733a3927ab0a0a7a97127bfbe70de2d5c459f8c1f66867a40d4f2a5d5d963163

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 361KB
Sample260824-keeexazxcs
SHA256 733a3927ab0a0a7a97127bfbe70de2d5c459f8c1f66867a40d4f2a5d5d963163
MD5 76f67b8b4d70064db8fc93e852d81185
SHA1 df823686dc0f1413444ce2da2195ee3b01ef64ca
SHA512 f78da51ac873a0c1cd4e36d9ec976b435658a8d43c7943b78040587cf8c2228b852533deb6880c4d6187adf54ca248777a366c6d4a07cfa942e5bada93892186
SSDEEP 6144:9XmRmTAHdwS/WYoTOLHIsPPzAdnz0YutYPDvhI:cECd9/WYoaLHF3z0z04PDvhI
TLSH
T19C748CA4B29C3BF5D8E385398D1DB556EEB27C250B20C61F23A8371A5F332911C2DB95
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (259) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 2 IoCs

pid	Process
4380	Logo1_.exe
3148	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\java.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXA99D.tmp	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXAC71.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\MpDefenderCoreService.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.Exe	Logo1_.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Logo1_.exe	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2016	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe
4380	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 1832	5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 1832 wrote to memory of 5896	1832	net.exe	91
PID 5460 wrote to memory of 2016	5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	92
PID 5460 wrote to memory of 4380	5460	2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 4380 wrote to memory of 4972	4380	Logo1_.exe	95
PID 4972 wrote to memory of 4624	4972	net.exe	97
PID 4380 wrote to memory of 2324	4380	Logo1_.exe	100
PID 2324 wrote to memory of 3216	2324	net.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AE1.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2016
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4624
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3216

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXB1C8.tmp

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXB1C8.tmp
Size 140KB
SHA256 dd5339b41631066a07c78457b9c8c0dc49b34550e6ed05e3d6a63fc9daa98ec8
MD5 8714690dfcfb842bdea671bd08c1aa02
SHA1 3d6128ec433432017db77eb95f9ab631f12bad48
SHA512 46e66f6bf40bc57725d378f7e77aca0cd75438c26af23ea7ce64fb5a2e3f21ac6faf235033d8daefd696879edd3cc2547f4a10f2f1cf3b350679a1c225d023bf
SSDEEP 1536:r7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxo:iCSjGoLpWM6bblmjxo
TLSH
T19CE35E6DB18FB3F2C3E199BC8D1CF2D5ED28FE20DE19285A75993B0E967A0C34508195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe.Exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe
Size 1.2MB
SHA256 354612c947750ea56fe906b6748e9e247d20c506b8b5a168f572edab9efb4cc3
MD5 067903949ac9182819d23ade4249d210
SHA1 b35903efc3ca384fa9e63f49d0f7b4c2165ca7e5
SHA512 cbe06396426f2ae760d93fa4854ef9ab007237fad262925e1e5cccb73afac0a4ddff99a389ddc4debac75de976eff5553563793dc6d2d806ee34704da8952cde
SSDEEP 12288:cc3Sgouvz0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1AnQ6i12NI+f:JSgouvz0ZRHkFfenxyQZXS7gZnQh2NIq
TLSH
T1F745C40267FD7329F1F37B71EABDB2645E767C61AE39C50E5284025E09B0A909A31733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB789.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXB789.tmp
Size 87KB
SHA256 e7f67b4f73acabfb3273c6c3c34ea4317f28dd948fd17848fe6e056a13db4753
MD5 ecde40815cd1c8e33d2dbb7c9638ecde
SHA1 0c31e4aeeeb8bf2c3ba661e59d66839d1f68c9d3
SHA512 3e5278b696fec2ed7aa953478b1ce7114daac34628bbb984cb6e0a3b9b8b45db131d25b3812235547bbe59715fb36bca8d0232063afdff1a1619f214922e74b9
SSDEEP 1536:u7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxZ1XkSPsULMHiH:/CSjGoLpWM6bblmjxZdtPlLqy
TLSH
T1BD934A69B28EF772D0F299BC8E0CF2E5BC247D301E19185BB69E1F0DDA7A5C2550C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB7EA.tmp

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXB7EA.tmp
Size 74KB
SHA256 84ac4e3b57d7ea9564ba057c67b103c1edabe83ec4509f5fa485ca92a8b353c1
MD5 2a769a19364b434c1c4682f5e06a3999
SHA1 242b2c0f13746b981717c642dffda5e52f9a6c66
SHA512 5a0453e2373e464872943f2c90c6f1da472854792f210984cd1f063bf6fea1b58f055c5c5e5c735bde997450d8193d9978c82617afb561594088d543a0636736
SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxo:DCSjGoLpWM6bblmjxo
TLSH
T1ED732A65B28DB776D0F299B88E0DF1E5BC287E301E29185FB69E1F0DDA7B0C2550C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB5EC.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXB5EC.tmp
Size 102KB
SHA256 d9a17342439bc242751276e361b18a4a90555b4f5e8205ac96ab15ddff00e814
MD5 703a9b7220ec2cb8df25f4f38094bb62
SHA1 a25c03f00230c84cadf38d371c43f8c187eb0985
SHA512 855ffcff17eb3259104dba2712d536c6f2a421576b7f0188dd6077fe6c76f1fa2b1f05c76d60e5fcf6466149d0472863aef3bedf91ca7aef335f6ec231c449b0
SSDEEP 1536:27qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxw4GZjzQwK5WW7VCn6KyO:nCSjGoLpWM6bblmjxue5BV0X
TLSH
T14EA37C65B68DF377C0E299B88E0CF2E5BD257E301E29085FB59A2F0DCA7B5C2550C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB980.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXB980.tmp
Size 83KB
SHA256 79d37a6b70d0bf9db4e945010b4fad145d50e5f7743d77d4e71d78ea1216f509
MD5 e68764f071fedf0cdb67120ddb88e33d
SHA1 38de1fcf517212f8321c996dec4d22f3e6974f2b
SHA512 b875040b7542a54d5ece9db971319fadfe680b02fc178120a35c3b056c6cde94399f1bb9192509a9a1e6acf85d749d0c4447d80f6ee07037b013a781d9c3bcd1
SSDEEP 1536:67qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxGqkSZZZ3n:zCSjGoLpWM6bblmjxIUn
TLSH
T1E3833955B68DB3B2D0F199B89D0CF3E5BD257E301E69185BB2AE3F0E9A770C2150C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXA85E.tmp

Path C:\Program Files\7-Zip\RCXA85E.tmp
Size 75KB
SHA256 1b67bfc9bb87c16e0656464b0df00c3842f144b2c64a4cdd7fc2fea6352a60b0
MD5 ac4c6d9a27d715fb36eaa7d533b66be3
SHA1 7ce0bd8300ebdcc7fd6a496f75aebf382c711b7d
SHA512 595d5827e08678a73e774472285f73b98e81750baab242063bd79cd75bea8a5412b3d5b8176b3468d271a766561bf97ee35edc669f26d563656daf43c48a444e
SSDEEP 1536:O7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxV:fCSjGoLpWM6bblmjxV
TLSH
T139732A65B68DB372D0F299B89E0CF1E5BC287E301E19185FB6AE2F0DDA7B1C1150C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXAC0E.tmp

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXAC0E.tmp
Size 75KB
SHA256 a20c8d39672d9faac6bb79bd2ac81f1f99141a115dd5f95c277a3bf9a436a737
MD5 e717f449f8a0dc846d08fa282fe7c3b9
SHA1 d95bb98d92b8703953c51ab3cfdf746a85475c04
SHA512 673b1cd2c04c61a33b027fd59e7abcbf446c681a0039d2fc547a646061bd29d6fa26bc520ec19d6dd096f38ae2ff4a0c3e9646d808682d33a80ca1c6858333d7
SSDEEP 1536:a7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx6:TCSjGoLpWM6bblmjx6
TLSH
T197731955B18DB372D0E299B8CE0CF2E5BC297E701E2918AFB6AE3F1DDA761C1050C195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.Exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe.Exe
Size 529KB
SHA256 b07bbf9ea33f4cd64b6ab5be23c0b71898279c6e7858076cc77f4bc956f83b35
MD5 1ec79145040f586611e845d4ce35b054
SHA1 60ab9ed4ed6ce700a37847edb54ac913cc3668f4
SHA512 b0eb6fc71a9c989c3d8f3a6ae1fe461de8996081670c5c61d81906eb38541b16b434672227dfc0df4c43f17b5802bb7c9feabc01875058b233a8bdf71dcc32f5
SSDEEP 6144:JXmRmU78n5Qw0tneDA/sqhleIc0HftDrkYY1hj63hgDonsogCh6NEpAFM:wP85bM3npxYfj63hgD1ZiL
TLSH
T191B4C40277EDB335F2F31B31AE7DB2515E7ABC619D35860E23841A0D49B0980EA75B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXBE74.tmp

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXBE74.tmp
Size 76KB
SHA256 808479d32c90cfeed4f48786ad6b65d3e0c51d0c219cafc2bb9c3ebafa477e58
MD5 81a1a4ea629b4cb31caac24444290a57
SHA1 921df5cfe6b55537eefab12ea13e105b4d5a0b4c
SHA512 356ee24bb3546133c59bc0179eb8225748df16bb513d8adbf54cd7647df394f587d2d5e9e79f4856e86b6fefdf2c3b56ebe0dfb7b8e5bf0c412068f4776d8e5c
SSDEEP 1536:a7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxYa:TCSjGoLpWM6bblmjxYa
TLSH
T164731865F28DB776D0E199B88E0DF1E5BC287E305E29186FB69E2F0DCA7B0C2550C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a1AE1.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1AE1.bat
Size 902B
SHA256 2ba06269c6782de88e0fa9afaf8d2d7d5705a33bfe6dd8839bae63e26f483a7b
MD5 81949920f6455992addbab6084ac299c
SHA1 0a4d247d1041c165fa3f1c67eae208d48a51852c
SHA512 392033ee9feea4d538edd6dc74d031840e4ef0f4f2a7fa82d9cb6190f47f919958f30093b660d596738710026a93c7aba39e4ee56a58898a5065aad47ad298a7
TLSH
T12111E511D6EAEDD8C8A6A12B49216EC9C0A57A5D3F4B37219B7C810E20E4E4CA9D1B52
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-23_76f67b8b4d70064db8fc93e852d81185_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 271KB
SHA256 2088a75d8eab2078d66aaa68013ed0d7825a8e43a0f95fed47b15f8ae87267e6
MD5 9a35d668667d23633b17afa1e9de2c48
SHA1 5568c9004152c1e46ed3348a193c93dccf2c838e
SHA512 518df430fd9fb349db6931e00ef1d967a5168e0dc6ede4a26b799262661ffd00c4dfd376574857c1ea2aed5238ccf59887a00affb84e616291325cfc9c9fea92
SSDEEP 3072:cPRc25w3tkPliErTc5wxoTSXLNoKrtgCIhsPs6ZzAOeqEoqz851YST/n9kd+Y7TC:cdwS/WYoTOLHIsPPzAdnz0YutYPDvhI
TLSH
T1CF449DA4B3501CF8DC67823ECD654916D6B27C5A0B70C65F13A836265F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 89KB
SHA256 2e6d598e4ac6429eb1ef49a361fad2f793f243423a0353e95a36802171db0516
MD5 3056d68ddc19f79e3fabbf022148ca18
SHA1 96139a1b603aba4eb4f37ecd7aa7d18946fad899
SHA512 66164aa5c1357d6461a930792bdd3359f2c61234bebefcc05812a32171f75932795cf34553578b0603b3e49f7ca469653360345c2680caa738aacbab9082c004
SSDEEP 1536:27qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxsKM1oHByzLBpE:nCSjGoLpWM6bblmjxpBynHE
TLSH
T119932969B28DB372D0E298B88E0CF1D2ED647D301E25185FB7AA3F1DDB77181591C189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3148-17-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4380-19-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4380-1140-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4380-1264-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/5460-10-0x0000000000400000-0x0000000000425000-memory.dmp

Download