ed7846a63b95880dc9a9
SHA512 67bf023259cb8ae8cff6cfdb9aa5e71a39d545f201e517ad0a1dd386d2382c941db3c11b23ca9fb1ce46174feb6b512233ee68106c092438e110005f7a8023fa
SSDEEP 24576:P4R5CIH/7oe4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJF3Z:PabH/rabH/pgjI45TMwwapIgT/
TLSH
T119C5F53271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 2.5MB
SHA256 ae25b58f36d7e695f5f0b37edd463f1a6b06b62ee36a597ea16e9098c4afff05
MD5 bc3bb3098a0f2f0e0a68beb127f9f61c
SHA1 604fe3bcf052a139cbac7e983c4cac6c27ceee5b
SHA512 fa11933844b7520970d464c0dcb2ce420c983e86d86d2f953f263bd6e02eb70744a789394e22f103dfb862d8ca46f414113c33af28fc6aae7bdb185686817878
SSDEEP 24576:P4R5CIH/7oe4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFk1:PabH/rabH/pgjI45TMwwapIgTw
TLSH
T11BC5F53271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 2.6MB
SHA256 61e5dbfb13d4458be1991513ca5a4e713448b8d4fb853c5f419ceab67832da98
MD5 4afabd41b81e2e6b6aca3344e41016ba
SHA1 df15cf12303b843c26078d10d3c9041d8aaf0101
SHA512 8ac9187098ec02965b3a4bf5bcf3cbbf5b669f70c532e767847b806bf74803de97b1fa57303288b875317a07b4114453b5a639096c28e8666235a6383ebbe833
SSDEEP 24576:P4R5CIH/7Fe4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFOD:PabH/kabH/pgjI45TMwwapIgT0
TLSH
T159C5F722B1E2045AC58D9071DF158625B7D23C798FF183E7B285F2ED2B725C07AB960B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 2.5MB
SHA256 7fc4eac0bcc27a6f11193cd370caf322d473ebe761f7d55440787e5b2af57a38
MD5 d0adef2e7a7028318535f1d50374452e
SHA1 fe9169547a5caa088ed11d9fc63d5804b3544072
SHA512 17f439d9bda27576694ff792cb81563152de21c89e879c07e8c376a2d51a04516fd9c0873550ee8225cd660677fe42723903b9e1999bffed2c71a5b4acccc663
SSDEEP 24576:P4R5CIH/7oe4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFG:PabH/rabH/pgjI45TMwwapIgTE
TLSH
T13EC5F53271E2049AD6899071DF168635A7D13C798FF193FBB245B2C92B729C07A3960B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 2.5MB
SHA256 6695c7d371158d5b7d177a526a4c4fe184469d2fcba3905cb09334e94cfddd36
MD5 aaaaf173f15fe3da4a096b04be9e42c8
SHA1 5e27511f06476e7aabb01a0f6c867dc85344c76a
SHA512 d17c8c0022052abefea614dee7602f4923b42c09ba46c68440c462d46d10f22c77ce7ab92664906891cfdad3cc628947cdfb5bdcfc47e7a0c5dc40c778d5aa03
SSDEEP 24576:P4R5CIH/7he4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFej:PabH/oabH/pgjI45TMwwapIgTwj
TLSH
T14FC5F63271E2049AD6899071DF168635A7D13C798FF193FBB245B2C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 2.5MB
SHA256 b54c7a11ae969815cf0bdfa02f55676241dbc41b22473874a90a25c71571968a
MD5 45548efdc6f939471521e1433c8ad09f
SHA1 04c833bb228d95d80f65e2e97af7153e1fcd78da
SHA512 2710897a7ec4bd4c8846a198febd615e43792470e0899851e2e9ff0ba5ee6c19fd9859d1eb9f95b2baf9c0c88144fb6abd4d251bbcb9f69e046bf29df36a2658
SSDEEP 24576:P4R5CIH/7ke4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFMjv:PabH//abH/pgjI45TMwwapIgTiD
TLSH
T1D8C5F63271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gb.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCDD48A.tmp\gb.xsl
Size 262KB
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
TLSH
T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc

Path C:\Windows\SysWOW64\Drivers\2026-07-23_e6497846e9f283b1a188f60738432a19_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc
Size 7KB
SHA256 1b0e02230bf83cffe4c6b690d2fb4a06214b06ce8c78ced8187d6c2c8c8057d8
MD5 a00a160cb4bdd6863db8a71a8b9eba67
SHA1 4446ef7aff1739321df0e636dd19051d8a9c8cb5
SHA512 f4e53935f2da2fadbe673f040749b37b80c358e647d97bc25d2c3456a9b7e6f661e11ec388ab215b666d2cb86ab6de909268cb255d812c5b2f50411029260100
SSDEEP 192:uUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU3:V
TLSH
T1B2F122B6E70E1BEA2E38716E51E90AD219BA6C8A00085E4370808A66406BC22803278D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 2.4MB
SHA256 ac485746828f92e99042f15545df490ac18f689b8debe85b031fc8e3da268909
MD5 69cf5b1b3d323de8673f476b6840498e
SHA1 1a0caf1e83d863bf222e6b85941067677c811f41
SHA512 07a95e55b468118f3a1e67e226d86bfff19d1e8eecbbe63366c94dae1d06466a9e885b43b3117d93b705d89bd837a69695655d19d78fad491a00240f3ea280b6
SSDEEP 24576:P4R5CIH/7Je4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFM:PabH/gabH/pgjI45TMwwapIgT2
TLSH
T13AC5F53271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.4MB
SHA256 e452a359843cf9788020c6d0147ac5cfd71f0c2a7ff08a952d12f66b95d0e006
MD5 919ae75aa6b0173cedc225d882627c74
SHA1 c7da6579a2801cffd2ebbc7cd966c7598eb0ebf7
SHA512 8a6e3e62855f0f6f9baa88aa4ae391bde516e0f93e0620f845ee16a40dcb6cd84da70bae51e1f1bbca03b38d61953a2af25cff0f2103cb1054314f97c6d2af6e
SSDEEP 24576:P4R5CIH/7he4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFM:PabH/oabH/pgjI45TMwwapIgT2
TLSH
T1EAC5F53271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.4MB
SHA256 abe819b50b86574d4885ddd4c0727be3324e50f480dfe01fe79878570a04532b
MD5 e3f58f8e61177d1a3d7e874ed34e2868
SHA1 c1119d272cb52fa89ead006e8f9a60d9b00793ba
SHA512 cb7caa8b2418d2d6e653f22bc73975249314e13ee7d453798b4a26ef6dfd58d27c41aaaa27053489b2b16d863b53b08b84c030e1e10ad26ec250a8db6f8faaa1
SSDEEP 24576:P4R5CIH/7de4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFM:PabH/MabH/pgjI45TMwwapIgT2
TLSH
T12DC5F53271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.4MB
SHA256 5a574f5da5a1c15f77a4bd599e1615e3d7d1ef6a6f806ad5a6323ce4de4222b3
MD5 7a81c30d72843c5b7db023d07b0b3ff3
SHA1 121c42970f2adbd0518a145791a6ad45d6c0c4b8
SHA512 917ebc54c2ed7297480ffbec4a052486a15e5e9eba06074907a594b72590a1bedd87e009d1bc98f5cc22158041ef4f3151c88b9073754ac6a6fa3b1d11d90739
SSDEEP 24576:P4R5CIH/7ke4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFM:PabH//abH/pgjI45TMwwapIgT2
TLSH
T1CEC5F53271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.4MB
SHA256 cd2165483a7c9438b45fad675f56d223c57a2ca38254f18002e9c5d2f1d73699
MD5 c50b44a09515b98e54e0830a13b81120
SHA1 6627ed0c70251630d3a6e91a015e9dd34c4cd7cd
SHA512 61d01b8f003ab48b3b451648e42cb61e3742a599569823cfa1358f75771835de4761a3f9c3d5f28cc0a040bacd381338689163677f2bbaa6ebe3abf49bec3318
SSDEEP 24576:P4R5CIH/7Ye4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFM:PabH/7abH/pgjI45TMwwapIgT2
TLSH
T1A5C5F53271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.4MB
SHA256 562c7e3fa924aac53d0764869a050c37c37ebc758728aa5566cf18a884117ead
MD5 02a99a60a61dcf809d8dddc927745f9a
SHA1 25b5a7422abda4a33db6d565c67d3815dad6aabe
SHA512 21edc5ab0b0228265c7ed529661e08ba4f2df79dcb3324858ab828cad01f730c17f6737b79ed06510087eeb7db6c4eb49efca9b441fa9dbeb67de45b9c450981
SSDEEP 24576:P4R5CIH/7Fe4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFM:PabH/kabH/pgjI45TMwwapIgT2
TLSH
T1FEC5F53271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.4MB
SHA256 0d4d9c727ba734b98c0e498ab10d2399cda79f0ca97885daa38618dabe0cd9f2
MD5 3202d2c5d9d73e44cb6dcdbdbaeed0a2
SHA1 be6d3e1bcbb17409cfd7a3385123085e004619c8
SHA512 a36c5c8112e577ee40d080f5c8575dd00dab0a687406faae37380b20089a9e021164b512f6cbe06c79db7cceca1e6989e8728d66ae193085645403fc7485f907
SSDEEP 24576:P4R5CIH/7Ae4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFM:PabH/TabH/pgjI45TMwwapIgT2
TLSH
T145C5F53271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.4MB
SHA256 32378636dbf7ada596c9f221216fbbd2295abd47fb9ba0e7b74284dd20469299
MD5 b13be193efbd7287ab69002a8f73bd04
SHA1 c15cf569674ca02f1703defe430bf7b1571b09e1
SHA512 6d3335c389884f9a7d309ed5e98f1582606b440d25164bef968a4c98963780fa2580d779d45da47b969298d01e8c05c4971652b853c1564976fa79d78963fa46
SSDEEP 24576:P4R5CIH/7ye4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFM:PabH/RabH/pgjI45TMwwapIgT2
TLSH
T14AC5F53271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.4MB
SHA256 3cc7941186f35a4846300e6ea33fab36b19b9e5470c13dfc663a6a1e99bd47ed
MD5 563aa75a6f5c5433940e18b355a42045
SHA1 abcde284d80640b0d3c38a8f0ab7c4364eb87a04
SHA512 fc46c56c66ac2073df17e19c941c322f012f13fe2de8e8b583990295db625143de1410e30da25c9304b822046b84283482cb8ed56225ffa45c7b87bb6ef08fff
SSDEEP 24576:P4R5CIH/7Fe4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFM:PabH/kabH/pgjI45TMwwapIgT2
TLSH
T163C5F53271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.4MB
SHA256 d0137472997c01bdeb6b1e93cf90f0fd995bc8660af982fd14997ccb36abf0c5
MD5 c8a1c8160e6cbf38e86dc62ab86c5b84
SHA1 f52d2fd1e3217332aad3edea5465a8afc77a133e
SHA512 bbcfc45da04a48b6dffd264dedc77ca619b05b16a13af4603503f464d75f4f50a36a6df0d40db16a0e672258701f2edd7671464dcedf776e5ad5b19d77b00431
SSDEEP 24576:P4R5CIH/7oe4R5CIH/7WegjI45bl9Mbonwap41+zzPTThwv3EJFM:PabH/rabH/pgjI45TMwwapIgT2
TLSH
T132C5F53271E2049AD6899071DF168635A7D13CB98FF193FBB24572C92B729C07A3960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4100-41-0x00007FF8B05C0000-0x00007FF8B05D0000-memory.dmp

Download

memory/4100-40-0x00007FF8B05C0000-0x00007FF8B05D0000-memory.dmp

Download

memory/4100-35-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp

Download

memory/4100-36-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp

Download

memory/4100-39-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp

Download

memory/4100-38-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp

Download

memory/4100-37-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads