de2960d197cf7f6f1fe0f7da5c8f9d31626b84b5a749024953d432b223e5f1b4

Analysis

max time kernel
149s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 557KB
Sample260802-g4ev7ael2x
SHA256 de2960d197cf7f6f1fe0f7da5c8f9d31626b84b5a749024953d432b223e5f1b4
MD5 203f78ede172fdf0a8147e197702c515
SHA1 0170c6376e61bcd51e3596103dd46dc80d568344
SHA512 8dbb068047ade914477a0d2c16abde26b0bcf1b693a9d07093594004678db216e7f1bf1483576ff3fe0563bfc89fcdf59aa2adbd14a9de4451539cf3fbcf363e
SSDEEP 6144:TXdmGu4J3iYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvx:Ju4J3i4e7WRdTfgwCHKy7GLbbdIvx
TLSH
T191C42990B3DC33B5E0F79A358D6DB511DE767C591B21CA8F13A8261A1E336D18938F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 2 IoCs

pid	Process
4060	Logo1_.exe
2624	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCX8A8D.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX882F.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9468.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9489.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.Exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe.Exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCX8B11.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\RCX96AC.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe.Exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\RichDll.dll	Logo1_.exe
File created	C:\Windows\uninstall\rundl132.exe	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Logo1_.exe	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3032	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 3252	4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	88
PID 3252 wrote to memory of 5152	3252	net.exe	90
PID 4220 wrote to memory of 3032	4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	92
PID 4220 wrote to memory of 4060	4220	2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 4060 wrote to memory of 5540	4060	Logo1_.exe	95
PID 5540 wrote to memory of 3532	5540	net.exe	97
PID 4060 wrote to memory of 1468	4060	Logo1_.exe	100
PID 1468 wrote to memory of 5112	1468	net.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF836.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3032
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5540
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3532
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5112

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX9046.tmp

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX9046.tmp
Size 156KB
SHA256 d73cb90557fca4597ec9a2c1d1d3c9e0ace74304dace94603a28b864c3cd3987
MD5 cdde3ff7cb9b2bc9fee2bbfddb31c950
SHA1 425e092e7f9634e21845ae14269412c7a2943138
SHA512 097e599c45ff4bcf3b7266022e94577b83401258e983245ed0bd69af330859ec821a93597d6459e96667b371b1ffd6d6c66f450322cd61b76b99601c51af5d0a
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjx12uC+ysafQNS:oCSjGoLpWM6slmjxAu4JY4
TLSH
T10DF3A16DB18EB3F2C3E1697C8D1CF295ED28FE20DE19285B75D93B0E9A7A0C34508195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX9326.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX9326.tmp
Size 94KB
SHA256 108ff712266118486590a08a12777ee2b9e65a43074b982275bf816707db3bed
MD5 8a55a80f537e554e3cc92587ab016005
SHA1 3d562ddf449228b5be9f7d440ff26d473550cf58
SHA512 68da214c1d4fc27e36b184f4033f7162d89a8ce606d077ae49a5b6c27b9d53ebb56e5f60282622cdc9331e054171fec2b41022a8cf3e24b957611f71638e52a1
SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxx2uC+ysafTNC:JCSjGoLpWM6slmjxUu4Jro
TLSH
T1EC931956B28CB376C0E169BC8E0FF2E5BD297E301E1D489FB59D2F0DDE760815918185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX95E7.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX95E7.tmp
Size 103KB
SHA256 f0e4aebc42e1dbdd323cf8a1019c3f602d834e6f9af352c0173e77250454da20
MD5 4624c6b2b37d5a54d7cdbee4a75806cc
SHA1 98a6a3875093cf2bf18ab371fa6211033eac5952
SHA512 a7d6f01b7045ee4c2b024e23cf936d606d84ebb27e5aa1689f9572c419e2d80a1176e67cd000b902022aa19ddc07f325d09aa61490da7566b7d0435f69b39723
SSDEEP 1536:k7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxc2uC+ysaf71XkSPsULMHiaNP:9CSjGoLpWM6slmjxbu4JjdtPlLqjl
TLSH
T111A37B59B28DF372C0F259BC8E0DF2D5BD287D301E19585FB68E1F0D9AB65C2490D18A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX9658.tmp

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCX9658.tmp
Size 91KB
SHA256 b3392a2c16f45881b5d04c4fa8b2a1bae126bc20654db7295ef3c42fda1fec38
MD5 42c1e33e23bc248976d520db6f8db3e8
SHA1 97036ef7c6bd6f2278ce313cc6e4100a5bc55d92
SHA512 aa676eb9244ae4e061fec22f197c7f5ac818a4f2f80501be0c9b6d2bf03c58b1241099118341ae832af3bb4c186a31a0dc9448fa9c21ed36372988df6f68592d
SSDEEP 1536:g7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxn2uC+ysafoNy:xCSjGoLpWM6slmjx2u4JQY
TLSH
T1E3935B55B28DB372C0F299B88E0DF2E5BD297E301E19085FB69E2F0DDAB71C2591C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX9489.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9489.tmp
Size 118KB
SHA256 2230cda2b2ea3afc8589ac93532e323f1901126b2b2f2f01680226b0363b3dbc
MD5 e6a44a25deff0eaac961eec4f2fd76bd
SHA1 1925b9c6700e58372832e04e897d8a3c64589d6c
SHA512 4d39202cd0e8c8b6b401cbf6964d5cccaf5668fb8a8b971914c4b64118b0b59de77c14a932504bcfba6f91e83a8804cb03c144552271a69d3e53ca61c3917fd7
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxS2uC+ysafs4GZjzQwK5WW7VCn6KM:gCSjGoLpWM6slmjx9u4Jye5BV0I7
TLSH
T18AC39D55B68CF377C0E169B88E0CF2E5BD297E301E19085FB59A2F0DCABB5C2590D186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX980E.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCX980E.tmp
Size 100KB
SHA256 0729eeca24e0514a9241e4abaaaf4b0fe653b0121c8740e2fbf9f1baa8b8ca97
MD5 f4a2b1a28ef90d928dca7d916b7aec27
SHA1 4ed748a53248f3168a09a1f927ec73a52f3e3c27
SHA512 0183d78f87c2b966ee0fb1a2fdfdcf321e99ddb1c29e3fa28f45455c844c9a7d57c3b509d0fe2ced195789e8da484659b17877c45e2bf82c866b82d837571fce
SSDEEP 1536:g7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxv2uC+ysafFqkSZZZ3nNi:xCSjGoLpWM6slmjx+u4JHUnI
TLSH
T1D7A36A56B68CB3B2D0F199B89E0DF3E5BD297D301E59085FB29D3B0E9A77082191C189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX85E2.tmp

Path C:\Program Files\7-Zip\RCX85E2.tmp
Size 91KB
SHA256 4aa2983a64633f0b43c02419a570dda5c307b8f6c192f00b13691b34a1abf1e9
MD5 99479a85edc13407d9ba3806094b6af0
SHA1 a8c0aae5558f406a08b6ac128b4fb48e35079823
SHA512 e508fa71dfd9d59a448f2d1d96ea56d898ae0864500d8bc267de625bf1dc95dd00ce37b6f30325842e0993c762f7835a91fd09543cfd2146d9fb5843b6c0d313
SSDEEP 1536:U7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxp2uC+ysaf8Na:NCSjGoLpWM6slmjxsu4JUg
TLSH
T102935C55B68DB372C0F159B88E0DF2E5BD297E301E19085FB69E2F0DDABB1C2590C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX8ACF.tmp

Path C:\Program Files\Mozilla Firefox\RCX8ACF.tmp
Size 91KB
SHA256 376cda90b3f7841411f9a1ffb5b56152a32c89e53c1f9fb7a61ae6948bf9de40
MD5 1855ef03e6ac04dc6090b779238b4a4e
SHA1 1d4c7aa24ab40e97e1d13c051c4e9d3ede672cc9
SHA512 370dee716c74fc4ac7467ecfd809b4ee79849ed841003b2db35b43ec59e10d16ee2b1ce8d1d356b757b17a03ac3a9dd1dc7cea66fc672dafdd718c084a3b482a
SSDEEP 1536:M7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxh2uC+ysaf+Nq:FCSjGoLpWM6slmjxEu4JGw
TLSH
T1FA934A55B28CB372C0F269B88E0DF2E5BD297D301E19089BB5DE2F0DDA7B1C25A1C195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX9CD2.tmp

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCX9CD2.tmp
Size 92KB
SHA256 cec0511ea2789edfe11660395d4e727662f065b38be0eeb7b08a714d772761b7
MD5 1c80cac4b1204094c36cfae887a6be3e
SHA1 3214fa477042823cecc4d133615685953c95d4ba
SHA512 add97c2eebd04ca65e3b8d9fe3e0f3ce8096a12516132fb83ecf95894a9d60f7331f26cf0d3f7aaa97c837393ef4437b6f1d0f7a53dff5f9b058eef80ebb166a
SSDEEP 1536:k7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxJ2uC+ysafRqNC:9CSjGoLpWM6slmjxMu4JJqo
TLSH
T1F3934A56F28CB776C0F199B88E0DF2E5BD297D305E29085B769E2F0DDA770C2590C189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aF836.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aF836.bat
Size 902B
SHA256 12c0764667fced1870d4f720810f485164c06a98c90315656862eb9c08bea131
MD5 5d540e669642d1e40ea8620c6568a6d2
SHA1 4b5c5f0b47b320ee6ca3303e99bd4dbbd268f5a2
SHA512 22f1a88c9cba2c9169e9464215402cda55587413160ece43a88940a25d222fed5e0ec82b35a0ffcc061c120a4193839868d18b42797291efc628c69c1449e1da
TLSH
T16D11CA02C5F6E9A81426B01A8F7EBC8ECC467A6E2B0532B19F2DC00E50C080CF5EA791
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-02_203f78ede172fdf0a8147e197702c515_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 464KB
SHA256 69ba4eb22f23261d99b66908badf829b0c95ad52863a7fcefa56b8d03b4f6a24
MD5 9e082b0703791143237272b5d236cf70
SHA1 459dcb119c75221e8c1a43d8537835fbd029d510
SHA512 df19fb2e13b43c6b56aebabb7bda2678c2b90411deabe8631fbbc16bd6fe42f096f2e243cebfa7efc3e1088499f8ad74c6ebb14a3ed68f9573806c5ec92009a7
SSDEEP 6144:eiYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvx:ei4e7WRdTfgwCHKy7GLbbdIvx
TLSH
T14DA43A90F3E414E8F0B79A3589764511DAB67C5A1B31DE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 8104fd424cced7380c5d86a482e164024b645225a1bf09e4f1ec62c704ad7fda
MD5 855731033586d8d02572c25a7fa94b9b
SHA1 26c457afa7f3b8993a60c4e960133986298f72da
SHA512 27b26af163367848de9de568d32be76834e129db613391f729cc6d28d7e7a1d032736a0796f9bf1d0efadadecfd7e4840e3c634fd059b446153648288b63ea33
SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxx2uC+ysafZN:JCSjGoLpWM6slmjxUu4Jx
TLSH
T130934956B28CB372C0F559B88E0DF2E5BD297E301E19485BB59E3F0DDABB1C2590C189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2624-17-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4060-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4060-1130-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4060-1259-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4220-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download