9968fbf730aee06197119c4ccdb06d6347f21d9a306c4920d96371c7e891bc24

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 10.6MB
Sample260727-d8ybjsgn5s
SHA256 9968fbf730aee06197119c4ccdb06d6347f21d9a306c4920d96371c7e891bc24
MD5 e9a5714be5add630502e7441dbfe893b
SHA1 7e9ba305e8ba3854ee8c3a3943290b248ac2b65d
SHA512 562a82bc60a1d3d0370d7d26add61162a3333a399191acbcc8a06a2857909e3e266079793aeb28969e534e42d70b427eade6b3f55529aab485169a3deec52758
SSDEEP 98304:jLapIqLapIULapIqLapIt0oAaldmdmnp:jcIqcIUcIqcIiKmd0
TLSH
T11AB60623B1E2049AD6899071DF06863597D17C7D8FF193FBB14572C92B72AD03B3A60A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
2712	UpdatAuto.exe
300	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
3900	UpdatAuto.exe
3416	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\UpdateSet.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\UpdateSet.doc	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3008	sc.exe
2732	sc.exe
4944	sc.exe
2072	sc.exe
5056	sc.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5824	cmd.exe
4176	cmd.exe
5976	cmd.exe
2064	cmd.exe
4112	cmd.exe
3600	cmd.exe
4308	cmd.exe
3412	cmd.exe
5604	cmd.exe
5816	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1932	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2712	UpdatAuto.exe
300	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
3900	UpdatAuto.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 3412	1932	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 1932 wrote to memory of 2712	1932	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	91
PID 2712 wrote to memory of 4176	2712	UpdatAuto.exe	92
PID 1932 wrote to memory of 300	1932	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 300 wrote to memory of 5976	300	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	95
PID 300 wrote to memory of 3900	300	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	97
PID 3900 wrote to memory of 5604	3900	UpdatAuto.exe	98
PID 300 wrote to memory of 5408	300	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	101
PID 300 wrote to memory of 5824	300	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	102
PID 300 wrote to memory of 4308	300	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	103
PID 300 wrote to memory of 3600	300	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	104
PID 300 wrote to memory of 4112	300	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	105
PID 300 wrote to memory of 2064	300	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	106
PID 300 wrote to memory of 5816	300	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	107
PID 300 wrote to memory of 5056	300	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	112
PID 300 wrote to memory of 2072	300	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	113
PID 300 wrote to memory of 4944	300	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	115
PID 300 wrote to memory of 2732	300	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	116
PID 300 wrote to memory of 3008	300	2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	117
PID 5824 wrote to memory of 2440	5824	cmd.exe	125
PID 2064 wrote to memory of 1676	2064	cmd.exe	126
PID 3600 wrote to memory of 6136	3600	cmd.exe	127
PID 4112 wrote to memory of 5048	4112	cmd.exe	128
PID 5816 wrote to memory of 5632	5816	cmd.exe	129
PID 2440 wrote to memory of 2456	2440	net.exe	131
PID 6136 wrote to memory of 5592	6136	net.exe	130
PID 5048 wrote to memory of 1800	5048	net.exe	132
PID 4308 wrote to memory of 944	4308	cmd.exe	133
PID 1676 wrote to memory of 2708	1676	net.exe	134
PID 5408 wrote to memory of 3272	5408	cmd.exe	135
PID 944 wrote to memory of 1844	944	net.exe	136
PID 5632 wrote to memory of 5832	5632	net.exe	137
PID 3272 wrote to memory of 5260	3272	net.exe	138

C:\Users\Admin\AppData\Local\Temp\2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3412
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4176
- C:\Users\Admin\AppData\Local\Temp\2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:300
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5976
- - C:\Windows\SysWOW64\UpdatAuto.exe
    C:\Windows\system32\UpdatAuto.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3900
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5604
- - C:\Users\Admin\AppData\Local\Temp\2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
    2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
    3⤵
    - Executes dropped EXE
    PID:3416
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\Windows\SysWOW64\net.exe
      net stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3272
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop sharedaccess
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop wuauserv
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5824
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2440
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop wscsvc
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Windows\SysWOW64\net.exe
      net stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:944
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wscsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1844
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop srservice
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Windows\SysWOW64\net.exe
      net stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6136
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net start TlntSvr
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Windows\SysWOW64\net.exe
      net start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5048
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start TlntSvr
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1800
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net user helpassistant 123456
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\SysWOW64\net.exe
      net user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1676
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user helpassistant 123456
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2708
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net localgroup administrators helpassistant /add
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5816
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5632
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators helpassistant /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
- - C:\Windows\SysWOW64\sc.exe
    sc config srservice start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5056
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2072
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4944
- - C:\Windows\SysWOW64\sc.exe
    sc config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2732
- - C:\Windows\SysWOW64\sc.exe
    sc config srservice start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 4.5MB
SHA256 fde5e78623df48d56d4be39e472bbef4c9eeb02cc66ea048033f927c64cb6cea
MD5 3ebfc985952e20a9e2f982566d1ab38a
SHA1 dcc29c23cccd0911f79d2f6b5dfcacc385f2f328
SHA512 44c9ca216ba1d7a3170b9edcf12a5d9b70a2dd3abb835eca703a27c6b93c534f0f7b75445ba06f549d1f8f0227c37f016ac76cde8732f848e73d137515027003
SSDEEP 49152:PabH/DabH/pgjI45TMwwapIgTBgjI45TMwwapIgTIPji0Aj:jLapIqLapIrjo
TLSH
T153260632B1E2046AC19A9071CF56873597E13C798FF1C3E7B145B2C92B729D07A3A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 8.6MB
SHA256 b62816b709d6d488a9fbab0ed563ef47e334883411bd881258ff331a545a0f67
MD5 8a54ae85d93f5e29d0f4844336c20b5e
SHA1 7466c035b7ba6918071ce7b91ef5fb24f72555c8
SHA512 cdac7753fefc40d9306fb41947fac7c2578608bdd2431e16425e7cdb727a39a08ee69cdff9a6e320b3be9a7307ed8bbb431f969acaff97ec351d912b1e2246ea
SSDEEP 49152:PabH/TabH/pgjI45TMwwapIgTBgjI45TMwwapIgTgabH/DabH/pgjI45TMwwapIz:7LapIqLapIdLapIqLapIrjo
TLSH
T1A696F53271E2049AC6999072DF56873597D13CB98FF183F7B145B2C92B729C07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 5.0MB
SHA256 811af06b60b45674479525a1381f866073be8732bba683a97c668feed97d90a7
MD5 8a3dbd8ca073748e4429d8eac921fcac
SHA1 19f9067d792fed030618c3b8efced748c541c3fa
SHA512 d58b718d1bdcfedd6e12c017aee9f072eb0495e879dfa704061fd51b73193be2082c43e5c3d2c9ec2e6e7bc38d7d040d2e50989b7c3d40e414b367ca539f4a77
SSDEEP 49152:PabH/DabH/pgjI45TMwwapIgTBgjI45TMwwapIgTr/ezSC6vUzPvMHjy:jLapIqLapIkezSC6v2XMH
TLSH
T176361732B1F2016AC19AD072CF469725A7E13C698FF183E7B145B2C92F726D0763971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 9.0MB
SHA256 801b5946ee525f018b6d01fac15b9f7faa0667d0832ee94cef3c82524ccf9b45
MD5 da003bf8dcdbe51d003487d4a043de5d
SHA1 f6aa86fbc7698e5c2a81299c76ed2aa02c9e8a41
SHA512 e8db834afc9a91d3f47f8f5c169d01faeedc01874d763988e0cc3da4c5a09ea4277b496be69d362dc380cd4b7fafccc3b04d23fbe8c6d554fcc144b059ddbade
SSDEEP 49152:PabH/DabH/pgjI45TMwwapIgTBgjI45TMwwapIgTgabH/DabH/pgjI45TMwwapII:jLapIqLapIdLapIqLapIkezSC6v2XMH
TLSH
T12696063271F2045AC6999072CF468735A7E13C798FF183F7B145B2C92B729D07A3A61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 4.7MB
SHA256 58adbb4baa2f0a404cd421986dd1c3c55bd433cabac92b8fbea87ac40f628701
MD5 7bbdc5822757be16c35206e451125ac5
SHA1 178b525465c703380a1385f9d03c8a4a16d4ea4e
SHA512 bd09833d3a63bda2f74376fceb20eead6c0be1ac8120472fa04f2ed856728214b83c13c91301304abe0446c657a05545f1210cc8229f0960af5dbb25c08f5ea8
SSDEEP 49152:PabH/mabH/pgjI45TMwwapIgTBgjI45TMwwapIgTkVO88hXl+:SLapIqLapIw/h1+
TLSH
T1F0360732B1E2046AC19A9072CF56872597E13C798FF1C3E7B145B2C92F729D0763A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 8.7MB
SHA256 382a7cef27681f15582bf71d876ea3f4ee45ca838afbb0584c84ae7331e17f5e
MD5 c66a8d439d6fd5da216b36f39f728dff
SHA1 074741d94ca17730d6f756e64b0660edf63bb44d
SHA512 0c817f063e9d6e288cd50d748a1a0d791491c4c2c58d03557ecf1e51552da9191e473cff525c8eee460c5b53565f78d7ef2e14214f3e2c88ee4c019249ef0faf
SSDEEP 49152:PabH/mabH/pgjI45TMwwapIgTBgjI45TMwwapIgTgabH/mabH/pgjI45TMwwapIK:SLapIqLapIgLapIqLapIw/h1+
TLSH
T1D996F53271E2049AC6999072DF46873597D23C798FF183F7B145B2C92B729C07A3A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 4.0MB
SHA256 c27c08064db4b7d62ecc2a3ba21954eb934c6a0bfae914924b5b00c66bb3ae74
MD5 e35dca5f843df6c641b65160037ac3bc
SHA1 1c9d594ad23fa769ff6f247430839459c00be9bc
SHA512 ae3321be6ed5f69fb7563be6922a006cbbcdbfcfb4f7f039235d78790c5b0e13005617f28ebeed6356b8513c0c07c551732b0a35981307d58d54cb08ac2c7cfd
SSDEEP 49152:PabH/TabH/pgjI45TMwwapIgTBgjI45TMwwapIgT:7LapIqLapI
TLSH
T19216C33271E2049AC6899072DF16863597D13CBD8FF193FBB14572C92B729D07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 8.0MB
SHA256 fb0bcbe99f50dd1cd8638e44fa98bc694e0dabe2bc0fc8ca4daca23f2f060f63
MD5 c4bb1820baf90b3ff5d461b011f497d4
SHA1 705b5ef0abf9edf72d03e8b6f7c0c7c2c7e0992f
SHA512 1c8fa0177a0d1cf22e2d40b10d31c87fb52dbbaa9a694bfbc1b838de1af334f27179177a0b0015500a63f4f37db518a5058f62cb7a36567a8129b5e913c3bc88
SSDEEP 49152:PabH/TabH/pgjI45TMwwapIgTBgjI45TMwwapIgTgabH/TabH/pgjI45TMwwapI/:7LapIqLapI1LapIqLapI
TLSH
T18C86C33271E2049AC6899072DF16863597D13CBD8FF193F7B145B2C92B729D07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 7.1MB
SHA256 ab6128e96a393dce4652d50b7748dcf95ac7e62631ab214a8b8be72eb99f863b
MD5 f10e546ef2ac499a9e52ac9d98d7b802
SHA1 074e5b52103d0c7a9ef8ba20f7b576034ba99c31
SHA512 b4f8228b1c25763356b83b933fc1591dcc66c0e4c43b87f0b1bfbfec3fcd04155ccab5f3a6727732c194c8e93d99357d56e211763a2972ea2718aa623458dfcd
SSDEEP 49152:PabH/7abH/pgjI45TMwwapIgTBgjI45TMwwapIgToyLSrJhMeJNvjLAE3dGGj8bb:7LapIqLapI6m7vj1BDlZG
TLSH
T1A3764A23B1E20099D18DD071DF468631A7E27C698FF193EB7644B6C52B72AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateSet.exe

Path C:\Program Files\UpdateSet.exe
Size 4.6MB
SHA256 e6fe2e8a7e159dff7e353c3ff0bd884f44ec3662e063e08cbe0faa720baa5d99
MD5 23abd2628e37315607ddc272fbe3bc68
SHA1 cd5f5252b9e0ff0828430239de695ace2bf41006
SHA512 46b01b802685093885f8f9be8e9d85aff3c97678a5b46f155136fc1a5bc48af1c61624372bc6f6aefacdf8dbc9c304770e11adb70ae6de873ca2dc9483eb6be5
SSDEEP 49152:PabH/3abH/pgjI45TMwwapIgTBgjI45TMwwapIgTTU0npVdwJ/Ith:fLapIqLapIknpVdwQth
TLSH
T19936063271E2049AC6899072DF16863597D13CBD8FF193FBB14572C92B729D07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateSet.exe

Path C:\Program Files\UpdateSet.exe
Size 8.7MB
SHA256 e85fc740e09d5ccfccaa5ef9980ac6bf02e859e5aea76fe746a8e4bcd0454c63
MD5 53e43547e31c01b4aed05be0a626d057
SHA1 336a8f2c3174b847349189212fb9562b92f867ad
SHA512 2a0c94b292633d549ad6ae3d423d9c551cc243805ce480ab51b85cd8dc69b601c5250bc244c5b60b4c20e332570d96c40a8fc78fd7b13346595e791eea8f3897
SSDEEP 49152:PabH/3abH/pgjI45TMwwapIgTBgjI45TMwwapIgTgabH/3abH/pgjI45TMwwapIF:fLapIqLapI5LapIqLapIknpVdwQth
TLSH
T12296E53271E2049AC6899072DF16863597D13CBD8FF193F7B145B2C92B729D07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 4.1MB
SHA256 8f525eda8117b4c7b4bac8f0b4b37b7a0b77d8cb5a356896c51755729d9001d5
MD5 120792039ff728bce424cc22f5b96a15
SHA1 454bd8736145b44d7d096036717210e83ece4d79
SHA512 3cc6476a076ba908da15f4e94cc66423cfe30cb0140c97068c686c02f8ec3b763e6ee3217c23036278e78afbc61008d94212e45a94da033d1c88e8c18001828f
SSDEEP 49152:PabH/DabH/pgjI45TMwwapIgTBgjI45TMwwapIgTd:jLapIqLapI0
TLSH
T18416D532B1E2049AC68D9071DF168635A7D23C798FF193F7B185B2D92B725C03A7960B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 8.2MB
SHA256 24c2c2c48b43aa389b973dea901f5787d2de8dfc01c2318f6bce64820c87dd48
MD5 d4d261bbb5ea553206f7b234f7ee6a4e
SHA1 6ce1bdf732419a4dd46f994ceca7a23872a0ebd5
SHA512 5c98e5eabdc52887ab2df2a62bf9c844a53c836c27d54ad5b60942bca4c96a7479dd373f428ca42eed9bc3ee4d35d1dd7db466d717a589a4f652bc3e6e887a15
SSDEEP 49152:PabH/DabH/pgjI45TMwwapIgTBgjI45TMwwapIgTgabH/DabH/pgjI45TMwwapIl:jLapIqLapIdLapIqLapI0
TLSH
T1D286D532B1E2049AC68D9071DF168635A7D23C798FF193F7B145B2D92B729C03A7960B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 4.1MB
SHA256 8398d808aeee19b410232c49cdef965b4641cdeb171a66551995ad213d365a9b
MD5 fd31ef417c9759ddfa40e27dad61e7d1
SHA1 f1568a682a81567ebefd4655c5a2715423149a27
SHA512 470be3c4cd13f19e7002f57bcb7cdff3ddad6d87266cfc58411176aba476629395bc2946aebcf00cc65f515608e69c470b179b62bfc9393a29aefda994756ef4
SSDEEP 49152:PabH/3abH/pgjI45TMwwapIgTBgjI45TMwwapIgTZ:fLapIqLapIE
TLSH
T1D216D43271E2049AC68D9072DF16863597D13CB98FF193FBB14572C92B729D07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 8.1MB
SHA256 ac16bfa48396d777ec44da5377f16bd10b12ad673f4be7ffb507756bc59ff81a
MD5 e55f2e7648b6fb4a46f5d2a82bcf5702
SHA1 c0d410b6b34ce89fab42bbc749306a88fc56f0f4
SHA512 9b1f6cdc9c8ed32a40f24f84bec666ce240437c7325cffa64f1d8491249912f56ed7c90dc63549e8141344879f1ec08706fbb42a27024df57ffca88dbbe1a2b9
SSDEEP 49152:PabH/3abH/pgjI45TMwwapIgTBgjI45TMwwapIgTgabH/3abH/pgjI45TMwwapIR:fLapIqLapI5LapIqLapIE
TLSH
T12186C33271E2049AC6899072DF16863597D13CBD8FF193FBB14572C92B729D07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 8.1MB
SHA256 4b782ac4dca3e5dc237af7391c33862505c7cf3a038f05b81616d68d5f96aaee
MD5 81e71337d560689919a8c8beb8b17a99
SHA1 21cf01383cdbed80c91a0521e2226c124fd144ea
SHA512 73381c41de376a85e11c397c53aa60a9f7745136b0bd9e7009edb2205b6d31b7723743ed9dced19db278a5d97ec5936af516ccba0987d9e99ca9b31eb8b18fde
SSDEEP 49152:PabH/rabH/pgjI45TMwwapIgTBgjI45TMwwapIgTgabH/rabH/pgjI45TMwwapIX:zLapIqLapI9LapIqLapIwj
TLSH
T1AA86C33271E2049AC68D9072DF16863597D13CBD8FF193FBB14572C92B729D07A3A60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 4.1MB
SHA256 551ac968d9d9e0ac926750abe1831e8f42983afeef32b4907ce7930fed16d16c
MD5 cf46777611ea01b18af074c80bf2aba6
SHA1 6dd73ac23f2fd77569bc0600c0c8024f7df1bf8f
SHA512 fe69d722a23d8f7a02ae9246a3f92be3f9f3a5fc1eb20d1ae336ac1c421eb5c163ecced8b5a79d62371a3aa77f727ec5339b595b9f22515d73230a24ea20805d
SSDEEP 49152:PabH/rabH/pgjI45TMwwapIgTBgjI45TMwwapIgT7j:zLapIqLapIwj
TLSH
T19716D43271E2049AC68D9072DF16863597D13C798FF193FBB145B2C92B729D07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 4.1MB
SHA256 d05ee6f47ce7aa19af6123d22005c81341908904ed5d0ffc34e10ec6fc2d9cc9
MD5 c1cbeb1ff812cd8fdfa81ed8afc1690a
SHA1 5b0a45500c86aadd023419816cbdb0d12c01fbe6
SHA512 c4b49ed2b0675379312503e115f9ef4e24b6f929aec7bf5ab66de9e6597730314a423f391259a92084663c7df22148d3d2ee29f2d02af957edbd84e1718be420
SSDEEP 49152:PabH/7abH/pgjI45TMwwapIgTBgjI45TMwwapIgT5D:7LapIqLapIiD
TLSH
T1EF16D33271E2049AC68D9072DF16863597D13CB98FF193FBB14572C92B729D07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 8.1MB
SHA256 f9646599487b4e25f5d9ba70eb77e36b258ec9dc210471b54f7a99bb950e5b6a
MD5 afbfc3c5c0bba7ef223f2458857cb86d
SHA1 2ee8bca464eb783fb5991ba3a75b310f4020e13b
SHA512 3ba0c6ddda4f25e18d655f33f65177674ac6c47977864c7c4f4fa69d40455f3c8b1354e17b514394c7924f8f909f2fd02cbf5d272ca293eb646f87d4b1672fb1
SSDEEP 49152:PabH/rabH/pgjI45TMwwapIgTBgjI45TMwwapIgTgabH/7abH/pgjI45TMwwapIh:zLapIqLapIFLapIqLapIiD
TLSH
T16886C33271E2049AC6899072DF16863597D13CBD8FF193FBB14572C92B729D07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Size 6.6MB
SHA256 a867dc2a50b5b29f45c55f4877ae72f3fa15cf88de279e1f9e74093c2aa07943
MD5 a69645efb1b4925d6d62f1e525882471
SHA1 0d19fe79af8b17781ec3345f8257ccf7ed328583
SHA512 2f1ec30d3860f3b6e948566720ca01bddb70e0e38f0f47cd47ae88c8d311e0427b88746d7fd0d741c0a3454942fda7a3b0a886f0886ac1b4ded015b1a2e23e7d
SSDEEP 49152:PabH/DabH/pgjI45TMwwapIgTBgjI45TMwwapIgTV+Cq99LyHHI+t6O8N+ailEyy:jLapIqLapIt0oAaldmdmnp
TLSH
T1E8662923B1E2049AD289D075DF06863597E17C6D8FF192FB714476C92B72AD03B3A70A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-27_e9a5714be5add630502e7441dbfe893b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
Size 2.5MB
SHA256 241d506bd9043269748285ac77db0f6f2485c49799a86d289d9e9de6ef3557a2
MD5 2fe5e3f6d690d53fc7d6d94232973e4e
SHA1 21094ae849842b50ab9a37a5991e767f6d48172e
SHA512 8c03a6b047817e1aee1a6f97a0d6e3dcbc04d82e6f9bca4b10aed5c7e7f5e8ab0f0d44ae6fd353215e7806b1d4edebb6d749801bc03d6f3fa23e35855d078d0f
SSDEEP 49152:B+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nky:80oAaldmdmnp
TLSH
T1C9C53803A19948D9D15AC074CE46C231EB227C5D4BF265FF3690BADA3A77AD03B3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 4.0MB
SHA256 ddfbc6a157f9b89f49f7289b6c9035ccfe90c57e7cf81802d4bafc2ef76b6424
MD5 486f7aa35c78da7aac84840fc3453f78
SHA1 6f6c070e1ce7a6d13c31d52666dde67b9ed58822
SHA512 a43dbd022518b4dcf4321a8ab17a2237f7e42d917ba39f2cb8a8e6154410ea966f4ed536877c30135edf29815fb3eed38179ade184705156dd03bd9cb04f9228
SSDEEP 49152:PabH/DabH/pgjI45TMwwapIgTBgjI45TMwwapIgT9:jLapIqLapI2
TLSH
T1B016C33271E2049AC6899072DF16863597D13CBD8FF193F7B145B2C92B729D07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.0MB
SHA256 2ac04c73d5f4c2d311f4f5f23de6ef122cde2f924279f606db8d4d533dfa6c49
MD5 807e46088612aa49c4e302882438b7d6
SHA1 917adea4b334b26cca67b5189c6b04e3b12afd29
SHA512 fc50d381c56a525280289cf65d74206291b11df8f48e741731d161f698dc58c832cdb894e3b953c11c0df71e37296a0f47e55b24f5148c8b0ecf440c21b2d3ea
SSDEEP 49152:PabH/rabH/pgjI45TMwwapIgTBgjI45TMwwapIgT9:zLapIqLapI2
TLSH
T14416C33271E2049AC6899072DF16863597D13CBD8FF193F7B145B2C92B729D07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.0MB
SHA256 dadb426b39a041ca9669c3e2650b65511706f1c6b5b6426badb29ca943696d7b
MD5 534908d069d91caa5e6ec093b9da22ea
SHA1 98433471a12314d10dc7ec4aa82ab8bc47660705
SHA512 f025ac4f61d8f785d21e4b66b517a7aec8f610bf2708c50d3a3576e785672aa376f8eeee95334ed1a60628df644aa013f5725127d887e3a6f15ae581afd70839
SSDEEP 49152:PabH/7abH/pgjI45TMwwapIgTBgjI45TMwwapIgT9:7LapIqLapI2
TLSH
T1F816C33271E2049AC6899072DF16863597D13CBD8FF193F7B145B2C92B729D07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.0MB
SHA256 b2b00e65ab5d4ba12775bfcff59cf97fb5f48779798faefa18b452076bfc1518
MD5 bdc00f53cffe5f324dbbf22327226490
SHA1 4ea685571094a97220d3ed285c7b2540d9f6495c
SHA512 9871aa5af97666d9059914ed51c9e75b51630c8b659909a0f0991aea9997e5438624e0a519db9d1fe9f1d7b44ad8f59b565c7f9a8861312a63f66b7a55d10426
SSDEEP 49152:PabH/mabH/pgjI45TMwwapIgTBgjI45TMwwapIgT9:SLapIqLapI2
TLSH
T13D16C33271E2049AC6899072DF16863597D13CBD8FF193F7B145B2C92B729D07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.0MB
SHA256 4cc546764c42a4c54d50605d10f61f870e8e98f80679bf6723ba1f5beee72453
MD5 e8d53fa3de48060c201266f1a59cdd3a
SHA1 a998e40dee2ded11864a461663613c85f065f014
SHA512 47a9fed50ff65d3373c2b022414a160ad534bb3189c74853702b61e6328f21e014f87a2884e2c5010a4f1d0551e14da140569a406060a6ff6aae0e4a3f52fe63
SSDEEP 49152:PabH/TabH/pgjI45TMwwapIgTBgjI45TMwwapIgT9:7LapIqLapI2
TLSH
T16616C33271E2049AC6899072DF16863597D13CBD8FF193F7B145B2C92B729D07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 4.0MB
SHA256 6fd9c1403d25515f37914436d21258b3584a7846587187ecd8fd849c3c904886
MD5 23925581937a3a5ac873752cc8b0825b
SHA1 f95fd4a7267b982c1155d0f3d66e6bf416adba30
SHA512 8ee64488ac2ff65719a291bfa5f48f15aed6b2f9b4ea8094ef604fc05e59f9fe680dbeeeec0704277ad7c967da0164b93e172a46aceb42a99cbd5bbfc03947f0
SSDEEP 49152:PabH/DabH/pgjI45TMwwapIgTBgjI45TMwwapIgT9:jLapIqLapI2
TLSH
T13616C33271E2049AC6899072DF16863597D13CBD8FF193F7B145B2C92B729D07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~8

Path \??\c:\ntldr~8
Size 4.0MB
SHA256 7f39069df89a4a9ec38eb6057299c0f77180b2bda6220f020cb9a47bd81137b2
MD5 ededb8f5e2c9891d7d0d289b5435550d
SHA1 5087455960b56defde873bd79cf69ced9aa9c7fb
SHA512 a99498aa7eb0300f3db8d6732293caaa940e2228c55fdcfe84e0f32042ed2c2501bf527b1b8961dc65bc990b951088e1b3c52055238eae90579224380b1ce464
SSDEEP 49152:PabH/3abH/pgjI45TMwwapIgTBgjI45TMwwapIgT9:fLapIqLapI2
TLSH
T1D616C33271E2049AC6899072DF16863597D13CBD8FF193F7B145B2C92B729D07A3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads