Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 00:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 1.8MB
- Sample260823-ajftesgg97
- SHA256 237402abe9700d2e4ad0f03128a7631e6df575b5e183d01e63ff2c724d4b2725
- MD5 cd9e8a8a6bfbcd3b2c99b89b9ad45b68
- SHA1 22d259d68f81251fe00b52f64c012ce4e8814f67
- SHA512 4309ab559f07ff0fd9f13778367f3f6582dbf425861f5c756ce8d86dbb2b97cda0a531ad25e8ed8b01994684dbc2f0b93167c781979c1d8027807dd225217724
- SSDEEP 12288:EZ41TtTuRWny8d+roTfREZW9Ax3K8CbEcieT6O48OwgIk55bCu/8huoMTJ/8rov/:ftTuRWFsronbEqa6+GG8yKrO4c
- TLSH T110958E1BB79400E8D42AC175CB654236E672BC560B30AADF06D0B3692F77AF46F3A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sl-si\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.tmp 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\as-IN\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-fr\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.tmp 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\TabTip32.exe.mui 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\css\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ro-ro\ui-stringstmp 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\gl-ES\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.tmp 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_hover_2x.tmp 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Media Player\de-DE\wmpnetwk.exe.tmp 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadLine\2.0.0\fr\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\es-es\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.tmp 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QHEADLES\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca@valencia\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\System\msadc\msdaremr.tmp 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ca-ES\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\System\ado\de-DE\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\EBWebView\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\System\fr-FR\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\System\msadc\en-US\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Windows.Input.Manipulations.resources.dll 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\pt-br\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5884 2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5884
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2115213192-531537726-3295841909-1000\2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 32KB
- SHA256 ce5306fc9740622a5dd06f751051edbf61bb9ec3cacd38fa006a9b3271d3390e
- MD5 74f1d60711d6a4b9a09115809f3f4c07
- SHA1 c87ba2163ff37ceed7bd708e3cf903f57eb96ded
- SHA512 b512d4ebece673a91ff57a7ae40da9c649afa25cdf9e776b4a39a9d66bb8015f15443338627713f8f4de99c115df1e62e6167ebcabd082936015ce3eb5e3e56d
- SSDEEP 384:OidyDBQVcNEbmCXaQ4x/VC0TSz0gCaNwKdtpFIdUXJ/nCyEUGh6JD004R+i7:LdytQ7bzb0vgCa2Kdtp2dUXFCvEpQIm
- TLSH T1B8E26322F54C847AF214C6F219A9969674263D310A90CD1BB789BF6D2EB40D3B8F071F
- MD5 SHA1 SHA512 SSDEEP TLSH