76adb3f1b7b71bdbbbc746103bc5b7357c58c2973c66097eff4380a1b9186acb

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 359KB
Sample260903-xecbrsdr6w
SHA256 76adb3f1b7b71bdbbbc746103bc5b7357c58c2973c66097eff4380a1b9186acb
MD5 f42f5bc2367e4d755b210dccc62e90c0
SHA1 ff642bea7885de6835abd25c92fcf3b11c631fe3
SHA512 d77570babc014221590be9c32f7c6cc5c82c98d8dcee559064c5b73dc7c935af335f780624437cd15ffb5d9389bd424062f0ee0b0e1eae47a19f565725708f99
SSDEEP 6144:9XmRmTAHdwS/WYoTOLHIsPPzAdnz0YutYPDvhI:c4Cd9/WYoaLHF3z0z04PDvhI
TLSH
T1B0748C94B29C3BF4D8E385398D1DB556EEB27C250B20C65F23A8371A5F332911C2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 2 IoCs

pid	Process
2784	Logo1_.exe
2648	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXD21D.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXD61B.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXC626.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCXD3C7.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCXC823.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXC853.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\RCXC327.tmp	Logo1_.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Logo1_.exe	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4768	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe
2784	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 5748	4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	88
PID 5748 wrote to memory of 848	5748	net.exe	90
PID 4060 wrote to memory of 4768	4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	92
PID 4060 wrote to memory of 2784	4060	2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 2784 wrote to memory of 3488	2784	Logo1_.exe	95
PID 3488 wrote to memory of 252	3488	net.exe	97
PID 2784 wrote to memory of 1104	2784	Logo1_.exe	100
PID 1104 wrote to memory of 3100	1104	net.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35BC.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4768
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:252
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3100

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXCDEB.tmp

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXCDEB.tmp
Size 139KB
SHA256 38c834a224852dd2f535ce9e9e98c1efd18172e49a55b61fa48df958ecb1e214
MD5 b175db9dffbbe875dff1043e1e304f3a
SHA1 357d8a389418bd58d93358dd5ab8e9da0773ae66
SHA512 2822b7cd932722010efe4f6818ba0f4e31d788a32a4a4b25cc859048186b8b0da2cc70c42699f9eeb5d5e3bec5f8bef0636871dd8ba8473f14fc1235085fac1e
SSDEEP 1536:37qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxKT:GCSjGoLpWM6bblmjxc
TLSH
T1C9D35E6DB14FB3F2C3E199BC8D1CF295ED28FE20DE19285A75993B0ED67A0C34508195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD0EB.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXD0EB.tmp
Size 77KB
SHA256 4d11579b86095fdd4e82e0ef5b3479375fb6c222b7023ef538ae6946691ef794
MD5 cdbddb93c463815ad1632128fb25e460
SHA1 93a73809ee3e24830ddd0b87605a41f077d12429
SHA512 115bf15672dcb25b50c49d0c04d038a5e3eb4152d437d227c8aae91020dd3151c635ba8367045f5a6190c0d788ddb8ecce1991df900e7bb05609b2c9c9f65216
SSDEEP 1536:e7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxMj:PCSjGoLpWM6bblmjxS
TLSH
T17F73F755B18DB372D0E299BC8E0FF2E5BD293E201E1D589FB69E2F0DDA7A0C1550C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD458.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXD458.tmp
Size 3.5MB
SHA256 ed0fc05bdc27a05a80347b80211455507b9c307dd74bd099672a44d59a386abe
MD5 f9103ca2c75cd44e2c91782d70d6a70b
SHA1 50f4ec15149d92ca9cf246821fb01c414fa8ac7c
SHA512 c4145976bac33e88e0ee6184195c483c5fb06320f330719422aaa512a54fe605e5427eb3161881952cea9d631de544b1f6da9ec71333a589bba620acad9b2cd6
SSDEEP 49152:JuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrZ:zo/Yhy8OnZy
TLSH
T11CF53903A29D22D4D099D074CF4EA222EF627C8907F562EF3690B6D52A77ED47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD536.tmp

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXD536.tmp
Size 73KB
SHA256 92d2ff2b48b11b1088f985cf54114067fa09a32a327ed648c6044087f47c5d37
MD5 8b6e99a3a1d9d86f25a14e59db50e5aa
SHA1 72452d4b26b85f4a076c50aed2c40c88b701786c
SHA512 fbafed0e10facb6276f81fc26d1a08c27188a0acf55fcd33f92da09da8661ab099d798bdaaf01ca5f75d12b14866d56b1d31b3239d82399f59d33ee3b63a4441
SSDEEP 1536:K7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxyz:jCSjGoLpWM6bblmjxk
TLSH
T1C0732A65B28DB372D0F299B89E0DF1E5BC287E301E29185FB69E1F0DDA7B1C2150C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD22E.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXD22E.tmp
Size 101KB
SHA256 6c1a7ba019e33ed061647851ff9a351c45698767a6e75b4b63dd03cce126abcf
MD5 e2cbe2322a41ff1de4b8454004610690
SHA1 645aff59a8a72afd039b12d82a7db22d19c2e250
SHA512 d5e28059e2971b34d4ca69f65fba85015e66754539824003878c4f05d87a9485188107d58e1e81b8c76a611ad3a4da849fbb1e811628bf1acf3560b77594d20b
SSDEEP 1536:+7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxk4GZjzQwK5WW7VCn6KypA:vCSjGoLpWM6bblmjxCe5BV0v
TLSH
T166A37C65B68CF377C0E299B84E0CF2E5BD697E301E29085FB59A2F0DCA7B5C2550C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD6BD.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXD6BD.tmp
Size 82KB
SHA256 7a263b752bfc2a1f07b3b1d221993f805cb3ada7a457e251a3e621154711c630
MD5 ca8b520efe0ca90876bd91f0ec01eb0c
SHA1 bc391098ef4035cedbd7bac25523a305a1f5ad18
SHA512 6173cffa66e8f584bbfe71ca6d55031de95507ed35f48d6d3f4a18239a3d82fb5d76b188dfce11ff5a38b308ddc0a7bfabe56ec0315132481611d75c354fceb6
SSDEEP 1536:K7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx6qkSZZZ3PD:jCSjGoLpWM6bblmjxkUr
TLSH
T10F832955B68CB3B2D0F189B89E0CF3E5BD257E301E59185BB2AE3F0E9A770C2150C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC338.tmp

Path C:\Program Files\7-Zip\RCXC338.tmp
Size 74KB
SHA256 c71c87b083db4f1311c16b83851721ab3182285fee3915c0bbe0a31cbc8921d2
MD5 65e79776d4072c39da86c4ac758f9796
SHA1 23a79b0318668799e474934d5f5423c71fc5bf17
SHA512 d469e0129e75a4ba6bb1643eebb98aec95ae21ddedbc97331348c7daaa1dc75f50fc7e74828f3b532a2314a343401c92fc6a9b17b09d1d8b11e329921ea6dae5
SSDEEP 1536:m7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxE7:3CSjGoLpWM6bblmjxi
TLSH
T19B730865B28DF376D0F299B89E0CF1E5BC287E301E29185FB69E2F0DDA7A1C2150C195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC874.tmp

Path C:\Program Files\Mozilla Firefox\RCXC874.tmp
Size 74KB
SHA256 e901cb9f1beccb2d3f0260b723afc01ea59322cafb8ff97a2fda969743f460dd
MD5 fb99c034ede6c83e9f038c313bcf786b
SHA1 8415ae9e81a5be5bc64f51aeb04e0d3d5c4dc8ae
SHA512 0ee5df931f14a72d17b1bde909b5c10077c3ab1d3ef3e828028c90304ffab77915d37d42142d996522c03bf8d63b29bb1fb190bcfe4ec08377590041880ddea7
SSDEEP 1536:i7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx8r:bCSjGoLpWM6bblmjxq
TLSH
T18F732A65B28CB376C0F2A9B89E0DF1E5BC247E301E29185BB5EE1F0DDA7B1C2560C195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXDAF4.tmp

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCXDAF4.tmp
Size 528KB
SHA256 26daec3a67820c970d2e585c15e76a22e25478042f012ff7533a6a60fcc41c35
MD5 b9f420833ff50ecd8cc0bb6cdf8a1446
SHA1 f03c635851415aa474cf5019c86798efe6ecb28c
SHA512 77576741768c76f1b2f44a62fd89099c10ac2e35b10da6eb5570137f126a1831674efe07cefdd80fae95952fc0083241c8ddeeacbf6f42f0719e697d6202311a
SSDEEP 6144:ZXmRm078n5Qw0tneDA/sqhleIc0HftDrkYY1hj63hgDonsogCh6NEpAFM:gr85bM3npxYfj63hgD1ZiL
TLSH
T185B4C40277EDB335F2F31B31AE7DB2515E7ABC619D35860E23841A0D49B0980EA75B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXDB72.tmp

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXDB72.tmp
Size 75KB
SHA256 8eeb70fe8c874c2308527a81c739c1beaa557e3330fc7003b4593b76b29a9b6a
MD5 296352564bfb03de11db4cbbb5fb5317
SHA1 d7fc8c5e3ed0a3f2414a0a0a886dd16b2828b9b8
SHA512 7ab746e8c37c3c344c4e2ed87f70a851bc2ce0f90987f056b21989be5f8466a770696d927063e464aff03fba3fa6fc708e038ffb294f1590bccfe4721fa1d6da
SSDEEP 1536:a7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx0gj:TCSjGoLpWM6bblmjx0+
TLSH
T116731865F28DB776D0E299B88E0DF1E5BC287E305E29186FB69E2F0DDA770C2450C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a35BC.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a35BC.bat
Size 902B
SHA256 aaecff16f6130e6309ca7256b82c8385a95f51bb3a58b4eaf80ca5b669527ed3
MD5 a1e4bb7c66510eb2991604d7eb8e562d
SHA1 dd1e3922e899ccebcead7feda56ef3a5d3f4a805
SHA512 61fc63f4d171c10f64a992575d00078d572c7508e270b9d88a9ab22e79d56d3867fe3e2fc96400ed6a19d9b6fb7a667e8ed4f9b6c2a7b111ee83d25f07afd208
TLSH
T1B211E511C9EAE9DA1CA1B0A747166FCDC45B2B1C7F4A33A1A74C811E14C181DA9B236B
MD5 SHA1 SHA512 TLSH

Submit Download

2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-03_f42f5bc2367e4d755b210dccc62e90c0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 270KB
SHA256 854c67dfef3072d6bad0cad9f581874cb1f42bfd9e4efc2c8468021a0bf2f78d
MD5 3c8ba1db1efa94e4316de1e9454e24b3
SHA1 b3f2b3f3f13af969c97af98ae489c198cbf5b9d3
SHA512 9a46ed4d948da1ceb834503c54899a6eb3b091efc16747debfd1060c228be0081290b972e3dee16fdb73f6eb01adcb0cd052ab7a1683b608b55e2b930ed5ba8b
SSDEEP 3072:eRc25w3tkPliErTc5wxoTSXLNoKrtgCIhsPs6ZzAOeqEoqz851YST/n9kd+Y7TJk:SwS/WYoTOLHIsPPzAdnz0YutYPDvhI
TLSH
T183448DA4B3501CF8DC67823ECD654916D6B27C5A0B70C65F13A832665F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 89KB
SHA256 fab7c8b424814eb005cccbacdc95a4b52371e9bf9e0a1394324abbf3a7610a35
MD5 e4b7c22454bcb7a45d248ca68ec824f6
SHA1 f1946c564b1f2b25701235756606f660419b5c2f
SHA512 b662ff45276d59aa5cefc9331cd79cd4930d14f09bfd8713d40226e78f1e96fe5ca49f44700150f7dda6290659f1480800cf93f3b14b49127deef54ed2310388
SSDEEP 1536:27qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxtuKM1oHByzLBpnZ4:nCSjGoLpWM6bblmjxVBynHnS
TLSH
T158933A69B28CB372D0E298B88E0CF1D6ED647D301E25085B77BA3F1DDB77581591C28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2648-17-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/2784-19-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/2784-968-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/2784-1261-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4060-10-0x0000000000400000-0x0000000000425000-memory.dmp

Download