022680e3961cc24f9cddc300b6555534727ebb99fdf7d47c7dfc2aaf27b48087

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 11:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
Size 16.8MB
Sample260831-nlabbaga98
SHA256 022680e3961cc24f9cddc300b6555534727ebb99fdf7d47c7dfc2aaf27b48087
MD5 50c2372396b6312c640d98afbee0bb9f
SHA1 021cead8e3775dc73767cd0b7f1d530809cd94b7
SHA512 0691c69d25319ceda8b1a724be3090774b6f32a9d90fe562408ce89a349b857762e601ac3cfee87b31cf41ad22c7d67fe73cc5c03ffdedddb0e5b1a5c271d8bf
SSDEEP 196608:FQdWQdJQdWQd7H18UvQdWQdJQdWQd7H18UE:ZHo
TLSH
T1D0074962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
4392	UpdatAuto.exe
1692	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
2104	UpdatAuto.exe
1140	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4~4.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5108	sc.exe
1688	sc.exe
6112	sc.exe
5820	sc.exe
2552	sc.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3620	cmd.exe
2008	cmd.exe
3708	cmd.exe
5444	cmd.exe
888	cmd.exe
3644	cmd.exe
3964	cmd.exe
4456	cmd.exe
1792	cmd.exe
1328	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4188	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
4392	UpdatAuto.exe
1692	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
2104	UpdatAuto.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4456	4188	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe	89
PID 4188 wrote to memory of 4392	4188	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe	91
PID 4392 wrote to memory of 3620	4392	UpdatAuto.exe	92
PID 4188 wrote to memory of 1692	4188	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe	94
PID 1692 wrote to memory of 2008	1692	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe	95
PID 1692 wrote to memory of 2104	1692	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe	97
PID 2104 wrote to memory of 1792	2104	UpdatAuto.exe	98
PID 1692 wrote to memory of 1140	1692	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe	100
PID 1692 wrote to memory of 4636	1692	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe	102
PID 1692 wrote to memory of 3964	1692	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe	103
PID 1692 wrote to memory of 3644	1692	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe	104
PID 1692 wrote to memory of 888	1692	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe	105
PID 1692 wrote to memory of 5444	1692	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe	106
PID 1692 wrote to memory of 1328	1692	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe	107
PID 1692 wrote to memory of 3708	1692	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe	108
PID 1692 wrote to memory of 5820	1692	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe	116
PID 1692 wrote to memory of 6112	1692	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe	117
PID 1692 wrote to memory of 1688	1692	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe	118
PID 1692 wrote to memory of 5108	1692	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe	119
PID 1692 wrote to memory of 2552	1692	2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe	120
PID 888 wrote to memory of 592	888	cmd.exe	126
PID 3708 wrote to memory of 3556	3708	cmd.exe	127
PID 4636 wrote to memory of 4904	4636	cmd.exe	128
PID 3556 wrote to memory of 4432	3556	net.exe	129
PID 5444 wrote to memory of 5712	5444	cmd.exe	130
PID 3964 wrote to memory of 1116	3964	cmd.exe	131
PID 1328 wrote to memory of 3204	1328	cmd.exe	132
PID 3644 wrote to memory of 4944	3644	cmd.exe	133
PID 592 wrote to memory of 2012	592	net.exe	134
PID 3204 wrote to memory of 4776	3204	net.exe	135
PID 5712 wrote to memory of 4224	5712	net.exe	136
PID 1116 wrote to memory of 4612	1116	net.exe	137
PID 4904 wrote to memory of 4644	4904	net.exe	138
PID 4944 wrote to memory of 4228	4944	net.exe	139

C:\Users\Admin\AppData\Local\Temp\2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4456
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3620
- C:\Users\Admin\AppData\Local\Temp\2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
  2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2008
- - C:\Windows\SysWOW64\UpdatAuto.exe
    C:\Windows\system32\UpdatAuto.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1792
- - C:\Users\Admin\AppData\Local\Temp\2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4~4.exe
    2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4~4.exe
    3⤵
    - Executes dropped EXE
    PID:1140
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\SysWOW64\net.exe
      net stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4904
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop sharedaccess
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop wuauserv
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1116
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop wscsvc
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Windows\SysWOW64\net.exe
      net stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wscsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop srservice
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\Windows\SysWOW64\net.exe
      net stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:592
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2012
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net start TlntSvr
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5444
  - - C:\Windows\SysWOW64\net.exe
      net start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5712
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start TlntSvr
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4224
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net user helpassistant 123456
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\SysWOW64\net.exe
      net user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3204
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user helpassistant 123456
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4776
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net localgroup administrators helpassistant /add
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3556
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators helpassistant /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4432
- - C:\Windows\SysWOW64\sc.exe
    sc config srservice start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5820
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6112
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1688
- - C:\Windows\SysWOW64\sc.exe
    sc config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5108
- - C:\Windows\SysWOW64\sc.exe
    sc config srservice start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 8.9MB
SHA256 c966053bf66d34a8daa3e3013c1dfb6bd15635ce7d2da23eb43bd565ac113740
MD5 b1ca1691475ed1f6f0b9b7f36f8ca5f1
SHA1 d187ace2ccdb0581c4d06024bdefab2def2318bc
SHA512 782d9de2a446f03f7802e138f7ffb9ee2a252b14371a68d73234c766465e5d256a0f945563df4df3b3089aee84d58cdd212d82f97ec359c74f1b0d1fbcb549bb
SSDEEP 98304:DIyatduIyatd/IyatduIyatdHbY6dRnUm8UEjo:FQdWQdJQdWQd7H18UOo
TLSH
T1F49649627201966AF025EE77C76B7325B8203DA61FA0858FD60D732C1E362F15FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 17.2MB
SHA256 3326d8343df6b36a5eaa43dc7e610c29da1d28fc06b310aaf17ec2fa84843ea8
MD5 492c89b5bb9b5cb527b1acf3c7c6fc02
SHA1 a9bf19892b4617b3c1cb5b661228a1b51826a67b
SHA512 14a38f87cb2a40c3ad801424b41545cdcf0bb4531a25b24c8f5c74a9cd87b706ad2fa6b35a257e0ac59d54a55a686f31b6045ada2a85ba652e752b5bb78153f2
SSDEEP 196608:FQdWQdJQdWQd7H18UQQdWQdJQdWQd7H18UOo:ZW1
TLSH
T10F0749627201966AF025EE77C72B7325B8207DA61FA0868FD60D732C1E352F15FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 9.3MB
SHA256 5a0eab9ede28bfc4413c1640545c56f69b30c2eb8f8de7be4ca54847b1a6f26f
MD5 f92195cdbe8d92fb8250fbe975e44bb3
SHA1 f1be6f865753985d066edc7271bdec4235cbd85b
SHA512 8de659b615ce2ef0176ef59d8db2afebb1ccc6a6089e61222dd5c95a8c229b17b3aa7e7516640c4653ade5a67ef91a2543a6acc7f727a4492572c07e2546c208
SSDEEP 98304:XIyatduIyatd/IyatduIyatdHbY6dRnUm8UhezSC6v2XMH:BQdWQdJQdWQd7H18UW
TLSH
T12EA649627211966AF026EE77C76B7325B8303D961FA0858FC60DB32C2D362F15E76349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 17.7MB
SHA256 83e1492b21f900db4b69557894bc266652f9143d0b55f30c8580983aef3bad26
MD5 5ca41f1f07e45cfa90eda1676a099092
SHA1 701bd7ca3f968cadd0d6a544650f1050e1913343
SHA512 216f30444fcaefd085c8403c9f706460a7078b9001a5933e18a85a47d6976bd294498b2456f04f30dd33156ccadb87fd96c906bf0d3f4c393c20137e0ffedc87
SSDEEP 196608:BQdWQdJQdWQd7H18UUQdWQdJQdWQd7H18UW:dK
TLSH
T1641749627201966AF025EE77C76B7325B8203DA61FA0858FD60D732C1D362F15FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 9.0MB
SHA256 44407436a4452af5ddce803dd93c7ac72d0b8a89e61a69aa1e9ba762d8eaf03a
MD5 130dc3e5373a1c072640bef051d1b508
SHA1 bbc364c8bf9dc26f4a90ca2bbb2039aeb7f25ba0
SHA512 725f2d3736aac85f28cca8459d6afc27d37f1ba96e8f94172a40a393f2ed74b2c80e71fe0b91989e1019fffebe77e1c6d03f0d69cba31c8c900d2dc1b8eb2915
SSDEEP 98304:0IyatduIyatd/IyatduIyatdHbY6dRnUm8UJ/h1+:cQdWQdJQdWQd7H18UJ/h1+
TLSH
T1589649627201966AF025EE77C76B7325B8203D961FA0868FD60D732C1E362F15FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 17.4MB
SHA256 a6ada301d2e0c63b1443ed97972563f83a043661b5e91f64e4500ef7b707a44a
MD5 22b26d5820e111a53d24b04463d7b032
SHA1 0bccbf591bd4bc5ce0db36bdd2e53fd4a71f154d
SHA512 718a8f4bea39dc397d1263249a0680ac9414078e2987b1115caa89c1af6f6be9aee68b37e6abff92475d15e03d199356e1c35b3185194c346a80761ce4c6c887
SSDEEP 196608:cQdWQdJQdWQd7H18U5QdWQdJQdWQd7H18UJ/h1+:eB
TLSH
T16A0759627201966AF025EE77C76B7325B8203DA61FA0868FD60D732C1E352F15FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 8.4MB
SHA256 7c23bb59dbb5e4a35445306d86746ae900e3a97cdd0161d797a3d616b63241a4
MD5 53bef1315c1965a08f83c2fe75548e20
SHA1 bd5596558df18ee6e0b583f769d94955fc92bf5b
SHA512 da5db8aa60fab4ecdb22a231820569467dbf18e8cc18a27a00fc59f03f74fdc789523b0a52b35e99a1b832e097fa5b94868e8ccc6e11dad9c8e4fc596625f5e4
SSDEEP 98304:hIyatduIyatd/IyatduIyatdHbY6dRnUm8U:LQdWQdJQdWQd7H18U
TLSH
T158964962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 16.7MB
SHA256 604aa3f2a5ba70a79292112df5350329b572b2b443cb939c6dc7171de06d32a3
MD5 11247985144857d4a53cb7f68add8ad6
SHA1 ff184a63c7c5b51cfb895fc27d6ce3e1fd674436
SHA512 fcacb209fbfb48b8a5ac99585043cca4ceac736cabd3569317176add8cd5c49434751eebe3d199e407646666e8c1ffdf1c400011220d2ec26828e7d7df9e4c56
SSDEEP 196608:BQdWQdJQdWQd7H18U+QdWQdJQdWQd7H18U:d8
TLSH
T1DB074962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 10.1MB
SHA256 177821e51eb46a269b09a801bf5f384b90ecdc6ff38608b1efbf4a684e174f34
MD5 3286b2a29502cd943292ade3a88ba517
SHA1 19f4c562da4ddb24b4c3c026eab667cf97cf0f2a
SHA512 9c84206fbbc4736ab7430f1ef3959c00f39c475d05130c75862cc73e1f1af7489e9cd52879ac25a0e1bce484dfea30b83e5a63d5ffd29293226aa26db85ac9b8
SSDEEP 98304:/IyatduIyatd/IyatduIyatdHbY6dRnUm8UXthHRc/Q:JQdWQdJQdWQd7H18UXthHf
TLSH
T1BFB65A62725151AAF019EE73C71B7324B8A07DA50FA0868FC60D73291E366F16F7634A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 11.4MB
SHA256 10316d5056ebb76624d368988553b2a7345f4b2ba788726a8e8104a41505d1a7
MD5 7653d7b1a7045b8a55812e649370d399
SHA1 839dc56d8eb5788c8f2825f0a9d8d499ca259406
SHA512 423ef1ebac7966d88405f862eef4f604eeff1080728809367ac5964ddd460b08fc9298b3d45cf8fc9b9fa101dd27da4f3f61e85b07134992b3dab06b42295f75
SSDEEP 98304:/IyatduIyatd/IyatduIyatdHbY6dRnUm8Utm7vj1BDlZG:JQdWQdJQdWQd7H18UwjnDO
TLSH
T1E6C66B62B24151AAF019EE77C31BB321B8207D950FA086CFC64D77292E366F16F7A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 19.8MB
SHA256 fe487e8c9e5f3325518abca15ae9f9d9d701e49302110e7df7160dc7322d37a1
MD5 0bb11f606830c22361a9af4b233025e1
SHA1 de60c08602ad1bc3cd14af225b478ffbde9f7966
SHA512 78f48a23869a7d2d739878d9920f4c71a9ac4d7f65fc419307a19afbfb0d89e5f5d6736e711d8159f9ca44dba12b4d427a400e88eb37d3285d495e92cfb8135a
SSDEEP 196608:1QdWQdJQdWQd7H18UsQdWQdJQdWQd7H18UwjnDO:pi2O
TLSH
T1A0276A62B24196AAF015EE73C32B7325B8207D950FA086CFC60D77291E366F16FB6345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 9.8MB
SHA256 11f274d16426023a119b1c2d1437439b716c80a497a8e2b9e2f743a1d9a52190
MD5 d60a6627124d18ce43cf74ffe7006501
SHA1 6a5d8833d43e0cddae2150b007fde63fe58dc558
SHA512 b1ddeab7a3230ed2a0e8253ae69b66c237e771ce1bf32b51240a63004169c2ba58746a3285ef0a3b8874d47f79d5c3193b60b1c0f118b88f813596cfff471af3
SSDEEP 98304:XIyatduIyatd/IyatduIyatdHbY6dRnUm8UmX2iwphX:BQdWQdJQdWQd7H18Ua2iw3
TLSH
T170A66A62724156AAF019EE73C72B7325B8207DA60FA086CFC60D73291E366F15FB6345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 8.5MB
SHA256 4aa2b842e482b769cd268bd35ed57943885fd6ecffb3316cd188b8ff123bd98d
MD5 1813c6e2135ade2f7b4baca4ac03412a
SHA1 6f5900f442f0e263635ef8e5b68d115a70a96aa2
SHA512 2bad89963e27ac017ecaf37912774f04fbafcbf22d8e66c6017191c9c460ed890d1591145df5199cba8e703cfa37c52e2ed35e6d78748e8a67e5197cbbc248d5
SSDEEP 98304:XIyatduIyatd/IyatduIyatdHbY6dRnUm8Uz:BQdWQdJQdWQd7H18Uz
TLSH
T16E964A62B201566AF019EE73C72B7324B8207DA51EE0858FD64DB32D1E352F15FB6386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 16.9MB
SHA256 bfb3213231c36d43dc7c2c03ca7a31c9d54d253b10d0d4a53ccd06c1f483d18e
MD5 a0986dfba701d027c51d87e94d4c7985
SHA1 11cba91c00995f27580bf67b2e3659f710a54369
SHA512 8ea7fd7ffec748e4745500525733f0495e039e8ae47bdfad16037fc66304d2fefc92d435e3366f6d5d971a3d29ff16f8ae9017e8df9280b2eb28ec02b6d18072
SSDEEP 196608:BQdWQdJQdWQd7H18UUQdWQdJQdWQd7H18Uz:dKX
TLSH
T18F074A627201966AF019EE73C72F7325B8207DA61EA0858FD60DB32D1E352F15FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 8.4MB
SHA256 9bd3b082ee2a3adab097d0a61cf73bb0d90dec612f0f6eeff94b93a7da512d64
MD5 5354a9b2c95b2aea5342fa792cb90ad7
SHA1 9a4a647fe33f1204759c30426ae2fdd6fe3513b9
SHA512 4fd66521dda9e1cf875344452b5ae17758f2a5018acb5c94f8ec9cbbff2abbf5d1046b2bf1df9acebc150424c3af4f8080f145d4e9d3943b553ba9f1eec87466
SSDEEP 98304:TIyatduIyatd/IyatduIyatdHbY6dRnUm8U/:1QdWQdJQdWQd7H18U/
TLSH
T16D964962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 16.8MB
SHA256 ffdfdadf29f62577d0f41fa1f7b89fbd7a4d5e649b4027ac5042b6c55f2fba22
MD5 ed3e48db237370984edb25c15fd7a4f5
SHA1 f9d866bf87e1130f4138d69b1f1cade8a9aeac9b
SHA512 a6531f02d77623fdb4a7ef911c2eff65a17813076ec4a62ae145baf1dea8a744e1e65dd2c216deea8f0237abba468ab3506a3eeb0d99ddcb66eaf42bd07e54aa
SSDEEP 196608:1QdWQdJQdWQd7H18UAQdWQdJQdWQd7H18U/:pm7
TLSH
T11F074962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 8.4MB
SHA256 4bc834f42b45cfa49c7ce68080f2d2087b01b707a9717d7aedcb8907c0ad10f0
MD5 a8d8160a497d607a8a2487a55594d5b6
SHA1 c8302f367bad37f8f8217b4cc0f255e680ba02ae
SHA512 46f4bf2845030c188a748a13801877ebf4d572cb71538492e727a48229efe211c4857e1d90a55bb8293d7d75bab522cbf6168cd66383881f5c7166d709e44428
SSDEEP 98304:TIyatduIyatd/IyatduIyatdHbY6dRnUm8U1j:1QdWQdJQdWQd7H18U1j
TLSH
T191964962720196AAF015EE73C72B7325B8207DA61FA0858FD60D732D1D352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 16.8MB
SHA256 a2eec25014396cde62939e57843b5f230ac60bc21b4b40bbc51d4340de8a42d2
MD5 036db6b2f2a5c2bd5526bf4e596c5c61
SHA1 7a8026db419373ba6e96a8319f6b4887f1ee6386
SHA512 bbdf37e56c618eb28bee8fa8e028f2096d7e5ebfc2f6988d5bb0af3ec2c866f3c95e651e92e2a47b00ed44159c787d985b6f7895d274add542f64c1509200ad1
SSDEEP 196608:BQdWQdJQdWQd7H18UAQdWQdJQdWQd7H18U1j:dmpj
TLSH
T141074962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 8.4MB
SHA256 0546036c1e2d8ec523c38552c8f365bdb699033cabd9f410d1e615aeb4d137d4
MD5 601ea0a197a2279ffff4d9b295a51924
SHA1 311b53f171a0e1b0a6630635a5893f1556f70d27
SHA512 e29f70383e5d53ecc4cf902ccc6da16b26c1518a2c2ed48c1d21a7a50edaeddabeb41bd0e86bbeac3d868b96d8a0e1043ddf37e89fd9b25fbb398009d630fa64
SSDEEP 98304:/IyatduIyatd/IyatduIyatdHbY6dRnUm8U/D:JQdWQdJQdWQd7H18U/D
TLSH
T13F964962720196AAF015EE73C72F7325B8207DA61FA0858FD60D732D19352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 16.8MB
SHA256 7645016d0083ba5cd795080f25564f3273c7ccb085d46e80b3a16f5c0458f445
MD5 a5aa64b843d0f12f17d8e683e2b2f03d
SHA1 ea1ee96028af8f699cfb5b59d45624a6f226c4bc
SHA512 a7967bff711fa28537d1aad70aa4c1c263001d1d244b6909ad6e7f60db73f5918741c81ace19798d0b4d32c4b7b51f424f3c3a7dd12a2a19a424cea375cdd871
SSDEEP 196608:1QdWQdJQdWQd7H18UsQdWQdJQdWQd7H18U/D:pi7D
TLSH
T195074962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4.exe
Size 8.4MB
SHA256 c148ac280957907997996b9a405ec7ba0477f6f58e46bb98079aaa7893acd34a
MD5 d9d462753d6fde40c54bcd8930529abd
SHA1 b95beddeb23df9d2e63b7b42db9e168430d3e4c6
SHA512 468aec1d86f4afe0b21ef576ffd12ef2e022dd3846e73e26f223431138fba99956311bb61d262f070adb4194e191f2baea8261cba265c482b07d96c86350c636
SSDEEP 98304:DIyatduIyatd/IyatduIyatdHbY6dRnUm8UM:FQdWQdJQdWQd7H18UM
TLSH
T1D1964962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-30_50c2372396b6312c640d98afbee0bb9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl~4~4.exe
Size 44KB
SHA256 f7722702e33e9c02a8b11b96472f9a7b08afd5bcc090a6da818677956b73a559
MD5 e0e2408eb11225ce097ace0f480c0127
SHA1 a414af7f4b53377d7a4b2f42ad110f2a274c1048
SHA512 cafbc0c54f6a1dd4ec2cbf99d8f7dab9e734adb260a36fc04bb62d2d452e27728323a582913097318419db464fe601ffcaad9a49178840c786b655d47fe0c778
SSDEEP 768:KHkeHvDcVjP1PmGrdtd4l45BeZfrH2psAogOXBEpYi6uy9:KEQv4VjP9mstd4MBeZfrWogOXq76h
TLSH
T16F137C0257A908D2E8B7D274D8F24616EBB5BD96A73183DF53104A590F713C0BE38BA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 8.4MB
SHA256 b7ddf329713d21a92290615e374dbdca7748710af3293097e05d27305c8c8df3
MD5 0baede1fc3bcd9e43eabab68ce3d45bc
SHA1 297ca41725a18a43a2ee9ef26e04103d789c6eec
SHA512 8bbbc22f52238cd8d92778f4992a57ad28cfb9b296e590222e5ab3fc57df1ff88691909b37dabba29907c33e4b27f158e86e3e0ba12c069a9f4719389310761c
SSDEEP 98304:DIyatduIyatd/IyatduIyatdHbY6dRnUm8UH:FQdWQdJQdWQd7H18UH
TLSH
T103964962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 8.4MB
SHA256 687d5c89b3c755770ad0f35a00115fb7829e77b112af45c1026ea13183af57dc
MD5 91aeb0c30f9923ed706e6d5c0a494eae
SHA1 379694987c36e1eec61a81677dc4e5e7471def80
SHA512 fc3c08a0d16e3e6eaa9179b1275515436b99deb83c056a01d658c4819e960f0e5296b14bc42c30abfe3785c7c448a23272bdb8932ebdaa8cb594231de7e664c7
SSDEEP 98304:TIyatduIyatd/IyatduIyatdHbY6dRnUm8UH:1QdWQdJQdWQd7H18UH
TLSH
T117964962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 8.4MB
SHA256 8bf13a7acd44f0ff226e771a6ec30c6b157dc3bdede5cd7dd0ee88e5e1c7408f
MD5 1374442ff9fdb9a6c963d33513425c04
SHA1 144c7a2f41d3f4b4ae700996deed20b38bb1d001
SHA512 2a0ae559cebe292ea35e342e09741cc302474cb21ee87b632331ab17ef3b350909c828e71e4f1fc69d482a9c3be89590f95b478279265d49a3e388fae3dbc14d
SSDEEP 98304:/IyatduIyatd/IyatduIyatdHbY6dRnUm8UH:JQdWQdJQdWQd7H18UH
TLSH
T1DB964962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 8.4MB
SHA256 64472e94a647b918e72007d548100d15664b76835a7aa6fbbfbacc74831409d7
MD5 f97c17879634a729fa20b7843807d025
SHA1 37abb0d5064229576fcd9cd3dba17a6acf0d1129
SHA512 2cd347671299fddb9edd0b57a9b766cd2bc559b6bafba9a699cfba63ce3879ba87a8be93cce5f1f3249d30fccafcd780bfcbbc32b2a3245a39cec7c8a170fcc6
SSDEEP 98304:/IyatduIyatd/IyatduIyatdHbY6dRnUm8UH:JQdWQdJQdWQd7H18UH
TLSH
T156964962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 8.4MB
SHA256 9b6ba016f6ca70e47e0a1900769e43f2f7821f13dc123758add6cdfc777bb7c1
MD5 c0072d65d239f7ac687278fe665992ff
SHA1 ad891fbdf93144451bfd5f3c144258cfba0f1574
SHA512 02dc3d3e96181baf43f169c887816cfb04374a90570a428204277f2beb50198d8afee057525f088d4035e01a2421492d030bf640b2982085efc2095afae54e14
SSDEEP 98304:XIyatduIyatd/IyatduIyatdHbY6dRnUm8UH:BQdWQdJQdWQd7H18UH
TLSH
T127964962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 8.4MB
SHA256 579cb0d766fb1cf109d9c7a9cf425c742524e8f8577094df75874e8a20d54f67
MD5 8e05ffcf47a3c43f038a6c6442599bae
SHA1 78f5bff1e8b91c2270256a43ae8615fb016879ab
SHA512 34f44e9d7a90c9f0b59d3d15752d751a6bb381e6e490777767981cd5d98ee854e638a1abf4fa279f1d719254d71c47e21c0bc8cc5132e69b125c4a855f747a5e
SSDEEP 98304:hIyatduIyatd/IyatduIyatdHbY6dRnUm8UH:LQdWQdJQdWQd7H18UH
TLSH
T177964962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 8.4MB
SHA256 7b04bc4d819abe7b541257f9a67471de097deebc87a86614e188126fe0960985
MD5 4d41ff7f2eb42040e6f6df1126b3f066
SHA1 7aa5b09ec1d5f1ab02d48444f60d1ac52fb62955
SHA512 1753f3a209ded0a565054566c7c1facfd562c24f5d94384913377e348d888154d3e46d1e4021bde07a63023218fd043920a37bf630da673d0df1c6001502b3f8
SSDEEP 98304:XIyatduIyatd/IyatduIyatdHbY6dRnUm8UH:BQdWQdJQdWQd7H18UH
TLSH
T161964962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 8.4MB
SHA256 4362eed0fa607ac99bce641831775679718e1d4c17f84a57df8b094e1385e88c
MD5 d9423c4a2e3ad06932eacb826786d49e
SHA1 76664e3ef421bfc11dcc6aba0922196ac77eaf0f
SHA512 b694331a0d1e9dc9ab3b1aa4699fc1ef8510bd9277a2fbbea89364dc9dde9b40991c03610f812be654049036514f4957735bd8145925920172e24c14d816d2bc
SSDEEP 98304:0IyatduIyatd/IyatduIyatdHbY6dRnUm8UH:cQdWQdJQdWQd7H18UH
TLSH
T1CE964962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads