c2613bcf7811ba59b182245bb596d7c1c2c1d0db22a464b6df28644c67611019

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 330KB
Sample261003-3sdpmszale
SHA256 c2613bcf7811ba59b182245bb596d7c1c2c1d0db22a464b6df28644c67611019
MD5 f1261632c158f8997c894c87dfbb10a1
SHA1 1f74e3a15a43ffb93ca472fc2ebd20f75e3f45a0
SHA512 ef8239e7adf2c68d42d0c3ca04686d1db569464259fc2c09fa72233326de3d10e9b3a870f4cb171574ddb639d15e5ed58c4fbbf441acd3b56d90fa5c76d70285
SSDEEP 6144:VXmRmNUETEzAVQiI+WjFDfoY9+6s6Be/ODsTnJzQlnuGQI:UuUETEcQiHmNJLBIuntH
TLSH
T1C9744929739C3BF9DCE68178CDADB112ED317C210B64D5DB23A46A291E332D06A3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 3 IoCs

pid	Process
4304	Logo1_.exe
2400	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4768	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
	\??\F:\	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXE1FF.tmp	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.Exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\RCXDF3B.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe.Exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\RCXE1CD.tmp	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.Exe	Logo1_.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Logo1_.exe	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5728	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe
4304	Logo1_.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5420 wrote to memory of 3068	5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 3068 wrote to memory of 4944	3068	net.exe	91
PID 5420 wrote to memory of 5728	5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	92
PID 5420 wrote to memory of 4304	5420	2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 4304 wrote to memory of 2636	4304	Logo1_.exe	95
PID 2636 wrote to memory of 2952	2636	net.exe	97
PID 5728 wrote to memory of 2400	5728	cmd.exe	98
PID 4304 wrote to memory of 4004	4304	Logo1_.exe	101
PID 4004 wrote to memory of 4148	4004	net.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5420
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4472.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5728
- - C:\Users\Admin\AppData\Local\Temp\2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    3⤵
    - Executes dropped EXE
    PID:2400
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2952
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4148

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXDE77.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXDE77.tmp
Size 77KB
SHA256 aec4ea56e5466aba033ad11e81431ba1009dc158c54e247220bb76b857425f5e
MD5 aac2e5197e226611a040965b6a437ae1
SHA1 aa56f8d1d895b2d32970a3871d3f450b56a60c6c
SHA512 25501cf9f004a61331a56c0d6b44ed5a64fa8d4b22e134274a5bd69f8611a58feb7b37a419fdb43acf3d42d80f75289116938008963e6f27db4753ac52214fd2
SSDEEP 1536:a7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxp:TCSjGoLpWM6bblmjxp
TLSH
T1C873D656B18CB3B6D0E299BC8E0FF2E5BC257E201E1D589FB69A2F0DDE7A0C1550C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXDF0B.tmp

Path C:\Program Files (x86)\Google\Update\RCXDF0B.tmp
Size 74KB
SHA256 0ef70d9f9844c05befce9ce0acefb290e515210563a75ea87e8c0fc46a5ad9c5
MD5 d2bc3f2b0de5f779d601d2406e80e873
SHA1 198b0e27ab813c9b89a50309e6ef8cc51227fffb
SHA512 7f411fe02da8c81738959e23e1ef7a5c1a48b295078371cb2c3b8578cd37a1a029a362251223a1f39a4740937374b653c438d42857f7dc410b2648c04d3a5388
SSDEEP 1536:m7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxv:3CSjGoLpWM6bblmjxv
TLSH
T15C732A69B28DB376D0F299B88E0DF2E5BC287E301E19185FB69E1F0DDA771C1150C195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE079.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCXE079.tmp
Size 86KB
SHA256 b5f2b64dbc7c862e65985ef33bbad2a24a68733cf711dc8bc6e8143480ec2589
MD5 5c83ff872189979ad56e625626cd1953
SHA1 faa30d341db0115890ec2e8c668a6c5912b542d6
SHA512 9fa229b3904943584e3b545dce0ec4af47a7b1c357a0be735a7f335293f31cf42a717cab0b598314f97fb321f1f73dfd2c830c3761d7971ceb3e4f736a736b6d
SSDEEP 1536:67qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxS1XkSPsULMHiP:zCSjGoLpWM6bblmjxSdtPlLqS
TLSH
T179834969B28DF372D0F299BC8E0DF2E5BC287D301E19186FB69E1F0D9A765C2150C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXDFA9.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXDFA9.tmp
Size 101KB
SHA256 ce13e12c77f751810fcb2b1aca503076446dfd5238f251a869bd1fe7fa94f1db
MD5 45e080a00c1850e934c88c61e3ebf14a
SHA1 e4c75b7c5754ef98902980bb2a82d10f3d6b97c8
SHA512 c403c3e6ef92c80de66b822a38bc11ada6cdad76e89e0da278f11ce3cdab99379bcac53e9a2840dffec2e9d3ae33ced60f0cb911728d6fcf6473b970c8a597ba
SSDEEP 1536:C7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxh4GZjzQwK5WW7VCn6Kye:7CSjGoLpWM6bblmjxPe5BV0f
TLSH
T1D5A38C65B68CF377C0E299B88E0CF2E5BD697E301E29085FB59A2F0DCA7B5C1550C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD1AF.tmp

Path C:\Program Files\7-Zip\RCXD1AF.tmp
Size 74KB
SHA256 dcd036e0551af131c1a431e0dd11fcf14517e895ceb8001784be3f260e0fa7fe
MD5 65d4b37f47d978d9cc6dd6e0c2d93680
SHA1 b23a94d4eae42c4af9920ed694ac4f93d7d48ef3
SHA512 8ee2858aae138057c66e0d2d03e2c7b47488b275995bd97d065519cbf9af2e47758103763889324d210f513dfd1ce6608d555432d2ea633b75d57b4d6ad3df55
SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx5:DCSjGoLpWM6bblmjx5
TLSH
T185730869B28DF376D0F299B88E0CF2E5BC287E301E19185FB69E2F0DDA761C1150C195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe.Exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe.Exe
Size 3.1MB
SHA256 0074c6eb1e8d56a909a8fc4763963365572f8bf34dc8d0c6332a159879bada3f
MD5 3ec5a4afb121646668f2bfc6140e8550
SHA1 7ec5d12c1f17aa0e7d40ee3d33c5d7b5627c723d
SHA512 30f17132feb0286aaa203176996c588e704cadb1629d5d7529802b113a8c849471bba1cbcca0a7a50aca08e93fad47a94a8a48d0677fc764cc461a29c8411855
SSDEEP 49152:fyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AX:Om7vj1BDlZG
TLSH
T14EE58C13F29D62D8D0D9C078874EB232EE62BC454B2166DF0690BB562F77AE06B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe.Exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe.Exe
Size 360KB
SHA256 ba1d89d2285d2e823188dc6acde4043dd66c1d3ca6ff9a97936104c5390ba126
MD5 02940ee42daeb48de6920abf84e1c0fc
SHA1 bc4e9e5a1245bb52ebbf0ea6cd10fa4df73b4929
SHA512 c00d66db927fdc29b647353de22ab03dc51c38a4c16138ae400a46c57bd266b68c26a37a119048223d3bdc25db532c92723a6618f2bbef752647bf9d7e7448f5
SSDEEP 6144:1XmRm8AHdwS/WYoTOLHIsPPzAdnz0YutYPDvhI:0TCd9/WYoaLHF3z0z04PDvhI
TLSH
T1D3748C94B29C3BF4D8E385398D1DB556EEB27C250B20C65F23A8371A5F332911C2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD67B.tmp

Path C:\Program Files\Microsoft Office 15\ClientX64\RCXD67B.tmp
Size 139KB
SHA256 efa06c84802a1016eb63f0dd23f07227f30a949404df70bce2b9e5b1ff014d8a
MD5 6ddc78488c6e46e284d8da4fe2a89e4d
SHA1 90023c2066eb478445aeb65a27bd9cdf56f43b22
SHA512 dbf46ec599f3c2560637b1d313a4c9f5b74783022f3a23ecab44a29644042d4e20d507483b355a820398476eee20742d499c26ad7edcd33538a0a7cfeea81aae
SSDEEP 1536:v7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxPng:+CSjGoLpWM6bblmjxPg
TLSH
T1B0D382B5B25CB776D0E199B84E1CF1E1AC5D3E202E2BCC6A755A3F0DBB761C11A0818D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD64A.tmp

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXD64A.tmp
Size 74KB
SHA256 ccc79dc15326c8d4da7c1c61494a000a8fc38993e66d6b29495ae7a993776db1
MD5 145b3f13c20dd955b704dfe2c456c5ee
SHA1 f95d853041c702ac2061ba4cdeae4a980dd34029
SHA512 200bb8f9f42d12c22c1baddb13db874a3723c5b9e4d17c26f11a9be29bac0cfee0ae2717ff625266a23229e7960c1b866cf4bce44c30c1def5a9e27277be3ffc
SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxR:DCSjGoLpWM6bblmjxR
TLSH
T1FA731865B18CB376C0E299B8CE0DF2E5BC257E701E2918AFB6AE3F1DDA761C1150C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD700.tmp

Path C:\Program Files\VideoLAN\VLC\RCXD700.tmp
Size 75KB
SHA256 4e862b8df29eb77708b3687fbb69ae489dbdce2b8f1271e5e959a7c4d86cbd5c
MD5 03ae4236a70070976341ba51dd6688bf
SHA1 bc796553fdde93aed3c426b9d7c759f37ff45d14
SHA512 d5526119f0ba8ce839fae1c66813422b5eff7327c4780e9ede7caf8f73cfe592acf00e5aa986e955b12b8c6906df560de6355ebed9c50e415c5b0d958cb41de1
SSDEEP 1536:W7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxQ:HCSjGoLpWM6bblmjxQ
TLSH
T172730865B28CB376D0EE99BC9E0CF2E5BC247E301E19185BB59E2F0DDA7A1C1550C18E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe.Exe

Path C:\Program Files\dotnet\dotnet.exe.Exe
Size 219KB
SHA256 80078d5c9827e9305cffff28fd8084b471b5440373ee67c91b5a99b24df29a65
MD5 d034aee707f1d2146614d38439997161
SHA1 96df17e50a72322fcca1eb513f36049150ad4821
SHA512 7469fefb9df2f8da60d3a883879b7d251b31189cfa39734551fc053a5ad3939bc1e1c62152c5589a7b54cd3544b0c0943d11fd14fa669ad1750a04cb663ef168
SSDEEP 3072:jCSjGoLpWM6bblmjxD9vJ9psmeIBcV8pQFq4XKF3QP6:5XmRmX3psmeI+sQFqT3Qi
TLSH
T13C24C319E29C73B5C0EE5178CB1DB681BE273C214BE1928B62D4FA3D1F762805DE9643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a4472.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4472.bat
Size 902B
SHA256 e676c3ca2176e8181d88d5854b32abb8170a94fe6fc6f3b5f886a3f8c49ecb91
MD5 31521ddb7c79085d567ce100a73b293f
SHA1 1dd3ab8590fd6a63392ac972077c31bd81f435ef
SHA512 fba178ae8227f2d6ba3b787a300d3c7b1d510d2421cb9c97995a7bbaf4cf6156ae68fc6a6e200fea22f43334108da410a1fc780c0db48fe61cd4aa75d99f6e23
TLSH
T1B511E325C6EAE6AC4028A8630D955E9DC0D126AD2F583376EB29C11F50C4E0FFC51B63
MD5 SHA1 SHA512 TLSH

Submit Download

2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-03_f1261632c158f8997c894c87dfbb10a1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 241KB
SHA256 99beeac093d4060251380f2689671981a370a0481e4e48559ca45eea76695468
MD5 dfa938a9b286fb9e80531038da0bfe4b
SHA1 35aee7aefe505846bad4f6561638ed161f4530b9
SHA512 a81ca0afb6e1ec436ee53448be42862e3714db4b8422b0846b0badeaed839ea6e89c8460aebb1947b8fb114dbd454b3b980782efb58a717ba8838ab3d555dda7
SSDEEP 6144:izAVQiI+WjFDfoY9+6s6Be/ODsTnJzQlnuGQI:icQiHmNJLBIuntH
TLSH
T1AF346B7DB79009F9EC6B813CCDA28516E67278560360E6DF13A486261F733D06E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 89KB
SHA256 c905e0ee195966f515d9c98dfd43181f792c650a27ef61057c587a616220b63b
MD5 b831f284b4ea8b379514862c9d5a1a93
SHA1 67ff410c01103514f59fc165843ba7179521043e
SHA512 1242751f092c5347702a574216dcf2c72b3afe5ebc3626afc8af5bce22e777802937ab3d96f56de6656fc4dba7ed6f5f7480d68884b495787d1567c27629c265
SSDEEP 1536:u7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx5qkSZZZ3bQNRwW:/CSjGoLpWM6bblmjx7UENRt
TLSH
T10E933915B68CB3B2D0F289B85E0DF3E5BD257E301E69185BB3AA3F0E9A771C2150C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4304-21-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/4304-1388-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/4304-1525-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/4768-19-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/5420-11-0x0000000000400000-0x0000000000427000-memory.dmp

Download