a047060f5994ba3b139301e6edccb840d0d7e6e1bc9218de0e9187ad8a4a97fd

General

Target
2026-09-28_36af467599934d37c9088c0a423c8349_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
Size 3.7MB
Sample260928-vbtersztes
SHA256 a047060f5994ba3b139301e6edccb840d0d7e6e1bc9218de0e9187ad8a4a97fd
MD5 36af467599934d37c9088c0a423c8349
SHA1 18d7dbe45595ae94932051a49064b74f430f4001
SHA512 c14d6aa4b383c8b69bf7e19fdd7e36e39b40a8a9ebe43904374df52fb46fe94c1d7f79a55cc5f5b631596d6a02dd63042ac358eff728cc82420958dbb00c9555
SSDEEP 49152:OjvikOMDRZ9IBVL+s0ezJGd80SHMsThF35Hj1BzuW9Gllgo3Cjvik8:OjVOMDtIXLr06AdfEThF35PzuAE+3jV8
TLSH
T15506E015B7E800A8F0A7A279C9B34562D6B17C120F70DA9F1191B26E3F736914E7DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4616	2026-09-28_36af467599934d37c9088c0a423c8349_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
1988	maintenance.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2896	cmd.exe
2432	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_36af467599934d37c9088c0a423c8349_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenance.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4792	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3800	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4616	2026-09-28_36af467599934d37c9088c0a423c8349_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 2896	4688	2026-09-28_36af467599934d37c9088c0a423c8349_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe	89
PID 4688 wrote to memory of 2432	4688	2026-09-28_36af467599934d37c9088c0a423c8349_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe	91
PID 2896 wrote to memory of 3712	2896	cmd.exe	93
PID 2432 wrote to memory of 896	2432	cmd.exe	94
PID 2896 wrote to memory of 3800	2896	cmd.exe	95
PID 2432 wrote to memory of 4616	2432	cmd.exe	96
PID 2432 wrote to memory of 4792	2432	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-09-28_36af467599934d37c9088c0a423c8349_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_36af467599934d37c9088c0a423c8349_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zbe2026928164924559.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks.Exe /delete /tn "Maintenance" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3712
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks.Exe /create /tn "Maintenance" /xml "C:\Users\Admin\AppData\Local\Temp\zx2026928164924559.xml"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zb2026928164924559.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    - System Location Discovery: System Language Discovery
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\2026-09-28_36af467599934d37c9088c0a423c8349_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-28_36af467599934d37c9088c0a423c8349_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4616
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4792

C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zb2026928164924559.bat

Path C:\Users\Admin\AppData\Local\Temp\zb2026928164924559.bat
Size 904B
SHA256 06a725639ca513c2f718d1fc2b0fa9e5a898675e05f77ef5dc2ba528b7b7f4d0
MD5 ecbef216aa06e06f1a5b80f15d7d4344
SHA1 3a88d314a27c78cd28c7894469867502a93c2486
SHA512 1db81734d53a72f1dc7fe00cecb9208526c325e600daa5c9a86dec5756c623df6b985132de12ba1ea3e866624e5ab38769f7e039f9ef3077568a6b66ac42c9ba
TLSH
T1AF112C8062EBCE7D041C95171667F69EC1AC29AD2B483F14D79EC50D2BC284DE8D6B21
MD5 SHA1 SHA512 TLSH

Submit Download

zbe2026928164924559.bat

Path C:\Users\Admin\AppData\Local\Temp\zbe2026928164924559.bat
Size 366B
SHA256 0581b3fd45f0d7220780485e9847276a2b0eeeb011729ede31da35cc262ab831
MD5 55c9e7afa99f9ce983d66c2652e9b8c1
SHA1 e603d96ca48740b733ec16f2e6dfb9ad58a15c18
SHA512 f65c3b3bd9cce7532c56fd99c141590f60ec8bbd08f9649e72f1a6bcb9da1cf89cdacb8d950f62a8b71596916ab86b02173a78221dd2962e71ae7e36f3a92d40
TLSH
T139E0680803A7C0D9500CE20375DB261368B1606AA6E137282DCB11208A8B089F8AB703
MD5 SHA1 SHA512 TLSH

Submit Download

ze2026928164924559.tmp

Path C:\Users\Admin\AppData\Local\Temp\ze2026928164924559.tmp
Size 3.7MB
SHA256 17ddf42f56e384ebf0249282eb47e39231c592ad019ee17de91aadf358127aaf
MD5 f5721c9e9110f4b0249b944f87d689d6
SHA1 c6799a4c601cb4a3fcfca75023722b8dd2c5bcc3
SHA512 2c8f4d02878d84935075545d3577ecddb5a738fec525faeef6ae62380d5fbd993d2d2ba119232b362001ed4e0c45756cc9cc4a9077eca9b69aed6d57c6da0b2d
SSDEEP 49152:S9Gllgo3Cjvik8+7FiB+cfRWkkjY5qUHj1FhW825PlJ0TJcttcCmIf+u9YZrO:UE+3jV37XsWkkjaHjTo82Pb0c0NZrO
TLSH
T1FC06F115B7E800E8F0B7A275C9B25516DAB27C520F30C6DF1191B26E3F736A18E79B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zx2026928164924559.xml

Path C:\Users\Admin\AppData\Local\Temp\zx2026928164924559.xml
Size 1KB
SHA256 702eba68ab4f5fb39e5ae9cb5e629d07d2bf38c0ecdaad8bc65a6ddabbd69cc7
MD5 74f52405f07acecd348897153d02394d
SHA1 4696f6981baf895936af7de02774f11ecc10c4a0
SHA512 ff40c6cb3cd64fc3dbf26eda6ca953e28b9584a647d2b63f020ac7e41ff886ab225dc6e7ce557383820481a4051c16e6a28c54d1607ebc56aef48a16fa28613b
TLSH
T1BA31E3589CC0F72BB533922BE7515282EF768393496A4038F4CC4B7B2FF514A6153563
MD5 SHA1 SHA512 TLSH

Submit Download

maintenance.exe

Path C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
Size 2.2MB
SHA256 a77315296dc58edac4959c9ed69ec96e9517883684edaeba3e64c48a44c186ae
MD5 73ad6d009f1c53c23f5d068caa805299
SHA1 f50493f49c3b2b3697b5eb571738dbc70383cac0
SHA512 1f9c739c7b745ba57b3d7e50e00bac9d3019de25aab5bb22c0da810d963dab93d71c56686fccf737cf87a4c95fe53b8e4b3dda09ac1526fb4899aa0e1336e920
SSDEEP 49152:uo7TN6XYwGRV1LCnO9DivWp1daCCN2eLF6I5YDPRrBdSm2610V+9dmhBafgE:uC6NIDLCCiO/dat6I5YPFBx0VmKafgE
TLSH
T184B5337F996640A6FEB86ABC24127F7C892BD12703306D71D9D59C37045E223AB324ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads