76adb3f1b7b71bdbbbc746103bc5b7357c58c2973c66097eff4380a1b9186acb

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 359KB
Sample260903-xecbrsdr6w
SHA256 76adb3f1b7b71bdbbbc746103bc5b7357c58c2973c66097eff4380a1b9186acb
MD5 f42f5bc2367e4d755b210dccc62e90c0
SHA1 ff642bea7885de6835abd25c92fcf3b11c631fe3
SHA512 d77570babc014221590be9c32f7c6cc5c82c98d8dcee559064c5b73dc7c935af335f780624437cd15ffb5d9389bd424062f0ee0b0e1eae47a19f565725708f99
SSDEEP 6144:9XmRmTAHdwS/WYoTOLHIsPPzAdnz0YutYPDvhI:c4Cd9/WYoaLHF3z0z04PDvhI
TLSH
T1B0748C94B29C3BF4D8E385398D1DB556EEB27C250B20C65F23A8371A5F332911C2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Executes dropped EXE 2 IoCs

pid	Process
2424	Logo1_.exe
2172	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\RCX652.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXA3E.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe.Exe	Logo1_.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Logo1_.exe	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5036	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe
2424	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 2228	3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	85
PID 2228 wrote to memory of 4396	2228	net.exe	87
PID 3188 wrote to memory of 5036	3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	88
PID 3188 wrote to memory of 2424	3188	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 2424 wrote to memory of 3544	2424	Logo1_.exe	91
PID 3544 wrote to memory of 2184	3544	net.exe	93
PID 2424 wrote to memory of 1444	2424	Logo1_.exe	96
PID 1444 wrote to memory of 4440	1444	net.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7886.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5036
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3544
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2184
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4440

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX128A.tmp

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX128A.tmp
Size 139KB
SHA256 38c834a224852dd2f535ce9e9e98c1efd18172e49a55b61fa48df958ecb1e214
MD5 b175db9dffbbe875dff1043e1e304f3a
SHA1 357d8a389418bd58d93358dd5ab8e9da0773ae66
SHA512 2822b7cd932722010efe4f6818ba0f4e31d788a32a4a4b25cc859048186b8b0da2cc70c42699f9eeb5d5e3bec5f8bef0636871dd8ba8473f14fc1235085fac1e
SSDEEP 1536:37qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxKT:GCSjGoLpWM6bblmjxc
TLSH
T1C9D35E6DB14FB3F2C3E199BC8D1CF295ED28FE20DE19285A75993B0ED67A0C34508195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX1491.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX1491.tmp
Size 77KB
SHA256 4d11579b86095fdd4e82e0ef5b3479375fb6c222b7023ef538ae6946691ef794
MD5 cdbddb93c463815ad1632128fb25e460
SHA1 93a73809ee3e24830ddd0b87605a41f077d12429
SHA512 115bf15672dcb25b50c49d0c04d038a5e3eb4152d437d227c8aae91020dd3151c635ba8367045f5a6190c0d788ddb8ecce1991df900e7bb05609b2c9c9f65216
SSDEEP 1536:e7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxMj:PCSjGoLpWM6bblmjxS
TLSH
T17F73F755B18DB372D0E299BC8E0FF2E5BD293E201E1D589FB69E2F0DDA7A0C1550C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX15B0.tmp

Path C:\Program Files (x86)\Google\Update\RCX15B0.tmp
Size 73KB
SHA256 92d2ff2b48b11b1088f985cf54114067fa09a32a327ed648c6044087f47c5d37
MD5 8b6e99a3a1d9d86f25a14e59db50e5aa
SHA1 72452d4b26b85f4a076c50aed2c40c88b701786c
SHA512 fbafed0e10facb6276f81fc26d1a08c27188a0acf55fcd33f92da09da8661ab099d798bdaaf01ca5f75d12b14866d56b1d31b3239d82399f59d33ee3b63a4441
SSDEEP 1536:K7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxyz:jCSjGoLpWM6bblmjxk
TLSH
T1C0732A65B28DB372D0F299B89E0DF1E5BC287E301E29185FB69E1F0DDA7B1C2150C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX17FD.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX17FD.tmp
Size 86KB
SHA256 e6913d318674892545c4342643012181377fc017e359e1d357a88da7eccded81
MD5 2c19c46eaa51b95209d45e137c2989dc
SHA1 7d40cc7d05cf4332fc1df7a9a63ccef800a87a6b
SHA512 066ea62257daaa6c0b30591b717ab3a9166f5e13e836ede521929143e217ceb39327362a350d9b7e47e1e6ffdabd0c9558469587f763e495210f87fe93149e76
SSDEEP 1536:m7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxN1XkSPsULMHiwa:3CSjGoLpWM6bblmjxNdtPlLqW
TLSH
T133834A59B28DF372D0F299BC8E0DF2E5BC287D301E19186BB69E1F0DDA765C2150C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX168D.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX168D.tmp
Size 101KB
SHA256 6c1a7ba019e33ed061647851ff9a351c45698767a6e75b4b63dd03cce126abcf
MD5 e2cbe2322a41ff1de4b8454004610690
SHA1 645aff59a8a72afd039b12d82a7db22d19c2e250
SHA512 d5e28059e2971b34d4ca69f65fba85015e66754539824003878c4f05d87a9485188107d58e1e81b8c76a611ad3a4da849fbb1e811628bf1acf3560b77594d20b
SSDEEP 1536:+7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxk4GZjzQwK5WW7VCn6KypA:vCSjGoLpWM6bblmjxCe5BV0v
TLSH
T166A37C65B68CF377C0E299B84E0CF2E5BD697E301E29085FB59A2F0DCA7B5C2550C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX1A14.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCX1A14.tmp
Size 82KB
SHA256 7a263b752bfc2a1f07b3b1d221993f805cb3ada7a457e251a3e621154711c630
MD5 ca8b520efe0ca90876bd91f0ec01eb0c
SHA1 bc391098ef4035cedbd7bac25523a305a1f5ad18
SHA512 6173cffa66e8f584bbfe71ca6d55031de95507ed35f48d6d3f4a18239a3d82fb5d76b188dfce11ff5a38b308ddc0a7bfabe56ec0315132481611d75c354fceb6
SSDEEP 1536:K7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx6qkSZZZ3PD:jCSjGoLpWM6bblmjxkUr
TLSH
T10F832955B68CB3B2D0F189B89E0CF3E5BD257E301E59185BB2AE3F0E9A770C2150C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe.Exe

Path C:\Program Files\7-Zip\7z.exe.Exe
Size 638KB
SHA256 7c00cea58bdfad35c984c335e6d4e55dd27df107901f056e5100e69dbe3a2f36
MD5 eb92207c6b28028e9232d162f0a66dcf
SHA1 067df4289a7742d825b89568c1f71fb18438260b
SHA512 5fb11bef30932aa4a37fdfd19709e5a91d345b16a0217e66624f2c56cac44e28f78aa555047fdb33c9b3d5aed4b68d2a19a077ea1260db5eadbcb32e61eaf810
SSDEEP 12288:c4CSXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:OW0Le5ji0hmxNrM
TLSH
T18FD40716F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286976C6E276E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe.Exe

Path C:\Program Files\7-Zip\7zG.exe.Exe
Size 766KB
SHA256 da55f7fbd83561a6f3e34027eb90cac81010eba0e185ee68e1bf2cfdbb9c973d
MD5 60679f03849178f139b320b6e76bdeca
SHA1 ecad539810b8aceec858abcf4e71e065ff8464ab
SHA512 4ffe6a0ef3aabd58830d92b77293c692ee1015dfde01619f8d896f4603217acc50cc6902e857f520107ca63dcab9b64e6a62f462084ff0e2ac4eb576f7f9c9b5
SSDEEP 12288:sBVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:YVbqPb88hv/l+7
TLSH
T144F4E665F56CB331D0F2C0B9C4DEB69AEE323C415B318ACB1246972C2E676D68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXA4F.tmp

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXA4F.tmp
Size 74KB
SHA256 d5ba1d38f4890c2de890dfb6f77b7e36675831fba8b8e46758fe46c719b1b25b
MD5 213cea97db86c335c0e80ee7a2814e8b
SHA1 b130f3945dd4c4772c6734863047b0e4bce1e880
SHA512 621af6d61de03de261ca5deb25a1d5658457d3b85b96a0706879c3801c54a94b634eb5d5a9b866d1f08913fda7f67a814b58ce6672f36d50e2f8d22520054ce0
SSDEEP 1536:i7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxUr:bCSjGoLpWM6bblmjxC
TLSH
T150730965B18CB372C0F299B8DE0DF2E5BC257E701E2918ABB6AE3F1DDA761C1150C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX1EC9.tmp

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCX1EC9.tmp
Size 75KB
SHA256 8eeb70fe8c874c2308527a81c739c1beaa557e3330fc7003b4593b76b29a9b6a
MD5 296352564bfb03de11db4cbbb5fb5317
SHA1 d7fc8c5e3ed0a3f2414a0a0a886dd16b2828b9b8
SHA512 7ab746e8c37c3c344c4e2ed87f70a851bc2ce0f90987f056b21989be5f8466a770696d927063e464aff03fba3fa6fc708e038ffb294f1590bccfe4721fa1d6da
SSDEEP 1536:a7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx0gj:TCSjGoLpWM6bblmjx0+
TLSH
T116731865F28DB776D0E299B88E0DF1E5BC287E305E29186FB69E2F0DDA770C2450C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a7886.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a7886.bat
Size 902B
SHA256 4452289f9bf6d183e1d6504d662d5e51c290929b6c8da6952ee5585aa683e323
MD5 90e442f99bdb38c5b6e1c42a923fef98
SHA1 df830b71a22527ac67fb13600df56202a389098b
SHA512 b18cca3b83ea9d448070d14f4e6b8f7798023668f9cacde405947a1618311a601ba7f8953542c0c8613f6ccfc75ed13a5066e82d4c898417b6a44749196fdf0d
TLSH
T18E11E511C9EAE9DA1CA1B0A747166FCDC45B271C7F4A33A1A74CC11E10C181DA9B236B
MD5 SHA1 SHA512 TLSH

Submit Download

2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 270KB
SHA256 854c67dfef3072d6bad0cad9f581874cb1f42bfd9e4efc2c8468021a0bf2f78d
MD5 3c8ba1db1efa94e4316de1e9454e24b3
SHA1 b3f2b3f3f13af969c97af98ae489c198cbf5b9d3
SHA512 9a46ed4d948da1ceb834503c54899a6eb3b091efc16747debfd1060c228be0081290b972e3dee16fdb73f6eb01adcb0cd052ab7a1683b608b55e2b930ed5ba8b
SSDEEP 3072:eRc25w3tkPliErTc5wxoTSXLNoKrtgCIhsPs6ZzAOeqEoqz851YST/n9kd+Y7TJk:SwS/WYoTOLHIsPPzAdnz0YutYPDvhI
TLSH
T183448DA4B3501CF8DC67823ECD654916D6B27C5A0B70C65F13A832665F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 89KB
SHA256 fab7c8b424814eb005cccbacdc95a4b52371e9bf9e0a1394324abbf3a7610a35
MD5 e4b7c22454bcb7a45d248ca68ec824f6
SHA1 f1946c564b1f2b25701235756606f660419b5c2f
SHA512 b662ff45276d59aa5cefc9331cd79cd4930d14f09bfd8713d40226e78f1e96fe5ca49f44700150f7dda6290659f1480800cf93f3b14b49127deef54ed2310388
SSDEEP 1536:27qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxtuKM1oHByzLBpnZ4:nCSjGoLpWM6bblmjxVBynHnS
TLSH
T158933A69B28CB372D0E298B88E0CF1D6ED647D301E25085B77BA3F1DDB77581591C28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2172-15-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/2424-768-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/2424-17-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/2424-1259-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/3188-10-0x0000000000400000-0x0000000000425000-memory.dmp

Download