9994a32a4c98dbcca5bcd21531aaf5b4be27242e5590bc3effb73e691091f0e1

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
Size 2.0MB
Sample260924-cc3eysbf76
SHA256 9994a32a4c98dbcca5bcd21531aaf5b4be27242e5590bc3effb73e691091f0e1
MD5 bcaa491298f123c8960ae5a4845d1cec
SHA1 ee7b554e245121d9b119bfe80e1779b905c6bef4
SHA512 670ee9f17748520273492cf015f71819fb59a4d8bf2f5688531e770ac37022b8598b64b652604eaf46d1c76f4cec1f9ea64d8b566bdaabede60cb84ba5e920cc
SSDEEP 24576:P4R5CIH/7l4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhze0:PabH/RabH/YfuvabH/CabH/YfuP0
TLSH
T1F3A584B16101963AF904AE73C71F731C78207E959CD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~1.Doc	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
1944	UpdatAuto.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\dayget.dat	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4244	sc.exe
948	sc.exe
3328	sc.exe
2804	sc.exe
2228	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4144	cmd.exe
3656	cmd.exe
5108	cmd.exe
5116	cmd.exe
1112	cmd.exe
1612	cmd.exe
920	cmd.exe
1064	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
204	WINWORD.EXE
204	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4260	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
1944	UpdatAuto.exe
204	WINWORD.EXE
204	WINWORD.EXE
204	WINWORD.EXE
204	WINWORD.EXE
204	WINWORD.EXE
204	WINWORD.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 1612	4260	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	85
PID 4260 wrote to memory of 1944	4260	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	90
PID 1944 wrote to memory of 920	1944	UpdatAuto.exe	91
PID 4260 wrote to memory of 204	4260	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	97
PID 4260 wrote to memory of 4836	4260	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	98
PID 4260 wrote to memory of 1112	4260	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	99
PID 4260 wrote to memory of 5116	4260	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	100
PID 4260 wrote to memory of 5108	4260	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	101
PID 4260 wrote to memory of 3656	4260	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	102
PID 4260 wrote to memory of 4144	4260	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	103
PID 4260 wrote to memory of 1064	4260	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	104
PID 4260 wrote to memory of 2228	4260	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	105
PID 4260 wrote to memory of 2804	4260	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	106
PID 4260 wrote to memory of 3328	4260	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	107
PID 4260 wrote to memory of 948	4260	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	108
PID 4260 wrote to memory of 4244	4260	2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	109
PID 4836 wrote to memory of 3800	4836	cmd.exe	122
PID 3800 wrote to memory of 2856	3800	net.exe	123
PID 4144 wrote to memory of 4900	4144	cmd.exe	124
PID 5108 wrote to memory of 2436	5108	cmd.exe	125
PID 5116 wrote to memory of 4972	5116	cmd.exe	126
PID 3656 wrote to memory of 4540	3656	cmd.exe	127
PID 1064 wrote to memory of 2828	1064	cmd.exe	128
PID 1112 wrote to memory of 3668	1112	cmd.exe	129
PID 4900 wrote to memory of 2908	4900	net.exe	130
PID 4972 wrote to memory of 1356	4972	net.exe	131
PID 4540 wrote to memory of 3680	4540	net.exe	132
PID 2828 wrote to memory of 3648	2828	net.exe	133
PID 2436 wrote to memory of 2480	2436	net.exe	134
PID 3668 wrote to memory of 2900	3668	net.exe	135

C:\Users\Admin\AppData\Local\Temp\2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1612
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:920
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\system32\drivers\2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~1.Doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:204
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3800
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:2856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:2900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:2480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:3680
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:2908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:3648
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2228
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2804
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3328
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:948
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.5MB
SHA256 7758889dbf963523b062128ebe8772c1517807f066703cc8323d06d37d7ead29
MD5 669d2b78c4bdfde66e71d195604cf33b
SHA1 d39a244cd1bebcc269ca8e6fef16e58f9a1f6b67
SHA512 7829f2cc87bd940a32b9de44ae9066975ec9e3e2605ecb1e9dbfe3a199bf3aa46877f9abc3f56c178fc147c7bebc19f443243a5a9839c3597990244687198969
SSDEEP 49152:PabH/1abH/YfuvabH/CabH/YfuPgPji0Aj:KY+ejo
TLSH
T114C5C5A17101863AF414EE73C35BB31CB8203D954E928D8FD60E7B6CAAB51F15E723A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.9MB
SHA256 75e4bbacb20f24d14188e45e8b2bdbcb55152ec57e1a3d3d500c02cf5a3dcc21
MD5 2d56dae749e7d2ae8507d9de6de1cee8
SHA1 8d0db0bf83f54640e8f89229591e5d2fdbeb8699
SHA512 0f69b9abdcd1812c7fac3c86c3bb93ce6d197dff1d60ec40ccf8c123f1af36101a269f3f874b2c6f3786082186ccf7f5989f4b25b8a7cddabd3608668ea42e0f
SSDEEP 49152:PabH/1abH/YfuvabH/CabH/YfuPT/ezSC6vUzPvMHjy:KY+DezSC6v2XMH
TLSH
T1CAE5D661B110873BF414EE73C25BB71CB8203D864EA28D8FD60E7B6C6A751F15A713A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.7MB
SHA256 c9dd981b82ea9e468372d8bab3fe452f1c3ed05e2f546cd9178b26be5d99caa3
MD5 9f096c8a2e4e14891358736443c63d13
SHA1 7d8f17cf9e3901fbfc8150bc50ee57a33042a730
SHA512 a60eaadb1cbc39cd21e9b74de52cd59880d18a856613a129d862673f87af7ca78fbd5648c4278b3b20c4291e302fe22380f5dbfc9a95e53306b780c4eefd4981
SSDEEP 49152:PabH/UabH/YfuvabH/CabH/YfuP8VO88hXl+:9Y+b/h1+
TLSH
T1A5D5E7B17100863AF414EE73C25BB71CB8203D954EA28D8FD60E7B6CAAB51F15E713A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 2.0MB
SHA256 1800e5fb7a8e2135a9752fbc98fac1669d64771767e5de8ec28bb8c1105e2036
MD5 4709af0ac1b60fde968efafd1a9061df
SHA1 180bb194380a2e17a7bcebc9fdfbc4fe1113cd4f
SHA512 b37ea03ac3ff47f05581fdf10af378a9d22ddfe6d127c60c37c1a70865d3f52258cd4e33620b6813ad606cda6c81fffd0c7f2379c7eb8538575e0849ba43f199
SSDEEP 24576:P4R5CIH/7S4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhzeSa:PabH/uabH/YfuvabH/CabH/YfuP
TLSH
T1BFA584B16101963AF904AE73C71F731C78207E959CD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 8.0MB
SHA256 af695e47a5820d92c337d3835ce4b8d89d001ca144a09b1d310648fe88a8dd51
MD5 3fc78ec87554df82372cb6e9e19bd1f9
SHA1 139639560faa1d6d93cc93ba1fed2c7235ebac71
SHA512 80504e492136bf698df11cdd03d16716527ba5588b1de4999a342a0c11b50fb0e00e036ad631b0daf78615193f1fd9e6cfc9b33c1ba343bb6a5e3eba0bb72628
SSDEEP 49152:PabH/NabH/YfuvabH/CabH/YfuPDj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeu:SY+SQRQyi36YOcP+Lvw2gAf+PN34
TLSH
T178865C53F26141B9F419ED71CB2E732169207C8A8FF186DF95883AA91A719F03F38761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.7MB
SHA256 3db21d0df13db6f52331c2ac122372501e27882c8538e286533265ef212c6aa1
MD5 7ddede2b1af7a72a5fa672c39fdf5c92
SHA1 6a5d0fb14c588707e9bb597fbddd1ea2a33d330e
SHA512 9992e3ccedde9f9a2621a2d1a5f3d8e56cad0425dd542f2073e453729b19f601887647fe636405ce7687a31a849718ec3320b2bd8763caa287d88cac1f451161
SSDEEP 49152:PabH/NabH/YfuvabH/CabH/YfuPj68Qg55nhoeWu7PNU3/Q:SY+dthHRc/Q
TLSH
T1B706E7727152427AF408EE73C70A732878907DA58ED28A8FC60D3B5C6BB55F02B7535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 5.4MB
SHA256 3d50d6531965428de315473b3f95e53a1040961daf0ebdc5ca921445dcd4756e
MD5 01c3cea129b2b7aede5436fe4838a25a
SHA1 9e5101bc897d8fdc5ee66f6bbb9db845f906166d
SHA512 26074d4372ce5dd75b0cdad4b52818a4dedad8827dd556388d45f49c0445d7524b947aeedb9e7f52f280aeec43500d12114bd543341006ba31dd950907cf3d15
SSDEEP 49152:PabH/NabH/YfuvabH/CabH/YfuPd3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVY:SY+My5112gYy5azzVvf69nLKnhZO
TLSH
T1F9463A63B14151B9F008EE77C34AB329B8207C964F629ACFC6093B5D2A769F05F79364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 4.2MB
SHA256 32f7f101e4c44c43fd3158e4b2558731bdbc2022332b2b898f118c9d6d446b7a
MD5 a6b95e3f6d066cd15f571fa778334176
SHA1 7c6031aab4d330ce6d04b58359411c8bf1730cb3
SHA512 4e69bae4af2da65974e7075ab9daf90f447e291d24c8606bb4868761a8c774a7a48b0eacc64c3429da7889727022b1b4013e8701cad4465e0d706b2ea260593b
SSDEEP 49152:PabH/NabH/YfuvabH/CabH/YfuP8B+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:SY+Wu6Jm0xd2d3
TLSH
T19A262962B10142BAF418EE73C30AB329B8207C954FA299CFD60D7B5C6AB65F05F75364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 3.8MB
SHA256 c994bf0035897dabe3d3a4a0612ca1d78d941cdc10b2c46a9d2ef31dfce0b332
MD5 0eee3e6c31c6612e2a97406e25542abc
SHA1 662fc661a059fd640f89a216fce6a7816820f668
SHA512 e90b904fef58c381e76923e99d4f2ad5c6b57015bd4e175d8f1b1b377eac1bdba27347efb79d7904a046e7719d60d9c17d0b7394e2f8196f2594e009bc996ffb
SSDEEP 49152:PabH/NabH/YfuvabH/CabH/YfuPHSuZQIY0Be2K8RVtOnks6NMHq6:SY+d5dKCi616
TLSH
T1E9162962B101427AF418EE73C71AB328B8207C954FA289CFD60D3B5C6AB65F05F753A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 5.1MB
SHA256 d044402134f60b1fdbb01d37e5124bf615dd80fb5712759fc2862e8a6edb5285
MD5 567d58304f05867bf9a3ae8b423affa7
SHA1 408fa96bf36b8db19eb9f01bc5ef8c51528bd64a
SHA512 406ccc029b149364b240633d52877f5da2291db1a472366c333874b15db54ce733d94ff9f0f82fa789161ae8e369d93846afba3e0836a4c7f2a25affb539ffcb
SSDEEP 49152:PabH/NabH/YfuvabH/CabH/YfuPAyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQdn:SY+Pm7vj1BDlZG
TLSH
T1C8363A62B10142BAF408ED73C31AB329B8207C954FA249CFD64D7B5D2BB66F01B79365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 3.4MB
SHA256 5dee25b4035ee639652c3fd79f0d63e0684558b7df9ce52b2b7de83aa3e38975
MD5 da8a3208ea06ce5cbdefce0f874e8f9c
SHA1 e45f68f98b81686a3f2ef6248a5e13a98a09fea8
SHA512 373c7a8a12f1d4156fa8a8794288cde2746648b39fb50c505194ea8ce991d5b676bddf4b1cfbe56b21a8f1d19a4b917e5e745ef7a25952b10dcf95bd5b7f9bac
SSDEEP 49152:PabH/NabH/YfuvabH/CabH/YfuP5htSn8EApI0fig1giDn0AP5w2:SY+IX2iwphX
TLSH
T16DF507626101467AF408EE73C31BB328B8207D954F9289CFD60D7B5C6AB96F01F763A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 2.0MB
SHA256 229ad60b484a16e030bde579726ef4d21973d7ceef11df6ca1bef50110971189
MD5 8b1fefe80c9da8f9503d28a1d213595a
SHA1 7f455e9269e0d7c4878b085b7e967b700e44ae0d
SHA512 a9735036e6632917e930a22ffd0521217778090a61d5994264d46f4f50cdec7cb27cb8a63449a93b848319771db25ec4c3f4b4c057aca9c42de225c085c2af74
SSDEEP 24576:P4R5CIH/7d4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhzel7:PabH/pabH/YfuvabH/CabH/YfuPZ
TLSH
T1C1A584B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 2.0MB
SHA256 57b08b71ca7d971c3c5c66727bebac354c6394c6cdeafefac0bcee1cc34282d6
MD5 4bf0b1d761bf3cc6d680336fd88884b3
SHA1 8034ae701f5d6c70548a112b906146b085d5f697
SHA512 606395d40127ae95a683efeb68f37d3d5e3d9537d66c12088c0b84de88dfb73b21599ce9613a63dad1bb8989ed68c83b53d0833ea38f33f887b3beed74ed371b
SSDEEP 24576:P4R5CIH/7d4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhzeDx:PabH/pabH/YfuvabH/CabH/YfuPd
TLSH
T13EA584B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 2.0MB
SHA256 9904cf0c1bd94359a23381b59f8f4fbebb87888338feb2c0288b5edf24470e17
MD5 63dab948555af8d86c97015ac6e2bb01
SHA1 8b0aa85830c8e69bc64970e92e0d6eb254b57a1f
SHA512 f57a5d10e3ef7dfe880b8427763c690198013a540d66bced950006707f1bd8620cac1353b12dd1e7f91a01d8848e26b9468af9ab050ff5d62cce6f8c7e0e72bd
SSDEEP 24576:P4R5CIH/7d4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhzeVs:PabH/pabH/YfuvabH/CabH/YfuPe
TLSH
T1D1A584B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 2.0MB
SHA256 72bf5fc6600f2c7bc59fc812d6a84b8be84295c7b8967961530cd00ff8c0d6e2
MD5 1d3681d9e200e38b79a3d9acb9e458a1
SHA1 82fbf0d32c6683e74397c93273c396f733882d06
SHA512 5adc065380d46d1a5c585c59eed1a82bea53582168714a70cfc0e1f6496dcbdd9d57c1e81cf3b35b3f808b885d8228d73917aad92d3203e9db89890a8d3ee53f
SSDEEP 24576:P4R5CIH/7t4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhzeb:PabH/ZabH/YfuvabH/CabH/YfuPb
TLSH
T1BBA584B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 2.0MB
SHA256 154ed5056e56bbf34a4c8bd09293f790fd9541c407bb7eebb875835983711995
MD5 4b1b796a2c6fd187a9470b2b707da146
SHA1 1fc2b5400f3320d09d1adee1d4685d37a3425a09
SHA512 886fd7d1a0a8188c6d2c4203662a2ac7ce137aa2a406d817b203d74b0ed5a099bd00c47ec2e186d6833b37f64f164c2463df83cf9bc8344035bd0eba86b6ba67
SSDEEP 24576:P4R5CIH/7d4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhzecZ:PabH/pabH/YfuvabH/CabH/YfuP+
TLSH
T17FA584B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 2.0MB
SHA256 549fbe6c21d3b3e315e131ac8b443ee78f4e9e6237506d606a0480bf13b12dfa
MD5 d1ad866584fd9c5ea2242f1e4544af78
SHA1 2f007c131f6e24f016cd893dfdee2995ef20b150
SHA512 5e4877b9fafce184bb1b91a10efe4dd8fbc6a96ba9696b47f7168086b1028414d4fa12b2adf4c6c26d391883301c4ce29af3c523feeae818acd685fd03e70fba
SSDEEP 24576:P4R5CIH/7d4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhzez1:PabH/pabH/YfuvabH/CabH/YfuPZ
TLSH
T170A584B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PopRemove.exe

Path C:\Program Files\PopRemove.exe
Size 3.0MB
SHA256 623cd8d100787575d4cc720e9637555de60d154015e3134115793c3898590fa7
MD5 538eebd78832541570d42efec36502c0
SHA1 9b5d538c6050382f20a17f1577ceadd09d2bc884
SHA512 8f89dc5c3ad5e89f45fbb2cba0c8ccb426a0645eb44e72a0049d3d49e01875e271afc0b9e7aa4ff24b59ca7e92d21ef9faed3b8caded62bc8781c9bba794c826
SSDEEP 49152:PabH/xabH/YfuvabH/CabH/YfuP/oTC9c/3l/Z3HJp6xD9yHVacB:WY+P9c/3H3r6xuVRB
TLSH
T111E52AB16501963AF904AE73C31F731C78207E959CD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 2.1MB
SHA256 3bb70f68ec7f5fad2106d0a0b7ebabdfe6aff1877c6080fde0f84c2ef9ae1dd1
MD5 c15cfcdc9babf6e0d575c3d2da185942
SHA1 2bff1a16caa3360abc735d4db45a1d98609e56f8
SHA512 eb81dca35728ed6ed10106723992575f7f75c80e65c5a6d2420aaa23b029342c760ad7ac04dcbf405e89ef34f2556be7a5e7b2f0e82053b7c9003c1d035c9265
SSDEEP 24576:P4R5CIH/7B4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhzelD:PabH/1abH/YfuvabH/CabH/YfuPl
TLSH
T17EA573A1A101963AF808AE73C31E731C78207D955DD28D4ED64EBB6CA7B41F11EF13A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 2.0MB
SHA256 f388849cbfa1263d52924b3e0525c281ab02a4ff1694fe32d8200bf69cc9081e
MD5 49cb46ef7c84ace6a1bd9dd71ba350f3
SHA1 4f52552289c05ade8f4bea53655f6942a3887397
SHA512 f7f3a6a5d61ac1e4fc57b6f0d4a1b9100c33ebf9a643faa278ce78096f8a35bd3e7832067bcfbeba47292a0294aa2c7c77beb74272d9d12e60404b86e0e7e1c3
SSDEEP 24576:P4R5CIH/764R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhzeR:PabH/WabH/YfuvabH/CabH/YfuPR
TLSH
T1E8A594B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 2.0MB
SHA256 a9f62cbded4dc73eedff4adf1e1c7e5cd7c4482c81a57f186f99a5e180e2adf3
MD5 963c4ec6be52fdc86b0568b2465572c7
SHA1 d9b21876a6bdbec7cec0bbc551e81920909cb43a
SHA512 265e004360446d9d64c82992c09adb7d14680aa8ae7d537a172ff8acaf7d0ba866a0d4d1cc03d1a9192e307aa12e2ec06fdfa0321eedbbb5ea2afd76e74fbbdd
SSDEEP 24576:P4R5CIH/7d4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhzezj:PabH/pabH/YfuvabH/CabH/YfuPzj
TLSH
T15FA594B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 2.0MB
SHA256 47fa4767d382a55b4c5fa03b553dd1a36a23a439fe0efdfd2ce5ba8db0d484d3
MD5 9dde11baea3f1dc865c31d2c9062c39d
SHA1 61841532ca3ffaf5dcf86266d06c8ce0207329d0
SHA512 75efb2e8b424df4312f18987db26af6eb58ecece7445889ac40ee278b00fe5a0737907a8ab92110a0447cc461ba38b77faf0e813a465c1ddcdb1a72048f38658
SSDEEP 24576:P4R5CIH/7m4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhzehjv:PabH/qabH/YfuvabH/CabH/YfuPhD
TLSH
T18EA594B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iso690.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCDDA30.tmp\iso690.xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
TLSH
T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 2.0MB
SHA256 7c946fa4df95512c1396d204493a816a54151a382706d609f6af42b5b5dacf43
MD5 921f9d6cbae7cd2b8be5b989c6f92c97
SHA1 e0f6aede9cd7389852e510fea2e222589f285c44
SHA512 8cf731759ac2d99c0354f02612ddcf492eaa1b47d8a403dd2a413b5d23f0ae7b9065f47f33f911a442aa67153e2027759d9617fe6620f93135cfdf89cbe277ac
SSDEEP 24576:P4R5CIH/7l4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhze1:PabH/RabH/YfuvabH/CabH/YfuP1
TLSH
T1C0A584B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~1.Doc

Path C:\Windows\SysWOW64\drivers\2026-09-23_bcaa491298f123c8960ae5a4845d1cec_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~1.Doc
Size 4KB
SHA256 57d6d4c889bb6788c22d5d523f02c9f9c2964027460186bd8f3f77e85ff8a993
MD5 99fc4318ef477ef1f36b388a33200136
SHA1 83ec79fe37306ee4c7e06f946eee4a25d52b14ed
SHA512 2ad747959812a56fa9eb311f6d2129dfbbeffa8661ea57ca791a958f082f7ce7bbbff78a4ba394a0408992ad4c6dbc9ba871e91df2e247ce552e14e9013cdb48
SSDEEP 48:QuN9uN9uN9uN9uN9uN9uN9uN9uN9uN9uN9uN9uN9uN9uN9uN9uN9uN9uN9uN9uNH:N
TLSH
T1F5A122C28308300A2003A08E0AC3802803A283808A2820C0E232C8A808C33EABCEF30A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.0MB
SHA256 5897f1270b9236d0eeb226c80091d924d4121d2feb3373235430846258cf6e58
MD5 ea9d76ec98ce96050a881e6cba0004c1
SHA1 7f3e8526e30ac3c3e3f57a22c8ce43a8b679e88e
SHA512 2bc56cdca0e9b0863220af3e734914b9c5f8d69b0addf342ded023829b52b2b280f5335f116f3ed7719a06cf3e209d05bab4e2729a62643a608ffd3201919c72
SSDEEP 24576:P4R5CIH/764R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhze1:PabH/WabH/YfuvabH/CabH/YfuP1
TLSH
T1E3A584B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.0MB
SHA256 8380bee5f1773b17efef9d74a1d350e9dfee07ed4964517bde69a3215952caa9
MD5 befdd8b78dfab39ba77c9dcfd906e0e8
SHA1 51eb4e47c8db593311bfaee5a2e9b11cc4b116f6
SHA512 bd3556366f4baf1a242f1f317af6f57da2fa706696250c32d738ffd66a4f32c989856cec92110d21dc5c7babd26a4abc546deb97e494ef95b03611be2b340fe1
SSDEEP 24576:P4R5CIH/7m4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhze1:PabH/qabH/YfuvabH/CabH/YfuP1
TLSH
T13EA584B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.0MB
SHA256 0180905867ca99425008ee30d02491277b3b2b5b12df13710eefbe3eeeb3f755
MD5 1fd3409380789ce61e172afe834d3782
SHA1 ac83135b3a11ce52c7e980431e05057f38dba14d
SHA512 06ad3a84cedba070c3cf473239705c2de7b28937f38ad6254f9dcbfad7b184f10fd6ef74d3bfee8d2272ecb25b4fa86a1934e647694ad906154df5c0b9769deb
SSDEEP 24576:P4R5CIH/7d4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhze1:PabH/pabH/YfuvabH/CabH/YfuP1
TLSH
T194A584B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.0MB
SHA256 ff46c2d308866c24c37726a1dc3ed2c298fbd5880b4a2cddc6b09cd6a6b3ac31
MD5 723c6de75d537981b4e9410aaf33d475
SHA1 1957e85405ec5d260c41313d9074187f5236775b
SHA512 fc08d23c4ff2fb41873f05293b0331419c3ac0a9ca26b866864bef0b298317bedcc5675b9869ca903ef4a2143093ba45c3a90da6c738bfc50884360066a2433f
SSDEEP 24576:P4R5CIH/754R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhze1:PabH/NabH/YfuvabH/CabH/YfuP1
TLSH
T1FAA584B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.0MB
SHA256 d79d3db3ac895883a2d15f9ca9b80ecee22e2d9cf7d447f76cc49f867550aec8
MD5 c0526f679d5726357db703c5e521d790
SHA1 d98acc11f4897ede1e1b1dc567bcf9162f5b03c1
SHA512 1c38ac952ea03e4543dd22ff4d688a4456e85a170fd466db70f76804d305085e71c55ed98bdfb93719ca748a1d4e0682c8119c25093e56d289bb1486af15d903
SSDEEP 24576:P4R5CIH/7t4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhze1:PabH/ZabH/YfuvabH/CabH/YfuP1
TLSH
T192A584B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.0MB
SHA256 743234325e7146d63ab11bec3526830b29c15bdc437e37d8695fbf4d2c167708
MD5 583c55fca9beb5293fa45e7a0dc3a284
SHA1 fd54b9b5e405593aa4ac92d5c0be253871c9a400
SHA512 576cba748bd3abddc1218c6bf080f02a1d27d7c18c729515fe3dce9e6f19cd5a0da1160d125d7bee13e5c1c5664277cf2ec969e02c982f5888eda92bd95bbc48
SSDEEP 24576:P4R5CIH/7F4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhze1:PabH/xabH/YfuvabH/CabH/YfuP1
TLSH
T115A584B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.0MB
SHA256 e56aaf96c647a4311cabe13b87d6a37ad62ef98e573ade2d2a4a177d93b7edd7
MD5 4ea748ff2d83594a1d2556c4491a0af8
SHA1 a7a3be607f79d6cb33b45436629dd0f2cde78d18
SHA512 d05be3b77aab8e827b95f2bf09cd6df63bcf1e0f08ac54f061308e8cf5712b79d0e8c49f070ca2362e7b76b5da8eb885fb1406367d6c505cc9907f2da8a2ca11
SSDEEP 24576:P4R5CIH/7B4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhze1:PabH/1abH/YfuvabH/CabH/YfuP1
TLSH
T19CA584B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.0MB
SHA256 49934ea8bc068ef9a9345d03ec57baef772de2b7dc0ad3b6f663ba6abb69f8fd
MD5 5b6ad13fb9aa8dd0f12f77ab25a83f66
SHA1 0fb6c5dd824ef0c696821e14891d5679e00a63af
SHA512 a98a4f3a20561a8030dcb36460385b21cb847ea68caa37926cf67a83abb2945892177f8d6ab76496322fcff56a7df5989f8ae61528c42512e498c9a0e629f103
SSDEEP 24576:P4R5CIH/7B4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhze1:PabH/1abH/YfuvabH/CabH/YfuP1
TLSH
T152A584B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.0MB
SHA256 3ffe77d948971eb64afa4c666381929ab582fbc3b6491915b9dadd3de072979e
MD5 88b0cb4bc80fddd76451c4a7d3a05295
SHA1 6d03cb7c43fdc35bc8c2954395f95e5027caafdd
SHA512 59f231e3a85a6be14b49e7de25f78c28132c0c06c874f195dcf3ba7fa980f1d9b6e1bab2f00a45102b437402db0adb752a30343d0b555332b6af2a9a69492706
SSDEEP 24576:P4R5CIH/7S4R5CIH/7AiGnB9umE4R5CIH/7u4R5CIH/7AiGnB9umhze1:PabH/uabH/YfuvabH/CabH/YfuP1
TLSH
T1ADA584B16101963AF904AE73C31F731C78207E959DD28D4ED60E3B6CA6B81F15EB13A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-42-0x00007FFF5F380000-0x00007FFF5F390000-memory.dmp

Download

memory/204-41-0x00007FFF61650000-0x00007FFF61660000-memory.dmp

Download

memory/204-40-0x00007FFF61650000-0x00007FFF61660000-memory.dmp

Download

memory/204-38-0x00007FFF61650000-0x00007FFF61660000-memory.dmp

Download

memory/204-39-0x00007FFF61650000-0x00007FFF61660000-memory.dmp

Download

memory/204-43-0x00007FFF5F380000-0x00007FFF5F390000-memory.dmp

Download

memory/204-37-0x00007FFF61650000-0x00007FFF61660000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads