f6eaec12741f71039481eda0f5f004a56fc9438f36e088d0c39d2ca344eeb978

Analysis

max time kernel
150s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 404KB
Sample261003-26c5layfle
SHA256 f6eaec12741f71039481eda0f5f004a56fc9438f36e088d0c39d2ca344eeb978
MD5 f7e85a2624f879ceb8ffa98421a11851
SHA1 c31fe7efc967c06d6097457ee66033a92f52c6da
SHA512 996bb9104e7514a480c6d0ba436b0f1654878c19dbc32609039a5b279bb2d8d3208906b819ef42e426d1c1c9d5f3cb5cfc7ded3b0ed371e65bd983e9a8f6a0b1
SSDEEP 12288:w4Ryed8I7r/7mdJXAm3ggRUeMz9TNXvkk:w4R5CIH/7Qam3NCdBTNsk
TLSH
T1C5948D61B75048B5F863857EA824850AE9723D750AA0C91F73D43B5A2E333E378B671F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
800	UpdatAuto.exe
4644	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar~4.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\D:\	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
\??\D:\	UpdatAuto.exe
\??\F:\	UpdatAuto.exe
\??\F:\	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1052	sc.exe
1332	sc.exe
5040	sc.exe
4832	sc.exe
2676	sc.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3716	cmd.exe
912	cmd.exe
1740	cmd.exe
3948	cmd.exe
3016	cmd.exe
2636	cmd.exe
2420	cmd.exe
1452	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4184	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
800	UpdatAuto.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 3948	4184	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe	86
PID 4184 wrote to memory of 800	4184	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe	91
PID 800 wrote to memory of 3016	800	UpdatAuto.exe	92
PID 4184 wrote to memory of 4644	4184	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe	99
PID 4184 wrote to memory of 812	4184	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe	101
PID 4184 wrote to memory of 2636	4184	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe	102
PID 4184 wrote to memory of 2420	4184	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe	103
PID 4184 wrote to memory of 1452	4184	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe	104
PID 4184 wrote to memory of 3716	4184	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe	105
PID 4184 wrote to memory of 912	4184	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe	106
PID 4184 wrote to memory of 1740	4184	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe	107
PID 4184 wrote to memory of 2676	4184	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe	108
PID 4184 wrote to memory of 4832	4184	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe	109
PID 4184 wrote to memory of 5040	4184	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe	110
PID 4184 wrote to memory of 1332	4184	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe	111
PID 4184 wrote to memory of 1052	4184	2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe	112
PID 2420 wrote to memory of 4196	2420	cmd.exe	125
PID 812 wrote to memory of 2932	812	cmd.exe	126
PID 1740 wrote to memory of 2508	1740	cmd.exe	127
PID 4196 wrote to memory of 728	4196	net.exe	128
PID 912 wrote to memory of 3840	912	cmd.exe	129
PID 2508 wrote to memory of 5060	2508	net.exe	130
PID 3840 wrote to memory of 620	3840	net.exe	131
PID 3716 wrote to memory of 4888	3716	cmd.exe	132
PID 2932 wrote to memory of 4680	2932	net.exe	133
PID 4888 wrote to memory of 3056	4888	net.exe	134
PID 1452 wrote to memory of 3220	1452	cmd.exe	135
PID 3220 wrote to memory of 4352	3220	net.exe	136
PID 2636 wrote to memory of 4540	2636	cmd.exe	137
PID 4540 wrote to memory of 1860	4540	net.exe	138

C:\Users\Admin\AppData\Local\Temp\2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3948
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3016
- C:\Users\Admin\AppData\Local\Temp\2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar~4.exe
  2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:4680
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:1860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3220
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:4352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:3056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:5060
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2676
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4832
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5040
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1332
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 682KB
SHA256 d476e1bebcc44721b3bf94d80fbc581e2acbdf2ec7b0c1c9d06ffa045976e7a8
MD5 c1ca80ab5dd5f15a4bd282f546c34e63
SHA1 31b3323cc52b402892d517286756c32692552079
SHA512 4be13bce91f80c7e3e51fdc5b1b5a99fbd1dddb8e3115e140aa8b54ff7e47d07f70e2facd36420eb84116d504d1bea966ca529f715b2c68b5b04a7b2345d72e8
SSDEEP 12288:w4Ryed8I7r/7mrlXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:w4R5CIH/7WL0Le5ji0hmxNrM
TLSH
T105E40926F6648335E073C0B9C5E2968EE9313D910B3089CB6385E76C2E776E79536732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 5ee9623fa58de3036c033ea0830e7fb8b406d758d3e60de100e277789f5e8f64
MD5 f1f2b8f31e635b7ecd80f7fd66965593
SHA1 c005ebddae602c1831a6649e9c7b3bdf3099ccbc
SHA512 887cb52a8d245315ff49e9af8fb1aa6f9d5a0f8ea1f7d842859ae002afd8da916a11ffb8282d1d40f64281724d45de4155ab82733eca39218473d6605afbd7b7
SSDEEP 24576:w4R5CIH/7W5a7/ezSC6vUyD/aqgrvWx6q8wyu:wabH/N/ezSC6vUzPvMHjy
TLSH
T14335FA25F5788323D0B2C0BAC5D6A699FD3238424B3089CB5246A76C3D377E6D53673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 825KB
SHA256 82bf60c144c18ecc54df159b9d22cbd9d4a724e50d1f6324b0757389caa0851e
MD5 61913a6a500c8d624bd4d65814ba3306
SHA1 3c2a11d8b8eb4370ae4e7bbf007cba8c993ed108
SHA512 d78bb847026e01823b612c9ada5f1a87ca7a86d5fdea7292e478eee14b555c393c30dd1332b13507f55177721208faa99cfc1b94d135aed9f7c0feaf95987c76
SSDEEP 12288:w4Ryed8I7r/7msLVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:w4R5CIH/7xLVbqPb88hv/l+7
TLSH
T129052A26F5648321E073C0BAC4D2969EEE323C514B3189CB6346E76C2E776D6D636732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 148KB
SHA256 1d8d98fe0872d442dc16938304593ba13c6c57f695b0d87627e7e108bf808fe0
MD5 378d1b8344f0f53d77133fb79e4bf460
SHA1 90a61ac4a254d3a4cbf3a315ccc0a5abf110bdb3
SHA512 8234b9b28a3bc4dc7e9b65afa2d3ceb90ac6d09ce2c36014a5e0d8e302fe47b1f8004624208bf09f8c91200c43520a4badecac2eb673a770387b479e2878f70a
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7mu/keL2CpaNVH:w4RywzYmqBml6I7r/7mYFa7
TLSH
T1ABE3C632AA00941AF56289BE7838855E7D253EB14EA15C1BF3C1BB5A25316D3F4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 1e855702e16167b21ea2eea015360cc55b669f428ff08fda09fc136c97945c30
MD5 0022fe87bb1c7c6569c3eaf777268ebc
SHA1 fa9dc743876dae44ee9774e6ee9e630518168ed3
SHA512 fb29b9a9d302dcba61cc201ecdaaa6feb633b81a79c1b50008b94f71ff7153b2a4cce4801f2caa5fe135e277e17c1037b9f73a96f3f47ccfc8df8042c7cd57d4
SSDEEP 49152:wabH/8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMi4FqJ8:pQRQyi36YOcP+Lvw2gAf+PN34
TLSH
T107666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.8MB
SHA256 46737a8d7967cd2575b10d4e24741b9ba8983b18122487f3515ec39916295e73
MD5 d728d2d8c0089949113f3f0832185bd4
SHA1 2aa9daf299e94232b6cd809725342c1c11154853
SHA512 9b02262455d1fb5e1e1e91051cc7d577ba4b0780b58ba0507289845d5a8b26c1253dd2f859fc5da28d74f8ed3a2ecba40ce462df776c437eb579b1ee7f7f9bab
SSDEEP 24576:w4R5CIH/7uYwvLof6SRQ+rn/fDboqxN1nnh6z7DaHGTNHu7PNU3/5W/ohL01:wabH/F68Qg55nhoeWu7PNU3/Q
TLSH
T104951733B2E20099D05DD1769F5A8721A6D17C718FE1E7DB8241730A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 26915bf2696a74608496ed976a15705c44e4a977ee33fd669d7c31fef44d9e0f
MD5 3f8969f4cc6dd9c9ea18ee221089e2f8
SHA1 da0571912845afb3e00d15217465a2b89ebd54c4
SHA512 4e20d669d3da9bf8afe6c1d538a492c1967738bad31dc4aee75fddff0000ee76363ca8b9cb1a0e2575a00482db37dad45bd53be74f8b2a033167526d0ad9ba5c
SSDEEP 49152:wabH/A3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgN3Oh6tznm2FQ/nho2qf:3y5112gYy5azzVvf69nLKnhZO
TLSH
T16B066A13F29900E8E01DD1B9974A9232E972BC574B31A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 19bfc7a3a3a598c8093b2d6bddefd9627be31c9b1ebfbddb6123cc1f487391b9
MD5 d63ce70a6810407d137f20194ad23e83
SHA1 13f76074151679864c1a5cc6bb71393b83607527
SHA512 39d49f2bd9741c66a45ce84db1d277430e326ca6c2857a080e9544c834515b69a80e2b76d4c3e9ffff954bfce2e5d0b1b7ec7f40e849dcdd9f610d061c2e14d7
SSDEEP 49152:wabH/mB+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:Su6Jm0xd2d3
TLSH
T102C58C13F2D901E8D06AC478975A9233F962BC590B30B6DF0B9073562A77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 4b59b66dfaad1a238102e5ba1895d1b00bf36fbe0b2202c48072f75f0720d317
MD5 8ae54419b36a91882233649c6829ba7d
SHA1 5f67da4b81371709edf960d81633dc8690ba59c4
SHA512 faa79d275df9b62117baa4c53eeb7c93db7f7fda2b5df9adbefbf41a07255f13bc0aaaeffeea7e9c642345bd4a02f5c0cfe795e0004d18ec451075a440577ba5
SSDEEP 24576:w4R5CIH/7hBhv8E1hps0+ogd2z615uCMVF1Agz6hUQ1zNOgLLwH7ReaQXx3+:wabH/V1hpsNoJpF1A6GU44CwH7R4xu
TLSH
T1FA858D13F29840E8D06AC17997569236EA72BC550B30B6DF0780B7962F77BE06B3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 6dbbc3fe53a5b7f06b305e212c2b8e9e64f58568db1feedf7a950d17362274d9
MD5 c6f5f08556ea9ac4524485858f82c09a
SHA1 1b280ac4a9ac307dceeceb1203685bf22a73b4a5
SHA512 bd39c01a002de37d49f09d937ef6de784c6b66e31ba97203d2ffee19089fe22c5e3371b1c2c01c682a36d83af0acf007e774580e648e888bbcb7e57882ef2d83
SSDEEP 24576:w4R5CIH/7uK4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6bR04FxGgVG2Onks6xt4bSMB:wabH/lSuZQIY0Be2K8RVtOnks6NMHq6
TLSH
T16EA58D13F2E940E8F0BED57897658226EA72BC554B34A6DF074072591E37EE06B3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 1a3707a4cd67587cb42c35dd33eddacbf0da5878d189429575323434907683b3
MD5 8ae1bdae5db064a00d8416258170ffdb
SHA1 87ab7f4f460ecb9d986ffd1ece119518e363f858
SHA512 65b41c071911f83a0795b0ea56d654cb13c6780749158ab1cfc4c85ac9ef66880496fdb0f0853a7e8a42a8fce258906b86c95a8a0d836a873bd3ee4841f2a6e9
SSDEEP 49152:wabH/ayLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AX:zm7vj1BDlZG
TLSH
T16BF59C13F29940D8D019C079975A8232EA72BC594B3166EF0790BB562F77FE06B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 c1293b02580dfab0531eb6ce0b8aedafce2656878ab65311625e54af802f4d51
MD5 e205defc1fe924d24c25c5cee188fa86
SHA1 60a511f5916c8f2d9c632a13937a5eed263b57a4
SHA512 3c831e00a26fa11cceeef7438eb14c25513801f3a169b944550fcba54c485eea035fd2b73281f31be3bae0f226c77e0ed5e7f5a9b701c8188c19a675ccfdb368
SSDEEP 24576:w4R5CIH/7hMhiavrPSLT8EARn+FgyUgd0fJY6B1i3iy9CTn0AP5+2QLy:wabH/OhtSn8EApI0fig1giDn0AP5w2
TLSH
T1A4758D13F2D940E8E05AC179C7568636E962BC210B35AADF0790B7561F77BE06B3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 157KB
SHA256 ccdfcafae6eaf89ef539f460f284d6578b54496c681f3c6f9d350719e2153229
MD5 160df8c6de3848f9e1a798fa64689e85
SHA1 78089aba602b7052cca13273acfc121a81c5b868
SHA512 2341716fb7d5ebb85fe707d1adda72c37946fb7d6fde8144ec57703ce0cbe06c4bee8f467e72db55ca15ab8f29b88ce630c1a44cc4f72bdffff89504dc4c38af
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7muHkeL2CVV/2rNx3:w4RywzYmqBml6I7r/7mw7e7
TLSH
T114F3E732AA40941AF46289BE7878814E7D253FB14EA15C1BF3C5BB5A25316D3B4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 157KB
SHA256 ff88cdf1d78be27eeee11c1ca3b27f51e4f35f32beb1a24f1802d4a833784200
MD5 71dc6faed2703a6b6eff5919cb661d22
SHA1 880c38dd5cf807edea7bf25916c31f70a382c967
SHA512 1b92ea25603460a6eff81b3dc5b32e027cd50cad88e32d647f6c8b9c905d2d25da6d69bf0457175123b5ce6dc419a8260c4f2e5b66f703130010e4cced1960f3
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7muHkeL2C0V0cFax2:w4RywzYmqBml6I7r/7mwgNx
TLSH
T15DF3E732AA40941AF46289BE7878814E7D253FB14EA15C1BF3C5BB5A25316D3B4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 157KB
SHA256 2836f0b72a2dbc0bc978259a0510b069a02c586b0c96d4e2d5ca15e2057adaee
MD5 456e1c49876db637b5d177795319d02d
SHA1 258d3de242716e29d4154e1a79d0990526e0d096
SHA512 a058ad4ccf09458b8acf01f508d6437f299cca1fc65aa25dae9f1a07366ca267d5b53ffcc72c6558c311d4b4088b122815909087589926a95ba1e10f68789a79
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7muHkeL2CNVfin7xm:w4RywzYmqBml6I7r/7mwzqs
TLSH
T15FF3E732AA40941AF46289BE7878814E7D253FB14EA15C1BF3C5BB5A25316D3B4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 177KB
SHA256 876cee9fc6d4a2d28d46d1b556b4d44b4f484219c40a8889cb36c51fd280def6
MD5 71534a085345812445a42bde12c4f563
SHA1 082dcf340c3c097eac8ab8c66b665457d2c3911f
SHA512 94cfc1eafad38e65603fa8964a3898c0295b72f248de0b05caf4f87ec591171e207162f27b9be8a0a56ee62b40078218bbae9f6ccbda2044ba49cf212c89a53e
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7muXkeL2CRlY72iMt+BofrebeOYmxv:w4RywzYmqBml6I7r/7mgFuSiox6oI
TLSH
T187041932AA40945AF462C9BE7C78811E79253EB14EA19C5BF3817B4A29317D3B4F131F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 157KB
SHA256 8411299fc91ef7aa262835bf9e53c190cb272dce57e7253ab0b6700c079d34b9
MD5 60467c8cfa9f49cea5eef0d6ed44de44
SHA1 fadc15abde989dea186dc11aefb4dfd22ddef505
SHA512 76486fda3bd150e6937d677ac678a15e22f30db2b2251634f3a69b2575a1046257e7db801d28b57a2e19b439eb3bfc2aef40622f0d66e4f667774374d7105eca
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7muHkeL2CdVc2U8xJ:w4RywzYmqBml6I7r/7mwLJZ
TLSH
T1CAF3E732AA00941AF46289BE7878815E7D253FB14EA15C1BF3C5BB5A25316D3B4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 157KB
SHA256 361d16534f4ab817983b214152e8366385fe44691ff0f448b0f676cc14896287
MD5 10fac417aa0dbf9fdb204ed9e867039a
SHA1 f9c212bcf49cf371940f73ffedcf48d69d5e34e9
SHA512 4cb1e130c793a5b4ee02f76d2a4c83fbe1cba12fbf136079eed10280272cbb0cbc9dbdb64e714dff67f22d396f75d0eb2d06e00c3c3c1f691007df9a00fb9ef9
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7muHkeL2CZV1cU3xO:w4RywzYmqBml6I7r/7mwPe1
TLSH
T12DF3E732AA00941AF46289BE7878814E7D253FB14EA15C1BF3C5BB5A25716D3B4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 277KB
SHA256 9b27e3ac3e9c6a5358d418a6f6243d76515caa386c98b5f26eece6d908ccc270
MD5 f0127d2a46addbb83a96d10fc494d967
SHA1 31e22eb60d273569548802e082b2f5004a5e2b62
SHA512 43c7b5cda05e821f4980af55a79b2fc597a4d8babce7dfff0bea163265ebff95710eedae9cca0b74fceb998a10960e230b1bc66e6bb555ef3032dfc5e873c517
SSDEEP 6144:w4RywzYmqBml6I7r/7mr63psmeI+sQFqT3Qi:w4Ryed8I7r/7mrFXsf3z
TLSH
T1C2540A21E6444199F06E8579EB2585497A273D714BE1998BB3C0FA3E2B316D3BCF130B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 189KB
SHA256 fe3a16f9b5d50669387213447785c615bea66feac97d861ef362b5a8918b5d98
MD5 9235a89bec74e6bc0cfff71387f5ed3f
SHA1 9973239b562dc2282e988cd94205f8d0e61a2771
SHA512 7c567f4a86c4b34b86e69ad6f4aafeaf4088e5e46843d439c544673963a3d0e4903b181bf07a6b2a4b90e9db47f64144b2cd46547fa1648070fe8678675efe60
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7muakeL2C04WJgkt:w4RywzYmqBml6I7r/7mfKJJ
TLSH
T12F143B22BA40805AF06285BE7874860E7D257F714FA15C5BB7C5BB1A29326D3B4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 198KB
SHA256 ec3ea2793125c292cf6b7d9291ef1288e3abbbb0e016805cb42fdf424451beb5
MD5 e2229bf7dcb2b3ca71f31fd704309f15
SHA1 6c5991939bd6f6a530579ffafe2f7ebbf676d1ca
SHA512 d49a1e4db854ef4d596f0e3417a6fc41963b1e69ef0e7b2d04cc4cc92f26d67ce0723191b822dee78e7234a7dcd035c8c0147f3efbd1157cf14e5f99199612d0
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7muHkeL2CEkIvQnkraVTxoQG:w4RywzYmqBml6I7r/7mwIk3nkraVT8
TLSH
T18C143B21A64080AAF06785BE7835854E7C257E714FA15C5BB7C1BB5A2931AD3F4F230F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 194KB
SHA256 5067e7bee0686b0113b8fdbecc9997f2f5524f46d37a7c98961b726d20064ec1
MD5 cf0a658c84bf5ddb3010e003e441dce7
SHA1 96d0e6cafcdb77c09a9c82f192fcd50d6d80f1de
SHA512 094bc7abe2e365c480a60fd6bad5497fac79bef08e4abb8a497f21a5328e69191a73a3dcda0618c047ca01b63b8d8fd07e313518ce6a5ea0c01e532c13d6fd6a
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7muGkeL2Cupw5Z/KtbmmD22RQXSfj:w4RywzYmqBml6I7r/7mDqpw5ySuJQX0
TLSH
T1C3143B22BA40845AF06285FE7875814E7D257EB14FA15C5BB3C1BB4A29326D3B4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-03_f7e85a2624f879ceb8ffa98421a11851_cobalt-strike_elex_icedid_njrat_vidar~4.exe
Size 270KB
SHA256 f6db5b9217d190c6d8f16a95b67d2f26f1bff4ec79d95f00d3755f182cc8e5ca
MD5 4e61919354a60148cb77981ff58f5ef3
SHA1 74dc9d4189c09ee8079375d579b3a7ba6d561488
SHA512 852d5726b8f0df036ce75ef5b0a81981526b80a313b968a66aa615fd234be54ceed89f0e7d746e94549254afe988cb854374f5cdfb83516aed7ad849a930c626
SSDEEP 3072:NMZcwhYciHmqo3v7ro/2szqJ71rISTQt8UPDSzXZc22Pb2pEx39TBf/uyfWIEICI:uZcweFm37cxzmRHUPD65Mb289TBnXvks
TLSH
T14D449DA1B3A04CF4EDB7813EC8518916D6B27C5A06B0C74F13A836665F733611D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 133KB
SHA256 dad261ab45163b212d7b0a2b5b70652471cac87027eceb84f06e96a8cd552cae
MD5 62eafbeab46d5e3b3ffb8e845320f4de
SHA1 8a56d279c8c96ed9ec4a6c22d41ba01d83732f2f
SHA512 b57173d77bd4addfed633baaa02a47f973dcf277b65681b6bf25b4cce4d6a70ceca47298b622748beee9d2033ec88f8790ce0846932564453d4652dcacbe8829
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7muAkeL2d:w4RywzYmqBml6I7r/7mdO
TLSH
T10BD3B632AA00951AF46289BE7838815E79153FB14EA15C1BF3C1BB5A3571AD3B4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 133KB
SHA256 441ee7d8832f6f49c0b749b173db5873bdab99f30a50133ab315cbafca7480f8
MD5 46d661a864adabdd396de70f0772ed12
SHA1 d188ad32dc5c047b21e4d2bc7778fdd554f7a132
SHA512 090219682edbccb76e349931e57fdd13859556267dfff68352d807e8b5ce75120c263a29994a917e4a02aa2b24d07a5cd9b47a48729c07fb150b8a31d5f6d274
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7muGkeL2d:w4RywzYmqBml6I7r/7mDO
TLSH
T123D3B632AA00951AF46289BE7838815E79153FB14EA15C1BF3C1BB5A3571AD3B4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 133KB
SHA256 dc8c67a449bf80e8813d60f10285fa95b78586315c34165fdd4b341be6cb8b58
MD5 eef49847cbc7a88fa202ae8b0ec9cf11
SHA1 71e6d74695f0594d6559d4734d02f7fe3ae0b349
SHA512 4a8284ba93fc9b2b30be96cec423af750330455adab55e1758e79bb5262fc27c379f1e597f32fe3b186794fb7f69ed46c9777d7d553e48cef6d3da5990dfa0bf
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7muakeL2d:w4RywzYmqBml6I7r/7mfO
TLSH
T1D0D3B632AA00951AF46289BE7838815E79153FB14EA15C1BF3C1BB5A3571AD3B4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 133KB
SHA256 a8d5b17e13ed5ba04a54116adc76634435e8ca96d5da31a72b763efcfae5a378
MD5 939bea0d161dc1cbe8510c1c6da51d85
SHA1 65d49dabe61d43b685d8d949da955f2ab8731c63
SHA512 48e953c3a77c58bc5887c7053e783dd33df400558387d24193b3606f3f7d01d9084e35707f6cc9a8bf978e6ddd4b48c6402ee19a5ad0db493812758085ed36be
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7muHkeL2d:w4RywzYmqBml6I7r/7mwO
TLSH
T167D3B532AA00951AF06289BE7838855E79153FB14EA15C1BF3C1BB5A3571AD3B4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 133KB
SHA256 0abbeeb0754aa9079e2d152b8691767740a7716b5b218d3ed6affbf6540e90c7
MD5 2860efb186be69eac994477799d4a5c0
SHA1 5906d2b7ccf829065abd45601da9ed7937746cac
SHA512 80cd05d4524a66bff1ac1d672eaa44b92ed9f93cf1768c2935b5cdc9ad1e033a83448813e496e36631f27d7b07e2c4a9f4f5aa84e847fd0a24f8722530c79fea
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7muGkeL2d:w4RywzYmqBml6I7r/7mDO
TLSH
T12FD3B632AA00951AF46289BE7838815E79153FB14EA15C1BF3C1BB5A3571AD3B4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 133KB
SHA256 a6802a7b2cc894a4f397c97c59cd4d7236d989b429f55352c9ac20d541e7eb76
MD5 ae76fb4ac091a158a942239bdf6a5d69
SHA1 698531fed0e8b4a8a7f92ff540f7ab804b2ac260
SHA512 e7770329e5501cd6f84dcc9b024129dd375a6dacdd783966e4295adf5e07fe33e93774dc153edbc6a004df4acb35000d3687908117a22a775ea6061e2bf62f8a
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7muXkeL2d:w4RywzYmqBml6I7r/7mgO
TLSH
T1E2D3B532AA00951AF06289BE7838855E79153FB14EA15C1BF3C1BB5A3571AD3B4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 133KB
SHA256 927d488d5dfb92c4ceff1c382b6263fe505bb86eb1e351c7b17e75b62667f52c
MD5 5e8ad7ef5c0847467d0fcea32745decc
SHA1 750a750dbd7600487a7f6d6773b97cc2099900ed
SHA512 1b9793349576ead44ee56f177eb17ee8fd96e561ede492b43d582f89d98823ede28cfba88986f39151566ed9c291be88a1b4399eeec612d3699f4b8f43180f3a
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7mu+keL2d:w4RywzYmqBml6I7r/7mrO
TLSH
T17FD3B632AA00951AF46289BE7838815E79153FB14EA15C1BF3C1BB5A3571AD3B4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 133KB
SHA256 407133bb2bb7e9c55d3b3b8524226e20eaf50cb601d1785feb48b4f0a2b0acd6
MD5 6bde17b0b86b49fa60b9db62474129bd
SHA1 deeae3ecd088c2789d62580f6d1858e7e701f370
SHA512 b3c1601c6f96f156ee8b85a717b52b9e082be0cf95fdc69a1c54580487e5df53f0c02ce2195130023077c943a3d5028eca10f720348ace102106dade9143a83c
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7mu/keL2d:w4RywzYmqBml6I7r/7mYO
TLSH
T17ED3B532AA00951AF06289BE7838855E79153FB14EA15C1BF3C1BB5A3571AD3B4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 133KB
SHA256 e4693ee00cccc4cc7a63e6ea412ee6620fc2b5142456276e0a91ec7442bff0ab
MD5 e9dbf68c80c8f30c4a9baceab2c1dc4a
SHA1 f1b2f4c3a7e904f5e6b2e9cf1e3d1c48daff2d62
SHA512 0486c5cc840e8560ed066c0ebe29f30515d9a8014e090e722219d2211e5c7533cbd1a650a431037303edb397951fcc41959083ce211e5e63975cc595c81a2f94
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7mu+keL2d:w4RywzYmqBml6I7r/7mrO
TLSH
T182D3B632AA00951AF46289BE7838815E79153FB14EA15C1BF3C1BB5A3571AD3B4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 133KB
SHA256 cc8c4406cad8f02cc34514038f7780404d179f0cc99dae3c454956241ca6dbcd
MD5 36d879d38c0261fca832a977f539e9cf
SHA1 827dc85cc40bac88f7e3e36a41b6b62844ae2739
SHA512 2ea3ef4ba6d929a75ad2a5a5c46c81858f5b83a452e9bccc7e2f5102f37db20b823efd1d7856df2dde2279a51e0c2dcfc88aa6cc0dc46fcfbee1958b75b4b92f
SSDEEP 3072:w4M+ywzoBrKolmIIRWB7MPVl6r87r/7muTkeL2d:w4RywzYmqBml6I7r/7msO
TLSH
T177D3B632AA00951AF46289BE7838815E79153FB14EA15C1BF3C1BB5A3571AD3B4F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4644-45-0x0000026006270000-0x00000260064E0000-memory.dmp

Download

memory/4644-33-0x0000026006270000-0x00000260064E0000-memory.dmp

Download

memory/4644-43-0x0000026006250000-0x0000026006251000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads