Analysis
- max time kernel
102s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 11:41
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe
- Size 4.0MB
- Sample260825-ntn5fagh93
- SHA256 efd56bd9c001370c1769238ae752435ed19dc095a52adf84e3a000d78fb9e596
- MD5 653bfa2b3c83c3dab117e1b128ace5c0
- SHA1 0815df72c7d0937388c4dd2d73336e08e4b4d8f1
- SHA512 63c112e606a40e0b5ed0ef4d5e3a7f50d47860dfc1942cb33c4307f93203b86f1b432313518c54b53355be84a9f1fab5b7a90de1ee081ccc58f384b4a19e4899
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJPqJtb2I:YqcxAO1rC12eQx
- TLSH T113164A21B2F84B65E0B79179C9B29645EA327C524F30C7CF12899A6D2E337C18936773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/3452-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5e4-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001babd-282.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-284.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0012000000019908-387.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000019d33-1284.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00170000000188d8-1472.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3452-1849-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3340-1970-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 3340 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe - Drops file in Windows directory 62 IoCs
description ioc Process File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3452 2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe 3340 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_653bfa2b3c83c3dab117e1b128ace5c0_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhad.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3452
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3340
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.0MB
- SHA256 efd56bd9c001370c1769238ae752435ed19dc095a52adf84e3a000d78fb9e596
- MD5 653bfa2b3c83c3dab117e1b128ace5c0
- SHA1 0815df72c7d0937388c4dd2d73336e08e4b4d8f1
- SHA512 63c112e606a40e0b5ed0ef4d5e3a7f50d47860dfc1942cb33c4307f93203b86f1b432313518c54b53355be84a9f1fab5b7a90de1ee081ccc58f384b4a19e4899
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJPqJtb2I:YqcxAO1rC12eQx
- TLSH T113164A21B2F84B65E0B79179C9B29645EA327C524F30C7CF12899A6D2E337C18936773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$
- Size 4.1MB
- SHA256 c6bae7a06c114a2e3be7230a29fd39f0e62a640c63a53ff861a27b93509cc191
- MD5 7bdefeda2e84c5dfb4f78811976ee12d
- SHA1 6a509e3b0a0d321bb91ea41385b50b790293268a
- SHA512 61dbc7f902984ca4ee9abd4e610d7622481fe524344682cedc96d296e685c2b03640ffbece57991cf31fd4ab9cf31cc463a165910a7d8b33897c476c20380f00
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJPqJtb2I5W:YqcxAO1rC12eQxcW
- TLSH T1C9164A21B2F84B65E0B79179C9A29645EA327C524F30C7CF12899A6D2E337C18D36773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.5MB
- SHA256 40d6d0dd2d0e7a1b4e52ad7bfd814e9e1d41d59fdcfb9ecbe30f4eae35d2bb53
- MD5 32a064abef8b6ce403c65abfdad8383f
- SHA1 2b0cf96d6d291c8354caab3b3eb0b7c159084ef5
- SHA512 e32cb3bbc43660f87c0b00ee3aabbac5d552b92add630c9366bc6fec7cbbc97c5e9d0abdb3d5bad0435102ac182d93a0e376b4efdd1e4be5072178cd37197835
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJPqJtb2IQPji0Aj:YqcxAO1rC12eQxZjo
- TLSH T156264A25B2F84B65E0B7C179C9E29649EA327C524F30C6CF12859A6D2E337D18936733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 4.0MB
- SHA256 f5c140c06a11130e6390843fd879a0a81d43cce16551df9482c29f1340615daa
- MD5 f4491c2cb0d73c8aaf47ee3f0f09a991
- SHA1 d9cea3e56644ddd262980c509dc89531aefcc9ef
- SHA512 33d9b650aaedee9d533ae8a429cdf22e748fea2722cf1322455138b9f1d8799a5750fad8b1b2e0c765e0def47c5aac5e9b5674833b4f940468ac7ab875768bff
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJPqJtb2IN:YqcxAO1rC12eQxm
- TLSH T1F6164A21B2F84B65E0B79179C9B29645EA327C524F30C7CF12899A6D2E337C18936773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$
- Size 4.0MB
- SHA256 062bcab1200aba21fab1b323bb53d0e1950e21365faed319982108e966d3c932
- MD5 9b3fcb0eb4239fb471c8631c1778b122
- SHA1 daa214ec7a0be7172d5f72f85f4b7254ead385b4
- SHA512 9a3daa830fea77dd168d72d2c248bc4a16b05b9d000030af41d2275f07265359f9eea27a1f2ecfa6640bd33cb1fbeac8d74cfaf91e37eb0f1ddf0f2c126386d8
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJPqJtb2I6:YqcxAO1rC12eQxd
- TLSH T142164A21B2F84B65E0B79179C9B29645EA327C524F30C7CF12899A6D2E337C18936773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 4.0MB
- SHA256 989aa31920484bc8ad522d4c2f4fafa0467e80b77b77cf9016c44b9346aaac8c
- MD5 4d387a1b3228d0ea4419eb18c4a85a1a
- SHA1 59fcbaef0ef2589a08bcd00f4d162474e2031cc5
- SHA512 09ffa2352cb4b0e19ca9cea5a74b8a38db50718e415a4a2580aa5e35e5f8a941dff42c8e0f010f5e65aec8ab282fb25224c75e5801d5b7547ddf7a3f54283a70
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJPqJtb2IF:YqcxAO1rC12eQxK
- TLSH T155164A21B2F84B65E0B79179C9B29645EA327C524F30C7CF12899A6D2E337C18936773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
- Size 4.1MB
- SHA256 5a69059e438413c486aa0d7f5f7592f5464db742181810bfae1f897552adb668
- MD5 31e3597ce4820482f68b93ecb7c7c42b
- SHA1 2c8e9ac5d50baea11a8d8e9259f7441a488c3870
- SHA512 6d59e089bbd3b8549dfe091fd18e80ec223aeabd23ad5b536e85640e858d10fb89898eacfd45c4f76adc65f2da00ff23fb2754f0f0fdda1469829716d960ef32
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJPqJtb2Ig:YqcxAO1rC12eQxr
- TLSH T1F3164A51B2F84B65E0B79179C9A29645EA327C524F30C7CF1289AB6D2E337C18936733
- MD5 SHA1 SHA512 SSDEEP TLSH