182a90fbdf4ce8272a75f13c619f692cf998400d4d4293d640908cc07ea7ef6a

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
Size 6.9MB
Sample260907-e61vbsw1a1
SHA256 182a90fbdf4ce8272a75f13c619f692cf998400d4d4293d640908cc07ea7ef6a
MD5 4057ad5cf38310b185a71258c9d91f0c
SHA1 19be6e1d4239d4dab3098356b525dd0aac07bb6a
SHA512 b45cf8ad1358b0cbdaa36fa84a9aa9cf53cc45123c1acd30e2c29b2cd46fa3ad3c64cfef74417f0d83c0e70fe1dca8b29d00c1b052721f6d78108cd230673389
SSDEEP 49152:PabH/4Yfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6OZ:mCuCjCuCc0oAaldmdmnpJ6dr
TLSH
T151762852A10045BAF404DD36CA16B329A6207C498BF299DFE2487ADD7FB66F03F35364
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~1.Doc	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
4468	UpdatAuto.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\dayget.dat	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\BlockMerge.tmp	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4356	sc.exe
1184	sc.exe
4884	sc.exe
3548	sc.exe
2372	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4164	cmd.exe
3620	cmd.exe
3684	cmd.exe
3312	cmd.exe
2468	cmd.exe
4716	cmd.exe
1852	cmd.exe
5552	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1816	WINWORD.EXE
1816	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1700	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
4468	UpdatAuto.exe
1816	WINWORD.EXE
1816	WINWORD.EXE
1816	WINWORD.EXE
1816	WINWORD.EXE
1816	WINWORD.EXE
1816	WINWORD.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1852	1700	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	89
PID 1700 wrote to memory of 4468	1700	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	91
PID 4468 wrote to memory of 5552	4468	UpdatAuto.exe	92
PID 1700 wrote to memory of 1816	1700	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	94
PID 1700 wrote to memory of 264	1700	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	95
PID 1700 wrote to memory of 4164	1700	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	96
PID 1700 wrote to memory of 3620	1700	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	97
PID 1700 wrote to memory of 4716	1700	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	98
PID 1700 wrote to memory of 2468	1700	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	99
PID 1700 wrote to memory of 3312	1700	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	100
PID 1700 wrote to memory of 3684	1700	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	101
PID 1700 wrote to memory of 2372	1700	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	106
PID 1700 wrote to memory of 3548	1700	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	107
PID 1700 wrote to memory of 4884	1700	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	110
PID 1700 wrote to memory of 1184	1700	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	111
PID 1700 wrote to memory of 4356	1700	2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	112
PID 4716 wrote to memory of 472	4716	cmd.exe	119
PID 3620 wrote to memory of 812	3620	cmd.exe	120
PID 4164 wrote to memory of 3004	4164	cmd.exe	121
PID 472 wrote to memory of 2356	472	net.exe	122
PID 2468 wrote to memory of 3948	2468	cmd.exe	123
PID 812 wrote to memory of 4900	812	net.exe	124
PID 264 wrote to memory of 4072	264	cmd.exe	125
PID 3312 wrote to memory of 424	3312	cmd.exe	126
PID 3684 wrote to memory of 2492	3684	cmd.exe	127
PID 3948 wrote to memory of 6112	3948	net.exe	128
PID 3004 wrote to memory of 3584	3004	net.exe	129
PID 4072 wrote to memory of 2984	4072	net.exe	130
PID 424 wrote to memory of 1744	424	net.exe	131
PID 2492 wrote to memory of 2368	2492	net.exe	132

C:\Users\Admin\AppData\Local\Temp\2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1852
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5552
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\system32\drivers\2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~1.Doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4072
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:2984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:3584
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:812
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:472
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:2356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:6112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:424
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:1744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:2368
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2372
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3548
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4884
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1184
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 7.4MB
SHA256 c7cf8cb5199b0d31e35aa573641e59914830d641d481fca1d2cdc781d1320d01
MD5 644d6361237f861f705813bb0f642233
SHA1 e79da27db37a6b68d56dcf84a284f3aaefa76552
SHA512 eeab22eaf4f2658c597912244e546a14b4e474a46210f681d2d97cdd2977c715523815edcf8e3a2e521c8791d584ca7b18035193ec517d6bd1bb8aefce4e5e18
SSDEEP 49152:PabH/sYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6O4:aCuCjCuCc0oAaldmdmnpJ6dTjo
TLSH
T145763A52A10045B9F405DD36CA56B329AA203C498BF299DFA2487BDD7FB66F03F35360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 7.9MB
SHA256 c2f20d94c00ea1874434865f2183afc37c36087730a343c06c21d6ddb713915b
MD5 ec661b0a94b24770b60de0f3acdbffc6
SHA1 5a7f65cb3b22f6e8a8d3f5909c59380fd0b080c5
SHA512 8d4eef3a252b0c8eec3cdd9a37e3ade6e6cbf2aba2be54cff6c95f002a5fbfa34682ff15eaf9576dc59921fb05d375e40c81d74cf877059c859f8e37811960b9
SSDEEP 98304:aCuCjCuCc0oAaldmdmnpJ6d8ezSC6v2XMH:frWrZKmd0I
TLSH
T1CB864A12A11045BAF415DD36CA56B329BA203C494BF299DFA2487BDC3EB66F03F35364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 7.6MB
SHA256 17e1f8d46d01ec068da0061f746e47341e65c045187be1f0165c1986774cf36f
MD5 778971cc84da2d5bc4f55c5f84a5a4dd
SHA1 54df7f32bd8cce66fe00c13aff5ec6f845968694
SHA512 c0870402235a612b85bf4cae2ab1cb2f88f375d6dc586e8820541966ece1175cd518ed41870f27b63f550a291f22a8f7ffa3372f9af98fd8894e0764673963b1
SSDEEP 49152:PabH/xYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6Ov:dCuCjCuCc0oAaldmdmnpJ6do/h1+
TLSH
T1A9864A12A10045B9F415DD36CA56B329AA203C498BF299DFA2487BDD7FB66F03F35360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 6.9MB
SHA256 f000bb9c8da36481d41288d39429ba8aa02f619b648c3d0ae4f72cf9635a4ac5
MD5 a1210b0f1e88c314495351fed872cad5
SHA1 afda15fb49fa289d829fa52762b85ff587956242
SHA512 b121fc2b9c9fbfff55d0a119a72115e636e0158893ea3e18df60234d11dc6959e060c8840805ecf221e54163573eebf28fce7581c841538468bb682f7998edd7
SSDEEP 49152:PabH/nYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6Op:HCuCjCuCc0oAaldmdmnpJ6d
TLSH
T1F3762852A10045BAF404DD36CA16B329A6207C498BF299DFE2487ADD7FB66F03F35364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 13.0MB
SHA256 e0814a7b8b6928e9a48f718bfc94e03b98d9fb952390e62c490f2cfdacf6569d
MD5 b74330d3db278ad79b62903e71968b14
SHA1 5fc60475ba8a1b34f092831959ae311cbced48f7
SHA512 190b3df9de8edbb2116e90a065adc4fda5fad87b34be6bdb2ae4de4cc8c892463cbfae5c6f878974f4e627e7b5b0f20af4f6005cb2afa5f213274316f6e251dc
SSDEEP 98304:zCuCjCuCc0oAaldmdmnpJ6dFQRQyi36YOcP+Lvw2gAf+PN34:mrWrZKmd0RQyiKaUX+PNo
TLSH
T176D66D13B25101B9F459DD75CB2A7325A6207C498BF195DF62883BE92E72AF03F38760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 8.6MB
SHA256 95b78594c99ceb889b9699fd7190eef4befa17c0dd63b28e1de530b0152db08b
MD5 965d712338fb5e95089c2ac725467f26
SHA1 e09265216f790d8f131c46f124ae5fcb42971c86
SHA512 251b45a1b058416f2a511033b788b68cbe8b5240c65a21a015146ffc3c217b9b501374c641a83e4696cc231879dbe1778f01ee6239172b0aebd97adb656837d3
SSDEEP 49152:PabH/TYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6OK:zCuCjCuCc0oAaldmdmnpJ6dsthHRc/Q
TLSH
T1D9964A23B15104B9F408DD36CB16B329A6603C598BF299DF92487AD92FB26F03F39355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 10.4MB
SHA256 3143b95fb0734bc5bd511ac7205986fc1abf6502a5eda2a1a98e056b936e5d34
MD5 4d505308817d21258810348dc80fb178
SHA1 084bc1fce615f1c4ab2b6a7046d3cabe582c936b
SHA512 d67c84dc82c0f4eb3d5b2cd2961032c9e13bbfbbc41b4bc91752a3f389b8439b51f5955913dfb277ea371473e942364286fad12ed37f2596290e2a3bd20d035f
SSDEEP 98304:zCuCjCuCc0oAaldmdmnpJ6dTy5112gYy5azzVvf69nLKnhZO:mrWrZKmd0FLIHuWhs
TLSH
T177B64A13B14005B9F408D976CB56B325AA207C494BB2A9DF96487BD93FB6AF03F39350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 9.2MB
SHA256 9917d880edb24d3ffcd7492683b50761403e3875d33e57d9f375f3d0eaecf48c
MD5 852e1856ae59aa019d0d38179079a21d
SHA1 163fcdd950f7edf244b762f8aa783a4117c65e59
SHA512 98f8250ba0490ecc9051564e60cc03f56fe1887a6d927f4205b09fcd583a6a6931f51e181ff01455200da0a45da47e1d2ab765448dd26fe4dfe156a65f67f767
SSDEEP 98304:zCuCjCuCc0oAaldmdmnpJ6dtu6Jm0xd2d3:mrWrZKmd0t6Jm0G
TLSH
T185A64A13A10145B9F405DD36CB56B329AA207C494BF2A9DFA2487AD93FB66F03F39350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 8.5MB
SHA256 0cb550e4a062519ae4343a302202c463c4c0dc1728637064ab753595902263cd
MD5 1d6db868303a8a1420efde4a087f0d29
SHA1 788a5a82fbdb3c110371c5b3ea39b3e8ef8121c1
SHA512 32f88d8e15d50bffa471d08ec59fb0d082f5604320147f7d396e4471cb49d338cfb2eeb8689339e0f95adfd0e167261d10237183d36fafb597408856ef61ed61
SSDEEP 49152:PabH/TYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6ON:zCuCjCuCc0oAaldmdmnpJ6dTmifP5R7
TLSH
T1F7963A53A10045B9F405DD36CA56B329AA207C494BF299DFA2487ADD3FB66F03F39360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 8.8MB
SHA256 d16ba9ab51fff9aee9ab327ea0c6e0fcb54ddaf698dfc8872b28433210dee46d
MD5 e78f6ff2e3522c1d83d92321bf2cc52e
SHA1 1ff14d2242c1490aaf465979bdc8f87a42a186ce
SHA512 8d4bd4c83850cb2591a3eb6c8b47b3e41249c2c62cde6c47575b389b3a25f9d3995874913c85b7e458b7ec46dffdb2ec6cd97520ead2facc3360421b9c269a86
SSDEEP 49152:PabH/TYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6ON:zCuCjCuCc0oAaldmdmnpJ6dQ5dKCi616
TLSH
T172964B13A10045B9F415DD36CA56B329AA207C494BF299DFA2487ADD3FB66F03F39360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 10.0MB
SHA256 df09d4ab71369e914a220b4b72b0ecb63c7bb7cffb24f0a45c0668b61a9e14ec
MD5 f73b3a3173384c7b7187ed22ee6193b2
SHA1 abaf2d7505fe5527a949b2e7eaeb455f3348ee7a
SHA512 8aa08531c678e2b471c1f7cf5489eea5413d22a4210e1d0afefedbee96bc9321021b639a5460bb8845bcd4e2cf35da16bd03033a59a6994889867609c859edb4
SSDEEP 98304:zCuCjCuCc0oAaldmdmnpJ6dym7vj1BDlZG:mrWrZKmd0WjnDO
TLSH
T1F5B65B13A10145B9F405DD36C756B329AA207C494BB2A9DFA2887BD93FB66F03F39350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 6.9MB
SHA256 f1c4696ec702fb71ae6562a2d4c4118769f046f173757080022665912b40db67
MD5 20c9227f1f0e6606b25be34c8181de78
SHA1 44a1d0fa04ab633b1e5d087f46a776dcf9692e6a
SHA512 d86a757339a60e6e47f6f00534e639f303c1e30c49b81c6b3b63074c1e1f80ac69a181fce0a598f1198170f80537367f1061e75c1e6de5afa0bb04dca6f7a68f
SSDEEP 49152:PabH/PYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6Om:fCuCjCuCc0oAaldmdmnpJ6dg
TLSH
T13D762852A10045BAF404DD36CA16B329A6203C498BF299DFE2487ADD7FB66F03F75364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 6.9MB
SHA256 d5f14c8dd39468457b7614f5aee2b0e9b5f07ae839d51c0f635f71bf350a7ef4
MD5 1f07848d627f7c6ecda35f38c8005566
SHA1 93d77eebe98e6e8cf72ac7f4f4ac9d894f440602
SHA512 9ccdf002118b0d8c999674c1408655611cf6bbaeddb784fd7ba65d7abbb4aa5f8a9171ba109b2bdfc9abac241e3f6aa66be98d8b70d6cb14cb55672981ce0a66
SSDEEP 49152:PabH/PYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6Oi:fCuCjCuCc0oAaldmdmnpJ6dI
TLSH
T170762852A10045BAF404DD36CA16B329A6207C498BF299DFE2487ADD7FB66F03F35364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 6.9MB
SHA256 2fe95156b1cebe0a4ef39f69a70b9474a48da2f0386d15145e1f20f3f3458793
MD5 c1f0b44f85d92e6a9fbe6896558cead0
SHA1 be7d0490164051882cae93d0ff7304863790af06
SHA512 37f5e683189b4889c79263c1235a196b014ec95b02cf851ba5ee32b3acb0cdc0529c2754cc9bc7dc7c1d8a641534c5b90f18946ab43f66fbb6964255b2ffd6eb
SSDEEP 49152:PabH/PYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6Ot:fCuCjCuCc0oAaldmdmnpJ6dD
TLSH
T1BE762852A10045BAF404DD36CA16B329A6203C498BF299DFE2487ADD7FB66F03F75364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 7.0MB
SHA256 a9d672091ff67d97131732bce81a095df756edbfa8f867f7ebfb9ac7a1e059b3
MD5 20d6fc983b3871987540b1aef512a5c0
SHA1 926a6d4f80fc24ec35874943c12e91f93c7a57ac
SHA512 3133d35eb13e2cc2d4639c1c4a7ac89e01b74ee17fe45a023e602e100c964814b331dc61699141367c772c8216472618496505ee9f76ea2ccf794602d7c1f9e2
SSDEEP 49152:PabH/fYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6OI:vCuCjCuCc0oAaldmdmnpJ6dK
TLSH
T12D762852A10045BAF404DD36CA16B329A6207C498BF299DFE2487ADD7FB66F03F35364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 6.9MB
SHA256 92ebf28613cb002191e235ba38ca9635f9f6cab3755ee0358e6b091083ae27db
MD5 ce0e7048ba6f38cba14095a7a3203940
SHA1 527bdade136c8a2360490900ece81e198396834f
SHA512 77480b710d3a2247765450efbea2d48de4381721f3570c2fbf91d795592d07c04638ec0b5e503474fc9683e2dfdc8bd1a53d66b861e59d810ad84215c4dcab18
SSDEEP 49152:PabH/PYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6OF:fCuCjCuCc0oAaldmdmnpJ6dn
TLSH
T1B1762852A10045BAF404DD36CA16B329A6207C498BF299DFE2487ADD7FB66F03F35364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 6.9MB
SHA256 36bc2826e9f029237b9f2f949763c3d749fd5128016bd050ccd5b041796721c1
MD5 9c9143d9069301cc501691152eadeab0
SHA1 c886c1019dffd16d51dbddc182b3a683dffa9d6d
SHA512 bb8b72427cca8cca1c88cbd28e25d97f49a7994657ae6bb5ca5f54eb5004f46d05f297408d64ceeeb939504712612b0abda9e382ba559afdcafd32e7fef9e991
SSDEEP 49152:PabH/PYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6Oa:fCuCjCuCc0oAaldmdmnpJ6d4
TLSH
T1F6762852A10045BAF404DD36CA16B329A6207C498BF299DFE2487ADD7FB66F03F35364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 6.9MB
SHA256 43796f076e956d68874d7e0848ed7afeaa1c50cfa98fa4d618f7f51badeeeb59
MD5 deb55b44d33b74917d9f678b96b32c75
SHA1 0c1ec950f0cdff7e6957eb906eb415858effe298
SHA512 6c41d1351f6c9521d77492f706640f8f1d3c467cd41554ce524495608f41b413a29cdf259fdc30cfe5835ceea62572e9ad724bcc17a04d27eb33bbdca86d370f
SSDEEP 49152:PabH/PYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6O1:fCuCjCuCc0oAaldmdmnpJ6db
TLSH
T1A4762852A10045BAF404DD36CA16B329A6207C498BF299DFE2487ADD7FB66F03F35364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 7.1MB
SHA256 6a8059e745b880f2e404742598127ee7bab9fcd10f91451e05f4df78a98eb56c
MD5 6988f8824b87bc5ee48958b11341b338
SHA1 3ad76d8bec6e373f5a3470c5d84e914cc0a30b59
SHA512 18c29aed6ee749fac798f446f46b198053f39c204e8929154395815beac4adb161bd44d8aac18736fdef8c030a06d688403d240c5a216fe194bc22deaca015b7
SSDEEP 49152:PabH/LYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6O6:7CuCjCuCc0oAaldmdmnpJ6dc
TLSH
T12A761852A10045B9F408DD36CB16B329B6203C494BF299DFA2887AED7BB66F03F75351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 7.0MB
SHA256 06403a219dfa8b3728469db796b9831435e25dbebadba465770fc092b5c582c0
MD5 5946de221c4a79745d161b4d27a6b990
SHA1 f8e6f6b0bfd9b53a62e724da90a346d859e03310
SHA512 b31f6143895cde0a19bd392916d335925393a4063992073610b746905c44afae4de62d6820e155260289dc4cf2dabe9b55bad43266942b63418196ab8704aeef
SSDEEP 49152:PabH/PYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6OE:fCuCjCuCc0oAaldmdmnpJ6doj
TLSH
T19E762952A10045BAF404DD36CA16B329A6207C498BF299DFE2487ADD7FB66F03F35364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 7.0MB
SHA256 a95b56afda7436b84ac4e47e25b7d3de6479a8b3cfbd04aa2b2d34c97bd5e0dc
MD5 5f1d62e8eecbb9d9226383c5be8062ae
SHA1 50e1a406f12a7a95fa3c8f8524980f227aa57071
SHA512 f94a2c332411bf09870da0a99848f5fedd1341359f1f25e26ba6c8b2f7613a2d1b6c6c45914510d238a16d73d405d6765a0e76f85602f5d669eba43129a2dcb4
SSDEEP 49152:PabH/TYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6OO:zCuCjCuCc0oAaldmdmnpJ6dKD
TLSH
T1D4762952A10045BAF404DD36CA16B329A6207C498BF299DFE2487ADD7FB66F03F35364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gb.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD1083.tmp\gb.xsl
Size 262KB
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
TLSH
T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~1.Doc

Path C:\Windows\SysWOW64\Drivers\2026-09-06_4057ad5cf38310b185a71258c9d91f0c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~1.Doc
Size 4KB
SHA256 b00aeb2fbd479d76ec5ff079f637bb694d7c986050d97d3cc6f4b093107c4a70
MD5 4fcc5f3e0e279d4bebb26ab4faaba2ac
SHA1 244583d5125d0fc53f73bac578c34fdfd9513d47
SHA512 278cf1e8bde15b843b07444e691e45572306b5b7ea3c3510a4d0a54ff1a92cc3bdc3d35ac89f364248d9778d4162dc2d5165e1c4461bb1c07bbf02c091e13c71
SSDEEP 96:Vo6Yo6Yo6Yo6Yo6Yo6Yo6Yo6Yo6Yo6Yo6Yo6Yo6Yo6Yo6Yo6Yo6Yo6Yo6Yo6Yo6p:26B6B6B6B6B6B6B6B6B6B6B6B6B6B6B7
TLSH
T19A9192390AC4956B869902880C69E61A67AB6220F8398A552EA409A67890225292E622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 6.9MB
SHA256 a77dec7f9a5ec2f25a695dd1612ebdb0147bac7d1e91d48d7ed47cb9b1d06f57
MD5 bb09682f0f01d978938bd8df490a513c
SHA1 18937438a586c07120bb6009b7d9716576bfaced
SHA512 0c03af91a8253211e9872c737082232491181277fb392941fe1ae9cd1120ad1e50a9a678c309efe250a7da969189859f0202ed03d7d806faf1f6143e6d89b33f
SSDEEP 49152:PabH/4Yfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6OQ:mCuCjCuCc0oAaldmdmnpJ6du
TLSH
T14E762852A10045BAF404DD36CA16B329A6203C498BF299DFE2487ADD7FB66F03F75364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.9MB
SHA256 c71cbf366fa6b962d6dc2554fdf3e23769a1e4a018e2ad5cecc082e3d40b3cdc
MD5 d01706f99437dd58bde9989b6abe68ac
SHA1 4279fbfa0c90dc5809aa92fc255137f64ab28afb
SHA512 e0670941110a29acd3ec0f967f4e35ff868775dfe327e861620ab29f2de3e49ae530f7d6250ba0e982315c6a6c157d7279f0eac7363a9691b34fb47f70c8964d
SSDEEP 49152:PabH/TYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6OQ:zCuCjCuCc0oAaldmdmnpJ6du
TLSH
T1C7762852A10045BAF404DD36CA16B329A6207C498BF299DFE2487ADD7FB66F03F35364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.9MB
SHA256 3234018bba2c040494f62348f82dd68c36d6cfe9ab5345fa4b5d5525a94debbf
MD5 bf721157ac1b2837b04b56ed2a1d2165
SHA1 4ef2620867de8f892234c076f01695bf0223a9dc
SHA512 42cd6e64092f857d126ad0c41f26fa333c5f940f0e9fc0d268e1420c9fe30b8529f8c44e1705d58abbf6c731d3438dbc1ceade6952d20961a301d271fd61b5bd
SSDEEP 49152:PabH/TYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6OQ:zCuCjCuCc0oAaldmdmnpJ6du
TLSH
T123762852A10045BAF404DD36CA16B329A6207C498BF299DFE2487ADD7FB66F03F35364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.9MB
SHA256 33754943d598e5ce549353b0824393715cc9b99a6a678b89af34995813fd4414
MD5 f15759618bdb0db972422af1083de1d5
SHA1 ac0ecb2a7e4db55874a9c70ce73fa6ae3d2860b9
SHA512 c7a3f9b8f611f7e34ae19ca0c367cac675d4ca3bb136276021f1d84c5b78518698d5d2953bfc23f931fffd3c91fed6814e84dd3526041a8f68922ed1f1772cd9
SSDEEP 49152:PabH/fYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6OQ:vCuCjCuCc0oAaldmdmnpJ6du
TLSH
T12C762852A10045BAF404DD36CA16B329A6207C498BF299DFE2487ADD7FB66F03F35364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.9MB
SHA256 efbff9d9b639a3a6a2e1cc508b38897beb000c6d4d45077ed8ba4215be9eb4b8
MD5 9a011f3b1512cbc8ea740b8bf5bae5cb
SHA1 165220b66ea450f27824c3937d74ea2ed3169bb6
SHA512 29c48ad4cffd92cd99ef4cb764b956d4159ee5bfe6a400f219fbea635a21587ee49e9c895a41c0cfe7605a1d21f1b8f94687dddd8564bdca5840b934e5914b98
SSDEEP 49152:PabH/sYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6OQ:aCuCjCuCc0oAaldmdmnpJ6du
TLSH
T1F2762852A10045BAF404DD36CA16B329A6203C498BF299DFE2487ADD7FB66F03F75364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.9MB
SHA256 e15b93ca5db303ca215ea4424146319f663300b3f6f192ec2e7b9957f16904bf
MD5 0d3c345b1babc8d56000f31378e79cf9
SHA1 2e04f91802590203f2413c4793562a296d02e4bf
SHA512 ea6e6502d8cfeebd9e437816737ab4c161421cf800cf2c285bce090193f598bd2b49525a9d1360eb727a51be967a0d53f2cf32e6fd76c1769496676c2c9536b1
SSDEEP 49152:PabH/xYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6OQ:dCuCjCuCc0oAaldmdmnpJ6du
TLSH
T135762852A10045BAF404DD36CA16B329A6203C498BF299DFE2487ADD7FB66F03F75364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.9MB
SHA256 66319299026649c3b17b701a9b6388408f4ecef0d9a49f6f8f85f0d65c0cb49d
MD5 078d462ccaa9ce8fb01e30c987d41abb
SHA1 88450716f1837712dd16da61c28a684a16d8a0b1
SHA512 281df4df8753f9e3f9898845f2f44643fd124e6b9012192e195b8cf88dacebd6fb1f2900149eefefe12e65dd3d8539f73e16e7f2f767e979249bcb571213a240
SSDEEP 49152:PabH/nYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6OQ:HCuCjCuCc0oAaldmdmnpJ6du
TLSH
T1A1762852A10045BAF404DD36CA16B329A6207C498BF299DFE2487ADD7FB66F03F35364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.9MB
SHA256 e4230097e08686f7e0e5ca97aa44b58d921c324b38ff3dd5d18741d0d145ce19
MD5 64d2d128fbcc99067d96df88d49f3065
SHA1 b7b11eb944bf519d49e0c42bfead3431bd10d794
SHA512 ee8280e1e862a80608c8ec299e277d8d9949ef1e8de63594124a820bb787b2825538d409272c47cde08a8c0f3ce740780c86177f55ed04e8f8f011705ae499d8
SSDEEP 49152:PabH/LYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6OQ:7CuCjCuCc0oAaldmdmnpJ6du
TLSH
T1BF762852A10045BAF404DD36CA16B329A6207C498BF299DFE2487ADD7FB66F03F35364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.9MB
SHA256 adec821b9cf2a6c7e2e944d11225e68d3da910294d7ff8afb013583ea39dd6b4
MD5 4f6bfa62bd6938a063c7e73e2ddc2700
SHA1 678f42b19ad55cb4931c3d4ee0924064d56e0cd3
SHA512 1794e1cd52a982794dd05ca7554b2eed66940a45cf8df4dac11fc6a02c02e381bf60f247da88a44ac8a33f98bf9145a78f040d5195a1d2b73578578573e9b5ed
SSDEEP 49152:PabH/PYfk5fuvabH/tYfk5fuWabH/rYfk5fuvabH/tYfk5fuu+Cq99LyHHI+t6OQ:fCuCjCuCc0oAaldmdmnpJ6du
TLSH
T1E9762852A10045BAF404DD36CA16B329A6207C498BF299DFE2487ADD7FB66F03F35364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1816-38-0x00007FF8EBC80000-0x00007FF8EBC90000-memory.dmp

Download

memory/1816-35-0x00007FF8EBC80000-0x00007FF8EBC90000-memory.dmp

Download

memory/1816-36-0x00007FF8EBC80000-0x00007FF8EBC90000-memory.dmp

Download

memory/1816-41-0x00007FF8E95B0000-0x00007FF8E95C0000-memory.dmp

Download

memory/1816-40-0x00007FF8E95B0000-0x00007FF8E95C0000-memory.dmp

Download

memory/1816-39-0x00007FF8EBC80000-0x00007FF8EBC90000-memory.dmp

Download

memory/1816-37-0x00007FF8EBC80000-0x00007FF8EBC90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads