shodi | b25594697a737fdab2936f761dd0ae0dc6dfb778865ef2f380f4feabf2bd6d62

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
Size 574KB
Sample261003-vtsaesvvht
SHA256 b25594697a737fdab2936f761dd0ae0dc6dfb778865ef2f380f4feabf2bd6d62
MD5 10fa47befd8a8ab5ac765a2a04e54b9f
SHA1 3d692070d5846e23f5e07f89182929329303cd86
SHA512 55c25d72575711cfbc062ed365b9237671d90db880c3d3741b4f4b3cdd2ba05d3894d1e602be293d51ee516ee8a2f71bc7980336161c85fffce8fa8163db8afb
SSDEEP 6144:AUR+oGB3Pa84wCjhOrpBGAO/cAYmQVsMzAVQiI+WjFDfoY9+6s6Be/ODsTnJyQlq:TYixUrHGQV1cQiHmNJLB9unmP
TLSH
T164C49D2AB79500F8EC66C138CA5A9536FA7278660731AADF139096312F737D06F3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery shodi spyware stealer worm

Malware Config

Signatures

Family: Shodi
Shodi is a Windows worm written in C++.
worm shodi

Detects Shodi worm 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000245b5-6.dat	family_shodi

Executes dropped EXE 1 IoCs

pid	Process
3732	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.usa

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 19 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\q:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\i:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\l:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\t:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\u:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\e:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\g:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\m:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\n:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\o:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\s:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\f:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\h:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\j:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\k:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\r:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\v:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\d:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
\??\p:\	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\UsaShohdi.asu	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UsaShohdi.asu	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Mozilla Firefox\updater.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\jconsole.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\ssvagent.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\PPTICO.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\chrome.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\msotd.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\7-Zip\Uninstall.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\misc.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Mozilla Firefox\firefox.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\uninstall\helper.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.usa	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 3732	3672	2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Users\Admin\AppData\Local\Temp\2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.usa
  C:\Users\Admin\AppData\Local\Temp\2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.usa
  2⤵
  - Executes dropped EXE
  PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.usa

Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_10fa47befd8a8ab5ac765a2a04e54b9f_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.usa
Size 241KB
SHA256 66adbdbd251a5b9c37bc1448952e56e99c3b4ab7893aebdac0662ed987f24781
MD5 3052548c3fba7473d5a4eecf2c59c3ec
SHA1 eaefaeb0b0b24f7ea2c706a06cbf081aafad7c72
SHA512 570e9186096568b85fc94194264f874d9dc55249f6ef6c00031eec8924bd8977549cef57d8657b9d84c01fbec9335608f14c9c6677573c11e9d33deb8bb8b545
SSDEEP 6144:fzAVQiI+WjFDfoY9+6s6Be/ODsTnJyQlnutM:fcQiHmNJLB9unmM
TLSH
T139346B7DB39409F9EC6B813CCDA28516E67278560360E6DF13A486261F733D06E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UsaShohdi.asu

Path C:\Windows\SysWOW64\UsaShohdi.asu
Size 574KB
SHA256 97ba284f0fd1991f8c7e09082a3dd60c3f074f4e8d27a51ed656349b2612c3f9
MD5 f95bc28a19ba903a313e7e163ce30493
SHA1 67193f1948b3ff407ae646667c85c63efca3ea9e
SHA512 46165995a7ab300b78f5489750a6a04c47a83249b3bb326612afbeb0dccc3d39bcc74e193b7ea3b29795f2f18d3546338f928ab6e2e846c66b58b7384fe23619
SSDEEP 6144:AUj+oGB3Pa84wCjhOrpBGAO/cAYmQVsMzAVQiI+WjFDfoY9+6s6Be/ODsTnJyQlq:BYixUrHGQV1cQiHmNJLB9unmP
TLSH
T1EEC48D2AB79504F8DC66C178CA5A9532FA72785A0330AADF13909A312F737D06F3DB15
MD5 SHA1 SHA512 SSDEEP TLSH