b16adb4b91f7d6de7ecb8b58bed87720600f8b8f65f2233198057d919c6f4d00

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 10.0MB
Sample260723-vc3d3ashqb
SHA256 b16adb4b91f7d6de7ecb8b58bed87720600f8b8f65f2233198057d919c6f4d00
MD5 853b09dab3c264536ec0e55933b9e9eb
SHA1 f95764f5fcf182c66d0fa6b953fab6243a81a057
SHA512 0a783175534bc4b2d094364653aa77d10b4b16355ca2eb06d8267ad7c03d2c98f2d06a29a4a9cd47a8e59a1f101e996bae11c66fe3582952d9969bad3bbbfcee
SSDEEP 49152:wabH/xLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpi:3sr0oAaldms
TLSH
T1FCB68C17F29500EDE45AC07897969536E9327C590720B9EF13C0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
2312	UpdatAuto.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dayget.dat	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3204	sc.exe
3104	sc.exe
5656	sc.exe
3452	sc.exe
3260	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3336	cmd.exe
4072	cmd.exe
820	cmd.exe
964	cmd.exe
1808	cmd.exe
5852	cmd.exe
3864	cmd.exe
3176	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
6092	WINWORD.EXE
6092	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1552	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2312	UpdatAuto.exe
6092	WINWORD.EXE
6092	WINWORD.EXE
6092	WINWORD.EXE
6092	WINWORD.EXE
6092	WINWORD.EXE
6092	WINWORD.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 964	1552	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 1552 wrote to memory of 2312	1552	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	91
PID 2312 wrote to memory of 1808	2312	UpdatAuto.exe	92
PID 1552 wrote to memory of 6092	1552	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 1552 wrote to memory of 4824	1552	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	95
PID 1552 wrote to memory of 820	1552	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	96
PID 1552 wrote to memory of 4072	1552	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	97
PID 1552 wrote to memory of 5852	1552	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	98
PID 1552 wrote to memory of 3336	1552	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	99
PID 1552 wrote to memory of 3176	1552	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	100
PID 1552 wrote to memory of 3864	1552	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	101
PID 1552 wrote to memory of 3452	1552	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	104
PID 1552 wrote to memory of 3260	1552	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	105
PID 1552 wrote to memory of 5656	1552	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	106
PID 1552 wrote to memory of 3104	1552	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	107
PID 1552 wrote to memory of 3204	1552	2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	108
PID 820 wrote to memory of 1364	820	cmd.exe	119
PID 4824 wrote to memory of 3932	4824	cmd.exe	120
PID 1364 wrote to memory of 3264	1364	net.exe	121
PID 3932 wrote to memory of 6012	3932	net.exe	122
PID 4072 wrote to memory of 5520	4072	cmd.exe	124
PID 3336 wrote to memory of 2708	3336	cmd.exe	125
PID 3176 wrote to memory of 892	3176	cmd.exe	126
PID 5852 wrote to memory of 4712	5852	cmd.exe	127
PID 5520 wrote to memory of 3844	5520	net.exe	128
PID 2708 wrote to memory of 1444	2708	net.exe	129
PID 3864 wrote to memory of 1564	3864	cmd.exe	130
PID 892 wrote to memory of 6064	892	net.exe	131
PID 1564 wrote to memory of 1052	1564	net.exe	132
PID 4712 wrote to memory of 4528	4712	net.exe	133

C:\Users\Admin\AppData\Local\Temp\2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:964
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1808
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\system32\drivers\2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:6092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:6012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1364
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:3264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5520
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:3844
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:4528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:1444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:6064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:1052
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3452
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3260
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5656
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3104
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 10.5MB
SHA256 cae0bb1ed3a5e4ec0a77cd784911f024a32a59642c71e56fecda84de33c4960d
MD5 40717b262613a84f9e31b033d7da8826
SHA1 a29a58afe600e15aa0edc632e8a86295a9db48d7
SHA512 0292c302cbec78202b3e9ea09e9522d3e2a7a27ccaaf11cc424a9aff7263164194ac45b6a1b15960dfeb5acffa38172b80effd6eee0704808492823dd60a1ce9
SSDEEP 49152:wabH/9Lh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpCPji0Aj:7sr0oAaldmSjo
TLSH
T180B68D17F2A401A9D06BC079C7969636E9723C550730A9DF03C0E7692F37BE16B3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 10.9MB
SHA256 1fad811191ec3046f2700d6b1e3e4685cf3f9cc985b73b282bd6d6d1a07f58d9
MD5 3cec6258d9ea790c31d0cc1ac223ccbf
SHA1 7cbb26864c766204b427c9ea79baf63398faac87
SHA512 45b67f15e8e7a67b2743036f3ce0b7fcb2788ce1c370fe6713bf9dcc3a09be7057740eb8b5f7f2a2e74fdeeaec2400e344c25b95d62efd09c927851c6f7f943a
SSDEEP 49152:wabH/9Lh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpV/ezSC6vUzPvMHjy:7sr0oAaldmPezSC6v2XMH
TLSH
T120C67D17F1B842AAD066C0B9C6D6A636FD323846073099DF0381E7693E37BE19739725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 10.7MB
SHA256 2536281eb63ebd2cf89b7b137e45d1b06b2940e8f7b0cd4a037ea4a09a91e06b
MD5 ee658bc715d6a1ad0175e09092ffee93
SHA1 5f8e663faeb49afd19fe0926eba5c3f7d7310846
SHA512 4b508bd79e4501fe3b7761fd91c43115dcf3c5a5ea0e6e2757a88b15aaded09fd0c78eef51941ef1b425d8b32780cae00de7e6888bd2edb75656b6b5b588e317
SSDEEP 49152:wabH/0Lh+fuF+Cq99LyHHI+t6O8N+ailEy6dmp6VO88hXl+:Osr0oAaldmP/h1+
TLSH
T105B68D17F2A441A9D067C079C6D69636ED323C450B30A9DF1381E7692F37BE1A73A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 10.0MB
SHA256 ab544322dad3ec1f4b54d6f1dd8fa15ad2f3c2ec5340057e5b46841dfc93109f
MD5 78aa03bfd18cd4341dcc8c7eeaeace91
SHA1 af03103514e422d6007869c5b72bdfbe7dbd9277
SHA512 d51781c1c900429af07a6f3842673dd7f2a404ab044ab67592529aef3080128c83724f7502db9432e6de6ad71097b6c35c428b14ac80f9a7ed9e40ff511c5f65
SSDEEP 49152:wabH/yLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmp:Isr0oAaldm
TLSH
T1D7B68C17F29500EDE45AC07897969536E9327C590720B9EF13C0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 16.1MB
SHA256 c7022c855426939df6973bde8316897f6d55341f2fe6bf078da0833da39a517e
MD5 7e79615a98998a27893587a0ca415c49
SHA1 16c8d136b48f2c91f04615736a64f353191878e0
SHA512 5e02ede933b0f428e9ee7bcb8fdba35ec65e53de8a44ebe268d641b31b91b4bfc0341d14459942a18c89b6db583146f33c48381a76ed42c76b50473fab14af27
SSDEEP 98304:Esr0oAaldmOQRQyi36YOcP+Lvw2gAf+PN34:14KmVQyiKaUX+PNo
TLSH
T1B1076C13F3A501E8E05ED974CF3956329A357C4A47B0A2EF269436E51E72ED07B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 11.7MB
SHA256 f80c256270875ddbde80557f7d3599f6fdc3205f8fddd7e33934432df5ca5a93
MD5 76314a78b40b3986874e06ce04e20bd9
SHA1 cf8a0d3aa00c1e8c43b74a95dcc053d10e4c338a
SHA512 00ae585202c1656323390d25d3e6ac3904a8683bddf09fec7afb5ee2d52cd237de2320e4dad39fd4915f5ef75f9af02dc2304ba39781e1ca4823c28e4a2ea6c4
SSDEEP 49152:wabH/VLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpl68Qg55nhoeWu7PNU3/Q:zsr0oAaldmpthHRc/Q
TLSH
T143C65B23B2E600E9D44ED0759B469632E5E27C658FA0E7DF428077162F73AD06B3D70A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 13.5MB
SHA256 15e0a1fa122bc48886813440b8d72fa9536438d9a85ad5033709d85312f5f3f5
MD5 277c5af651ffc455b032136d6ec2cb89
SHA1 517cbc32cc4a1bc7d806e9cf6e12df19b0ca4ed6
SHA512 909d4dd744427be5179e0648c0c85de7997a7e14cd874b0a04f1b0f47fb58226e5f68caa010467ae7bcdd949cee4bb35399f4c4ee77b17c175f300d783dd428d
SSDEEP 98304:Esr0oAaldmIy5112gYy5azzVvf69nLKnhZO:14KmhLIHuWhs
TLSH
T144E67B13F29900E8D05ED179878A9232EA72BC560B31B6DF0690B7562F77EE06B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 12.3MB
SHA256 c22c30ac83294dcc4e9553636552bf6a47c0997f342a637f24dcfd1b920a3556
MD5 5f9f2966acfca9e366822c9295966e2b
SHA1 41aa9566df8ade037b8a11ef31bd92ed570e1676
SHA512 434fb63aac9c7994b91466bc5adaf32a125f825428ad0d1874334c41ac2d72f895b21491c5f90ee286c70aeca3ac0a45aa9f157511c5e424c9ab6eabccca6761
SSDEEP 49152:wabH/VLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpGB+taZ3usBWOBr4tEGW0bqx0zb:zsr0oAaldmyu6Jm0xd2d3
TLSH
T1BDD67B13F29900E8D05AD078975A9232E972BC590B34B6EF0790B7562F77EE06B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 11.6MB
SHA256 cf4fa9a40583e4deefcfe4189d55d560a171e4c5d185064adf2dd23e3c5eb682
MD5 e89e7cbc1f9d43ee3e15f4aaab1d6b3a
SHA1 719a8cc951da6dfdfb041185796dca41a2aeda7e
SHA512 62bfb45cac93e96c15957ec086237b4256b2938327e827319e570df141a9333c269da0b5d9e4807194db7c8ef2ab4cdae707ea4272db92a4d12dd5dcb9a33a6b
SSDEEP 49152:wabH/mLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpo1hpsNoJpF1A6GU44CwH7R4xu:Esr0oAaldmCmifP5R7
TLSH
T109C68C13F29900E9D05AC07897569632EA72BC5A0B30BADF0790B7562F77BE06B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 11.9MB
SHA256 cb0cac13e744250b41c8acb6b018a4c325426e5bca984bcd0907b194f53b9ef0
MD5 cf6e04693db1b5b657aba861631bfbde
SHA1 265f5c598cf9ee2d7da3311648c7b3a0f206510f
SHA512 c73f5a5c65786999dac04b4f2429e523e098d8a120edb6cd48e3d943d28ba0219a8d7909ce5371f72c79481a126ba9a4e111cf10ecf491e40857738f2996d132
SSDEEP 49152:wabH/mLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpFSuZQIY0Be2K8RVtOnks6NMHq6:Esr0oAaldmJ5dKCi616
TLSH
T18EC68C13F2D900E8E0AAD17897669236EA72BC550B34B5DF0780B6552E37FE06B3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 13.1MB
SHA256 66b66cf505facfd792a4ceaab82a49bd1dd07b56b2c833634ec40e2bb2ef4df7
MD5 3ff6f6886f9222903846e22d90e1ec88
SHA1 8bf71b8ed8b01f892d9d1813418050d5325a7f19
SHA512 3cea0d949057d99eed17e730156f56e1db6993d6a3579f811f3f31288ee43dc9fdc1b52cc0de3f938309d0064ae3f19204e46c8879919de004972a7f16690008
SSDEEP 49152:wabH/VLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmp6yLSrJhMeJNvjLAE3dGGj8b2EB:zsr0oAaldmTm7vj1BDlZG
TLSH
T177D68C13F29940E9D05AC078975A9232EA72BC590B30B6DF0790BB562F77BE06B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 11.4MB
SHA256 2cbef931354f65e5e5e8c2d85b3baa920ad7449bea506575edd136e77f503fde
MD5 dc75e001940a16cdf05f10e2ef997ae1
SHA1 84e2261d3d428f60a9cb1e8e1aa469de79f46dd4
SHA512 82016750aa5e061b05c3e9373811b952b99b0b027f30eb1552fadff51a3bd1fc8ca58a82312b1aa130b4aaf7ea559cae9ebcbefe055e31ab28b2b43ed6be271d
SSDEEP 49152:wabH/mLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpDhtSn8EApI0fig1giDn0AP5w2:Esr0oAaldmEX2iwphX
TLSH
T158C67B13F29500E9D05AC178C7569632E972BC560B24BAEF0790B7662F37BE06B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 10.0MB
SHA256 e9713eeda8566e2442287e28f2b4271aa59b35e17d9af5ba905bcaa16ba82d79
MD5 33b3af5584c3365d12eebeed444717cb
SHA1 476a07114e8cf93251b4d0390c453cb27db2cb3e
SHA512 b2ad80bddfa40c95eaa24b7e4c96a8af679b02b2f6f47eff88b7ab0a4c83decaa89e59a064e38fd5f0b15d2381f35167bfb92467dec3fb74fa8ab63ade9e345d
SSDEEP 49152:wabH/aLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpb:Qsr0oAaldm1
TLSH
T112B68C17F29500EDE45AC07897969136E9327C590720B9EF13D0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 10.0MB
SHA256 197007cb38613215aaf236b9c7ba616c4e4b869abf87d5456f0caa998b434a85
MD5 a4d41a76884cadea8dbb7101d13f4ac9
SHA1 9fa39b07711bdaf74c5b5068c23b312c7137f8a2
SHA512 45a940e55f4e1c5419aa26bfab5c8658c4759e0ab70b4b0bbbe9642fcfa3e46e96d48604cb4b7a38b874a276f4fbb263f9322784bab7f51a1fe5f38d5fddfcbf
SSDEEP 49152:wabH/aLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpM:Qsr0oAaldm6
TLSH
T1E6B68C17F29500EDE45AC07897969136E9327C590720B9EF13D0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 10.0MB
SHA256 a3e66557994046468de26d1f9097b5036c181fe1585b430c8289b674ab46425e
MD5 5c89ab27ab98136b7200f1b433bde73c
SHA1 789e4fa96a3330b6c9818ea4f4f799d533b5eb05
SHA512 404f53265290f12abd81e5103185052e124c92a1d377fa158726613e41d1ca074325a32f80b449735c7a9a33f43fbbb1c3d4e664a0cea71f4e76651dc3654471
SSDEEP 49152:wabH/qLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmp9:Asr0oAaldmf
TLSH
T1ADB68C17E29500EDE45AC07897969136E9727C590730B9EF13C0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 10.0MB
SHA256 70a1bb3800939a0cb79ffad1d783bd6b0ec4f8a221371e260c1d4916eaf38324
MD5 9b61a76aed1d39ff2be1405bec1f3635
SHA1 2e821e525e30b6b3e88d8a6db647c6ee8aa90de9
SHA512 3f481483e47b8942ac23ffa468cf04b1c50c9f49e994511c9b4834d446ecf01ecc76946dd07822955497c8796115d3cd45c57168c3fd793b5237a1384889d9bf
SSDEEP 49152:wabH/aLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpI:Qsr0oAaldmC
TLSH
T1F9B68C17F29500EDE45AC07897969136E9327C590B20B9EF13D0AB652F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 10.0MB
SHA256 850dfff2df46557fb10cae930aeb0fff3d8956d27eac5953da0b7762ac979847
MD5 da2a82b6172c26f0f80dd670152050bf
SHA1 b22e7e578b0e5ae7c01bbf6a4c5212f9382a6c5e
SHA512 bcec90e542aaee48c7b87de63f33fe3d4e55d03cba34d19b04fb99c0589ba247da22f31eb86419bb7d262af7256658d33d95a3b2d990a944f597759ed3a78b1f
SSDEEP 49152:wabH/aLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpf:Qsr0oAaldmd
TLSH
T15AB68C17F29500EDE45AC07897969136E9327C590720B9EF13D0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 10.0MB
SHA256 2ba1198655ea395245b183de3486782a8d6912d21caf6fd4935e4dad147d285c
MD5 994d9ee12119b70c64be43fa48831802
SHA1 9974b3b1e880c729a93818877aedb8acbdf4f36e
SHA512 b9ab5c1b01b71d17ebeee323fb8cc2954ee1286fa9b07bc2e41dd7eb4f5c242b07d9b62263be38f8ef8295cb004ae02a376c83b5bcdc8918ee4e0138a153baf5
SSDEEP 49152:wabH/aLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmp8:Qsr0oAaldmK
TLSH
T16CB68C17F29500EDE45AC07897969136E9327C590720B9EF13D0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 10.1MB
SHA256 407390252af83cede4cd57e004fde3376f670e30fdd5eb81f311e3859b101e93
MD5 bb58b39752919ac4bd4d22d3afd8b820
SHA1 8948e2aeb4016a49600ee6e9eb3efc8f8d055176
SHA512 31192b6bda001d08e8a0213d7541fbfde662acf3f591f7b6d373c26a891fa4f40ebdd6c07752e914a05e908b0edea1693b65cfdb31e0afe0565623dea5a11020
SSDEEP 49152:wabH/9Lh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpv:7sr0oAaldmx
TLSH
T1CEB64817E29500A9D45EC078D7569532FA237C5907A0A9DF13C0E67E2F33AE06BB9B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 10.1MB
SHA256 40d0cc0ad95da24a97dc8b818d012ab84961150e027fafa77bde9463a8de0ac7
MD5 bb23daa549774abb92c46db4d1a83983
SHA1 30cd1a1b37b04d4ba33f05991ed84c425455c443
SHA512 fc29fbe1f909b5a88c8ea6bff5c3effbcc70fa6e4515a4858aca894ba0287e654ca1766a40106ca011e693832928abb0d5e5153e035aceaa53bbe7b800eb0f25
SSDEEP 49152:wabH/aLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpD:Qsr0oAaldmF
TLSH
T1F2B68C17F29500EDE45AC07897969536E9327C590720B9EF03D0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 10.1MB
SHA256 a474da795b5761e50f444cd14adefe14fe9ff95a1edd5dcd32fc0f0e7814be44
MD5 ece8221d09413eb0a41ffb11687c6f36
SHA1 b5c8c6bce967a19819c063f6d76062b2b011f81d
SHA512 25a0093bf21410feb22759b8e6a73ce716c759f0f30577ccccd86452dc6adab1c4973a06c5d9f9305a0ea4617cb6d8cd9c6d613a21dd379510cf9b4ebb02fbcf
SSDEEP 49152:wabH/JLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpxj:vsr0oAaldm/j
TLSH
T126B68C17F29500EDE45AC07897969536E9327C590720B9EF13D0AB662F33BE06B3DB06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 10.1MB
SHA256 07347b35cd9e5e7531b765e2acb40bbb79ee3641582e0608d1c3d096a58c2931
MD5 82f8937bb5101e1490ff86e10619d264
SHA1 72448137182ee96b544440b0a2186804113f6890
SHA512 cbb1620f8db8f337147e668b8d9e4c09d53caa5b17b85ec1cad6b2f270b2fa5d0074606005c214435f15dcc6c3ca40eb7519b09300e08d89153d1287e165e130
SSDEEP 49152:wabH/mLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpzD:Esr0oAaldm1D
TLSH
T127B68C17F29500EDE45AC07897969136E9327C590720B9EF13D0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gb.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD30B.tmp\gb.xsl
Size 262KB
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
TLSH
T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc

Path C:\Windows\SysWOW64\Drivers\2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc
Size 3KB
SHA256 749b6ea1a9c5fcfd00354e886d27a3ea3f11c1e859c12b0774c27bb6f71f8f67
MD5 104fe98b2d35e2911dad3968603f737f
SHA1 e9889a8936fdbc474faa482842cb3b9bd6e163d8
SHA512 792a8b2255113f7a06bd350285185ab955d54e1173ce45405ba1893d3f0698635234d2ef4bbb293c22f586741a3cf8cc63d3748b17c6a454f729b559b7845a01
TLSH
T1778112FF701BBC607A13249DE4764093557D3390AB6284375204EA0D1C14E6317F6C40
MD5 SHA1 SHA512 TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 10.0MB
SHA256 6af0f04aeb89e9cd195836f58675ea71da1299074d68c93986fc649783a1308a
MD5 85eb1a59a913d38535ef73b7c5e21617
SHA1 b80cf2079d092504d02a41ea11aad71ca77cfab3
SHA512 c2ce14a7c3e7fa6f581f618137e152efa078eb3b20597b0fe4a8b95fbcce5a77dc3b8d06eb376e4996736911a725bdd09c49ec63fdf1e8b8b642b7535ea78462
SSDEEP 49152:wabH/xLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpz:3sr0oAaldmh
TLSH
T143B68C17F29500EDD45AC07897969536E9327C590B20B9EF13C0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 10.0MB
SHA256 3598cac97f34aa73a2cd2499b6c627c68f2eb615a38af8c018a24a24b3695947
MD5 b7cd90370e05e50e5d6672ce63b963b9
SHA1 4e3321035a6f6f8e7ecc78461b37e5052ec67ae3
SHA512 622864f686c44d0bbff0b5796d045dd8a24c1de87ccccc12d87ef3c7939e72ff8fa99906f0ac4948c8af2a2c2daf2fb77ee8de3fd102dccc8c66e466dfe7495e
SSDEEP 49152:wabH/mLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpz:Esr0oAaldmh
TLSH
T13DB68C17F29500EDD45AC07897969536E9327C590B20B9EF13C0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 10.0MB
SHA256 42b3ccc1a0f282b3dbeb16bc2c9955fabb063166168b1eb15d39aa7637c47809
MD5 4be9fcd70c0a5f87902705db4a10341c
SHA1 5dccebc4cd8e85828f89166b2c75ec6e365b77b8
SHA512 c24efe389092577aa1230c8eb546f65cf877578e29ddbe28834e966446b8d2957caafaeeab803b7706814f46c4d274767ec9300173949a9246295267c5027701
SSDEEP 49152:wabH/VLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpz:zsr0oAaldmh
TLSH
T1E0B68C17F29500EDD45AC07897969536E9327C590B20B9EF13C0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 10.0MB
SHA256 8cdfc03196365de426269227bd9e9c8a9e263afe33eb5f99479fcc75ce5568ff
MD5 6be71f6de1e9e4fbc61638b2b07b9358
SHA1 ed19995f6634b366b2b170bffab73f52c9e9def3
SHA512 00e08b1390df0a8635722c040fa7d8f40246698ce2eae097f8ba390fac58c50ccc61c72c167abebc08847b64c4288cdea5e991afdadb986fb53812830137a2dc
SSDEEP 49152:wabH/qLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpz:Asr0oAaldmh
TLSH
T1F0B68C17F29500EDD45AC07897969536E9327C590B20B9EF13C0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 10.0MB
SHA256 32e7d82e8a76840b921360fe1915ee7113c22b6bd2b06429d09a1e199ac1c5f8
MD5 d134ae3d2442cc686a956a82c038dc32
SHA1 abed95ce0bb6d1534039addbb05ca1badafc5af6
SHA512 4757184c58a704693b5adfddbbb2edcd9a6eb0cf0e4206821cf1b989ef8bbc6e3ee033dc7820d874f87c494e14e311e94d798fe8b1a79df7bf381cdd4f581b08
SSDEEP 49152:wabH/9Lh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpz:7sr0oAaldmh
TLSH
T12FB68C17F29500EDD45AC07897969536E9327C590B20B9EF13C0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 10.0MB
SHA256 bc2d423b01a70484f3734daec59c3a946d8e84d428ac1241225df6ef7e218583
MD5 0325d9afe53eacda3285d0d1c20c14ea
SHA1 40d1b9287f86327019063ce8f22b2fbeba1c197f
SHA512 00dc3c03fdc28f4d47dbd87f62747e202381ba1c17e4d1d0e73f9bb61c28d05d3040a1667e3f086bd465839da98d49a771f24e602ef0cee004c537948716b6dc
SSDEEP 49152:wabH/0Lh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpz:Osr0oAaldmh
TLSH
T162B68C17F29500EDD45AC07897969536E9327C590B20B9EF13C0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 10.0MB
SHA256 851e156add69ce0c41de67e799ef15350f4fb43e44574283cab7035ee8adf8fa
MD5 40a304520ce9146c192d4d8ba85306a4
SHA1 3c41e025ac0f894b1445302d16f6f0f625004084
SHA512 31ad16ac7a3bd329273cd26d98654f5d87cd22a1c9554b25e69170af43b78874cf8dfd81d0a50ee0b73c64790ad3c63bdce0292777c0f0ae99774424a70ef59e
SSDEEP 49152:wabH/yLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpz:Isr0oAaldmh
TLSH
T162B68C17F29500EDD45AC07897969536E9327C590B20B9EF13C0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 10.0MB
SHA256 4168176ada50c151b71074d5b84bb0eef6f923ce1a4b37ac23d73f2653c8e665
MD5 9a5eb4e27f63f91307c3577427e5796e
SHA1 0220483abade1e9b69946afd5286cc025b908413
SHA512 59ac70a0d1edf6fd2eb88b0bd16dc3e0389ae1d159477a4a02eca1bfc13b92751462f220cb74da2d75f755302e7977ccff68f5822cf1636bbe7d158d03e6a43a
SSDEEP 49152:wabH/9Lh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpz:7sr0oAaldmh
TLSH
T1B7B68C17F29500EDD45AC07897969536E9327C590B20B9EF13C0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 10.0MB
SHA256 06192b77907fb0d360679294032197847bcb06da214f1c1147cfd6c13ba75b2e
MD5 fa3adb946b77e3f28876826f49284f5a
SHA1 78ee9be9aa921208c3d9fc9b72ed26204941e1f5
SHA512 f31cdb61c21fa011f388c4d1eed84c99801c46a3cfe1e0a54c0b618c963367f74c9b55c22a7987273b01822e374c0a92e525a4876774cf68364cc761321a8179
SSDEEP 49152:wabH/aLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpz:Qsr0oAaldmh
TLSH
T174B68C17F29500EDD45AC07897969536E9327C590B20B9EF13C0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 10.0MB
SHA256 7d59e34d58452c535ec0dd7c8c81e25b800df30cc73c0b4a2fa4b230aead966b
MD5 3cf626968070ed966beb22c6fa5cff4e
SHA1 fa32dd9c0ab2f6da797ee03d75a3e51769d7cf34
SHA512 a35c70b34c0759185789e58e57913e1e7a9e73f4555553c65ab8c74a0f911a59e37f02691e5adb093e6003c5be9c79b384f468e68cc23286fd89c614cf4affe7
SSDEEP 49152:wabH/JLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpz:vsr0oAaldmh
TLSH
T1EFB68C17F29500EDD45AC07897969536E9327C590B20B9EF13C0AB662F33BE06B3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6092-37-0x00007FFECFCC0000-0x00007FFECFCD0000-memory.dmp

Download

memory/6092-35-0x00007FFECFCC0000-0x00007FFECFCD0000-memory.dmp

Download

memory/6092-38-0x00007FFECFCC0000-0x00007FFECFCD0000-memory.dmp

Download

memory/6092-36-0x00007FFECFCC0000-0x00007FFECFCD0000-memory.dmp

Download

memory/6092-40-0x00007FFECD870000-0x00007FFECD880000-memory.dmp

Download

memory/6092-39-0x00007FFECFCC0000-0x00007FFECFCD0000-memory.dmp

Download

memory/6092-41-0x00007FFECD870000-0x00007FFECD880000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads