1acae41e186404bd4c9cb51cbd8b1129c18aa78823e8e64fa2d714661e7d851d

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
Size 4.8MB
Sample260804-25ea9ssfnc
SHA256 1acae41e186404bd4c9cb51cbd8b1129c18aa78823e8e64fa2d714661e7d851d
MD5 36b7b5e42f85086d632c773e0970f266
SHA1 2cc14d740a8158f5adc78f50aeff1b370deaf730
SHA512 efe7e16fe8ec804d62e6615c75a873c928a149bd992141eccbead9980f0327ca27ff6d64d1388f28c247865a5660f7d267de7b93c1cf11118bc4ea89c718b1eb
SSDEEP 49152:sg8nr3fffffffffeGiMYY8tTWOpe6XoYThRigk+70rRbcFHZ91/VZJ4R/+GCedBc:mZmoBT2ZmR/DQg/9g
TLSH
T14F365B027A9614EDC048C8B4838B86139A617CCB0B76B9EF559D72692F7FAF05F3D214
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (255) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 3 IoCs

pid	Process
1052	Logo1_.exe
1164	rundl132.exe
4884	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaw.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe.Exe	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.Exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	Logo1_.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.Exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.Exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
File created	C:\Windows\Logo1_.exe	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4964	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 5148	2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe	89
PID 5148 wrote to memory of 3220	5148	net.exe	91
PID 2420 wrote to memory of 4964	2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe	92
PID 2420 wrote to memory of 1052	2420	2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe	94
PID 1052 wrote to memory of 4960	1052	Logo1_.exe	96
PID 4960 wrote to memory of 3264	4960	net.exe	98
PID 4964 wrote to memory of 4884	4964	cmd.exe	100
PID 1052 wrote to memory of 1152	1052	Logo1_.exe	101
PID 1152 wrote to memory of 6024	1152	net.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5148
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF98E.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Users\Admin\AppData\Local\Temp\2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe"
    3⤵
    - Executes dropped EXE
    PID:4884
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3264
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6024

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$aF98E.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aF98E.bat
Size 944B
SHA256 bb8d033f18c70c842e7f164b30ea4c81e40415f137a8894c739b7df9bc6197db
MD5 46a8a53f6d22a6b57566bb93d54ffc0d
SHA1 bbe216d98c6cc7c89adbc72a6aeb5188fe3bbd53
SHA512 2e586c083e751ee0eee5e787423961e062893888235d1ee53a782bc3db5551b2cb89f07b546a2c87b5caa5d5da825f53c94ee5b38d035de4ac14e98a87c46e34
TLSH
T1E5110801C9CBCBE44C36624AC6B098EDC152252EAF9C3723EF39C98F259901B7891385
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-04_36b7b5e42f85086d632c773e0970f266_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_vidar.exe.exe
Size 4.8MB
SHA256 ff3469cef476ba065d5117e33e050b606ff1506c51139bb710ac1c9e04f818b9
MD5 22129b5a03e8922ab826e7f17aedc084
SHA1 8ab54c6ba7b54c7b787a7bf99311c785484e80f4
SHA512 46a1886605d2bb642ff043617662e244d1a5ae91292b9b3f00ccfaa2b447d62b18a42cad41af6059f8a4fd4eef180e318bddac17ef30cfdd4d88e9d863076aa2
SSDEEP 49152:og8nr3fffffffffeGiMYY8tTWOpe6XoYThRigk+70rRbcFHZ91/VZJ4R/+GCedBc:6ZmoBT2ZmR/DQg/9g
TLSH
T1EF364B027A9654EDC048C8B4838B86139A617CCB0B76B9EF159D72692F7FAF05F3D214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 57KB
SHA256 8a4142431415df59c0f078502c957d84bf4789f98b9140ff97acefd3c49bd536
MD5 abfea7c50d5a9e5b64ed0595113b7e7d
SHA1 950c145a5a3fcf6a194199ace1c3dff2c7519950
SHA512 e59faa23236894f7d8fbb41b942381292ef4777915a23d50991bdec264c2df9c765b0793afccea734101f13c4192421f81b4290bd7e311155edb318385a88985
SSDEEP 1536:KJGuExoJm4oFGRxYWeo77IBThGhvV4hSor1:c5EOFoFrJKATvhd
TLSH
T1BA43E12B7D575CFAC7C0A8F9EF09545FCA7863F0CEA6C266918288EDD72208CF541255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1052-12-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1052-17-0x0000000000590000-0x00000000005B0000-memory.dmp

Download

memory/1052-26-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1052-27-0x0000000000590000-0x00000000005B0000-memory.dmp

Download

memory/1164-21-0x0000000000580000-0x00000000005C0000-memory.dmp

Download

memory/1164-22-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2420-14-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2420-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2420-1-0x0000000000590000-0x00000000005B0000-memory.dmp

Download