55ecc2511721a424cbaa9c08593b3ee8ae2d4039cb980fe397cee8676c894223

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 1.1MB
Sample260922-k9564scf76
SHA256 55ecc2511721a424cbaa9c08593b3ee8ae2d4039cb980fe397cee8676c894223
MD5 ea255de34c18120765f70395510135f7
SHA1 c57f395642f771285a973edf66953df1c97acd35
SHA512 59f00d60f57ba166eeca270f821fcd355715ebe87c5700c280c665ffae2c49616e61bd22d61d90a2b54ddda3b0bfc9f7b642bcbafeeef09cb635072ad0e6ba63
SSDEEP 12288:xHD0L4xHIA4zwVyWFothzczm199zS2gRhVTNl7F62LKhxsDkofWB:x84mwQRthP199MVAPB3
TLSH
T126358D17B69C33E9D0E9C5748A5EB131EE727C520B20A6DF0290B2692E77AE41F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Executes dropped EXE 3 IoCs

pid	Process
2924	Logo1_.exe
2980	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3948	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXBC6E.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXBC2F.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXC68C.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXC467.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	Logo1_.exe
File opened for modification	C:\Program Files\ResizeReceive.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCXC62C.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCXBC8F.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCXC5CB.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCXC4AA.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCXC166.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.Exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe
File created	C:\Windows\uninstall\rundl132.exe	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Logo1_.exe	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4324	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe
2924	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 4120	4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 4120 wrote to memory of 4896	4120	net.exe	91
PID 4604 wrote to memory of 4324	4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	92
PID 4604 wrote to memory of 2924	4604	2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 2924 wrote to memory of 5040	2924	Logo1_.exe	95
PID 5040 wrote to memory of 4800	5040	net.exe	97
PID 2924 wrote to memory of 3260	2924	Logo1_.exe	101
PID 3260 wrote to memory of 240	3260	net.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A71.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4324
- - C:\Users\Admin\AppData\Local\Temp\2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    3⤵
    - Executes dropped EXE
    PID:2980
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4800
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:240

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXC1D5.tmp

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXC1D5.tmp
Size 156KB
SHA256 e7228566da086172862a7593f0e175f2cb41f2a846d06c978cb3ef2438f309d0
MD5 8c59a669f7b660763b4bef226b78d187
SHA1 1327f294bce8a2a5c15ad4aa99b13348c724bd34
SHA512 bc6465e15fb16fffe8a01d38361b65e58243d7f98fad4ebd3e74a05127c1a3220ac8a791978c0f8c1aa729d61ddff56ce3b2f19aeebf25645881d26d3bdc19d0
SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6QNz:hCSjGoLpWM6VsBEjx5ZdhZ
TLSH
T1B2F3B36EB18EB3F6D3E1597C8D1CF295ED28FE20CE19285B75993B0EDA7A0C34508191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC478.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXC478.tmp
Size 94KB
SHA256 d3b6525f1251b7b278514b2289cd49bfc659b064d0c7fce14eb700bba22b2d2e
MD5 f9d08b5533d2c6ebf3c984bb20187f15
SHA1 25200024100a1f8999ef8a251b10da2705db1173
SHA512 584b863bc9517f690e0713cfa6a1c4146f8ee327ffeae49aeb593204a36a45f4add054703b90753a4790f1cc3bea524ca7255482580c2ed5ac52715e566d44a3
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t67ND:gCSjGoLpWM6VsBEjx+Zdmp
TLSH
T11D93295AB28CB376D0F199BC8E0FF2E5BD297E200E1D199B71992F0DDE7A0C1590C285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC69C.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXC69C.tmp
Size 103KB
SHA256 5632b9bbe97f46387c6f6dc7d651315703efb86763428fce07b279f94b0ae6fa
MD5 00f960c255da5f69f4cd0bcc3b8e4635
SHA1 54a2a16c8ee83a968093ce57b1ee26ddc044d203
SHA512 dca56833a3e48ffadfbd19ece0a08bdbfa5fd711305e0b12be3647e6aa941ed24a5c31b8ce8b2ea0a77ee8f966ed155d2d61cbec7223275c41510bfb53234042
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHipNQ:gCSjGoLpWM6VsBEjx7ZdddtPlLqMu
TLSH
T1A6A36B5AB28DB772D0F299B88E0DF2E57D387E200F1A185FB69E1F0D9A775C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC6DE.tmp

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXC6DE.tmp
Size 91KB
SHA256 64a8816b8924c4087765c2f93bbc9cbe15dd181f4bc61c4852d87694dca5a134
MD5 9799a30bb1d7a91c92ec54e6efd403b2
SHA1 b1d4911dffcd2456a6f0bd8cdf8550cd7b74aaea
SHA512 eb5ab9ab5303d7742b3939da288f4367f189c13871bc0c7a2756018a9dceb4adabbd8d282beedd6b4414a26fa32abf656cbc9a6862eda5f2a0192c2391da394b
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6wNT:YCSjGoLpWM6VsBEjxZZdh5
TLSH
T1FD934B5AB28DB776D0F299B88E0DF2E5BD397E300E1A185BB59E1F0DDA770C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC56C.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXC56C.tmp
Size 118KB
SHA256 fde7da24ba1e2a849c83882535e40762635bdaeecef279261ebf477caa874abc
MD5 19bd3b0283abceeec21fe863f7bd7c39
SHA1 2110df0e09f4422f8fd9b4330308041bb1412fa9
SHA512 c04187820d8a0efb4b0f463e02c445c65cac2c7775f8924bfa8213cae00b94afe4e34553c0bd2a350f2bd87302989724a2a885c5a8c5854bb8183d0800f208a3
SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6x4GZjzQwK5WW7VCnr:JCSjGoLpWM6VsBEjxZZdQe5BV0LH
TLSH
T1D7C3AE5AB68CB376C0F299B88E0DF2E57D797E200E19185FB59E2F0DCA7B5C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC7F7.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXC7F7.tmp
Size 100KB
SHA256 a13dd73110347993cffda3a6fd118c4bc11cc0e8d47ea9e9351f49b4b0a0be82
MD5 286ba587eb5d1fe01b00da4f582082b2
SHA1 70b87fa07078e44b8e71e248747e6cb099858665
SHA512 7107c9ac10e8a268a409262a94818080da1017e344f7529c8f496b0f53bc6eb5f216318f543784349effaafce532038f73cf5058265742a7e969c289c320d0ac
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ34Nj:oCSjGoLpWM6VsBEjxQZdJU4J
TLSH
T1D5A35B1AB68CB7B2D0F18AB89D0DF3E5BD397E300E5A185BB29D3B0D9A770C1151C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB7FE.tmp

Path C:\Program Files\7-Zip\RCXB7FE.tmp
Size 91KB
SHA256 9de11587a6d1cebc07296fae7a47575076a24f9cc5f2ca476b731e964d0a7411
MD5 5b747276cbcc764cf170cbb931cce579
SHA1 22bc60daf5f90ec340deafbbb104d584354514c8
SHA512 e4f2efadf14a15f80e561c49db16e0c6c1707509fb5d5f6f5ffeb163ef3dc77113d0e57db2db37074ad784ca72f23321e69ead9cc3e27de41c2cd3b08c2ce4ed
SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6ENb:QCSjGoLpWM6VsBEjxGZdVB
TLSH
T12F934A5AB68DB376D0F199B88E0DF1E5BD387E201E1A185FB5AE2F0DDA770C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXBC6E.tmp

Path C:\Program Files\Mozilla Firefox\RCXBC6E.tmp
Size 91KB
SHA256 bc8325ff28c64e95c0a67cd91ce803cd8e8a3227d3fde0c76479eb5e09617df2
MD5 8e597718c20eeb0a4d7b77e823039039
SHA1 e8477dfdee4d72b698382c5d45d42971cac69e2c
SHA512 9a56d4d85f65d7fa1ab108fb6f1f67d166a66a86d496717cfe568376a09392bd358cffeead2196d756c95d288d564ba8ad65cb988a87b590b713fd94f2b5af78
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6yNL:YCSjGoLpWM6VsBEjxmZdfx
TLSH
T16D935C5AB28CB776D0F199B88D0DF2E5BD397E300E1A185BB59E2F0DDA7B1C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXCD29.tmp

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXCD29.tmp
Size 92KB
SHA256 21c99df972da19f1030c8eb063c5df67a39591e2a691c7705bd6b9399c94cc4f
MD5 dabc0bddaad906b596762aa66f5152dc
SHA1 1b0102d3a1ac8e497472c1064f976a7fecf64b19
SHA512 1e61674c849f67b84d9753d08f6cf88f605327f5f6217b4a84e872f475991bb0124efe8d1eafb3c42a8ae59ce83e758c1b7d932a2be8a7a0a84bd5b4b9bd3655
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CZND:YCSjGoLpWM6VsBEjx+ZdDZp
TLSH
T12C935C6AF29CB776D0F199B88E0DF2E57C297E304E1A185B759E2F0DDA770C1590C182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a2A71.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a2A71.bat
Size 902B
SHA256 0519e9ba3012797607b207813ea13773656cf5faae5858c2463ee5ee386a31ff
MD5 318691ec38d1d0e4a2205a21fbe12815
SHA1 9729c9d2663f67a12ef83f55118b1f97343b3249
SHA512 a64fdbc426048056ed6c775776d419e0865612be4cadfc010a7a7e05f22ecc36b9f132b386833970d0132682d4dedeb9cce52372586149d881274b907f26cad5
TLSH
T12F118212C7F5E6AA4910A4134A31AEDBD025231D3F463731AB2C9609A0C484CFCE7756
MD5 SHA1 SHA512 TLSH

Submit Download

2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-21_ea255de34c18120765f70395510135f7_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 1019KB
SHA256 ce8a79827562ba47f939ac8e4d6c61d91f9d144570b86fe025328aa31c64e88f
MD5 2718f4b26e1b58f0d1ee9e135cad8182
SHA1 041ffc0e3742486a25dcf939f000cd0d6e61ce5f
SHA512 280f3f8428944f90caf30b436aa7cf7e44cf53da031e48220420f090be81b777950a77274b0580358aab0c94104059c71e07db15dfdfb00cb93c004fafbc2cde
SSDEEP 12288:sHD0L4xHIA4zwVyWFothzczm199zS2gRhVTNl7F62LKhxsDkofWB:s84mwQRthP199MVAPB3
TLSH
T14A258E1BB6D500E9D02AD5748B564132EA72BC530B30AADF06D0B3692F7BAE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 7ecfff1295c4960d90cbbbb44b3dccf94ffb20ca5ca824169ae5ace0ebdd6984
MD5 425e4f9d8cd9a460c1a45063cf2a66f7
SHA1 0e0e0c5daaefcea052c3b06a7efaa98b093d66c6
SHA512 d44e568935ecb570027c5aebf3ec54238efe87e20119afd1a8454fb77c4767dfad2a9d87cf113ead0361e50ca7c4ee208ac367008ce16497f39d6805979f9d01
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t6JN:gCSjGoLpWM6VsBEjxeZd4
TLSH
T186934A5AB28CB776D0F159B88E0DF2E5BD397E300E19185BB1AE3F1D9A7B1C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2924-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2924-1036-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2924-1268-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3948-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3948-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4604-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4604-12-0x0000000000400000-0x0000000000429000-memory.dmp

Download