Analysis
- max time kernel
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 15:21
Behavioral task
behavioral1
Sample
2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 1.2MB
- Sample260804-srn4wacg77
- SHA256 bfe46e788c37bd2dbae3fc4e800a7fe970bef6f8a8fb6c680f1feb4316aa9b50
- MD5 7423c91e4d1efd21518d7f0373b47645
- SHA1 cbdd90e98f37a2af779ba180ac3fa7c4d04e2a07
- SHA512 aac715524677d8720cd4af435491329966b1cc37854f20b5eb03b519eac7523702edc1beb819268763f8124b704b115fcf9138494b306b1146f7f093fd3351e9
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5Tvinrml3Re5jcAkSYqyE:A3kMP56r3pYq
- TLSH T1EA555A16F6644FA5D02BC178C9D2965AEA733C465F3087CB13849E283F237D19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/4928-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c540-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4928-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5476-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000199ab-549.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000199ac-546.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bd1-716.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a0bc-1024.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c540-6.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x00030000000199ab-549.dat aspack_v212_v242 behavioral2/files/0x00030000000199ac-546.dat aspack_v212_v242 behavioral2/files/0x0003000000019bd1-716.dat aspack_v212_v242 behavioral2/files/0x000300000001a0bc-1024.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5476 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4928 2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5476 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_7423c91e4d1efd21518d7f0373b47645_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4928
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5476
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.2MB
- SHA256 bfe46e788c37bd2dbae3fc4e800a7fe970bef6f8a8fb6c680f1feb4316aa9b50
- MD5 7423c91e4d1efd21518d7f0373b47645
- SHA1 cbdd90e98f37a2af779ba180ac3fa7c4d04e2a07
- SHA512 aac715524677d8720cd4af435491329966b1cc37854f20b5eb03b519eac7523702edc1beb819268763f8124b704b115fcf9138494b306b1146f7f093fd3351e9
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5Tvinrml3Re5jcAkSYqyE:A3kMP56r3pYq
- TLSH T1EA555A16F6644FA5D02BC178C9D2965AEA733C465F3087CB13849E283F237D19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.8MB
- SHA256 d57448d0d30089b98574c66358588a2ef67da573d9e9a0e9825251c864fbe82c
- MD5 003dc8dcfe8334f6ca8f4a074b3b9eac
- SHA1 4d776eeb5f43d1397b00d0a903aaa7fc1c6af50b
- SHA512 a7f45963d013e1541fd1cffd42189d14c07de1b587a0842a002aa9775e4eed4989fa93e5c40f3c179bc27c01895f3383af178a4de8816b7112629a48918f64a1
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5Tvinrml3Re5jcAkSYqyED0Le5ji0hmxNrM:A3kMP56r3pYqjPji0Aj
- TLSH T180853916F6644B75D07BC0B9C5D2969AEA723C421F3087CB1385DA283F277D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
- Size 1.3MB
- SHA256 7403f362af1c08fb0a58dd8529307a3921837ffcbb1f8c62fe1fc66efbe0fb92
- MD5 a252dd88b7474cd5f4252b2774c44eb7
- SHA1 acefa02f1a8c252fe087973ca83a5bdf8a265982
- SHA512 5b6479aacf6144c185e2e0737834daf33e22e465717dfb16c98a45c887bb0c159698c811e6fe70ca78cce4456ec99543cd5d4133b27e67201b19c766e745d26d
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5Tvinrml3Re5jcAkSYqyE9/:A3kMP56r3pYqJ
- TLSH T18E555A16F6644FA5D02BC178C9D2965AEA733C465F3087CB13489E283F237D19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$
- Size 1.3MB
- SHA256 bc166abe9adf5a9f523a1bd0e4c23769912591f9d8b95856d577c0b955a09f51
- MD5 db2b9cc2ef9b18e0267010aa9ded4388
- SHA1 30b253765a582ad5c28e11090461130abc67bfc1
- SHA512 7385b4316e5986d0aa6064b605df6aff59967620a26adeb2258769632390acd33f1472fd1dffbddb6943d659cf07c2398306fbd0d34619fef78f270e26b443ca
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5Tvinrml3Re5jcAkSYqyE393:A3kMP56r3pYqJ
- TLSH T1EE555A16F6644FA5D02BC078C9D2965AEA733C465F3087CB13589E283F237D19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
- Size 1.3MB
- SHA256 e3359ebed0905bc2450048d9cdbeb4c52388a5f979e2107ea3ffe81c06dfd0e1
- MD5 2fd9f2a080487e239ba3ec31e00f8f29
- SHA1 d9e800ccf8acae21095d513a12c711b7ef1021d0
- SHA512 7d77112d7a4493c0ae42ad57c5cd1d7ddd91ab9ebb51cb175ae473b77f2633c61e48c94ad71522e59c78d85901826745222ce067e3d713bf7d2fde02ffa77204
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5Tvinrml3Re5jcAkSYqyEtv:A3kMP56r3pYqh
- TLSH T125555A16F6644FA5D02BC178C9D2965AEA733C465F3087CB13489E283F237D19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$
- Size 1.3MB
- SHA256 52f5c322df3295897fa0646dadefd09563122b626c7aafd68e2c52eacaabc601
- MD5 7aceb68dd268feda95bc8a1f9af91fe9
- SHA1 a4b8b687b44755525270cbf798aea6949c647ff0
- SHA512 49588273553fac259a98932bb506bb1a30e61c8e280bde56e06c3379a0514bf4ba5187e570e760b1554ff2a16124777529dc908d0043c4e343b6a4c50d74dfaa
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5Tvinrml3Re5jcAkSYqyEuwE:A3kMP56r3pYqk
- TLSH T1DA555916E6644FA5D02BC078C9D29696EA733C461F3087CB1395DE283F237D19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH