7a9eca8e02a15882ffde9a458387025fd4ff270e4b7cb56447daafc661052f48

Analysis

max time kernel
89s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 1.7MB
Sample261014-c6crdseb95
SHA256 7a9eca8e02a15882ffde9a458387025fd4ff270e4b7cb56447daafc661052f48
MD5 e88eb4aa1db802d6d26f5adce2d1d0ff
SHA1 caec3f2bf06aeabe549099ba57773ce491623e78
SHA512 73d7de37a48f4f7cf39a3771b74057b041448e8afba0aac6355bc6a0448c6ce9d136280dd3c0bf5d28abbcd0fe89d8c112abb36f574e82d4c0fb75173b031a31
SSDEEP 24576:A3mnXoZjzyacNVEuzyUD5TvinrmycNkZe0p4Ek4niOkl/A04szE87JKTvm:A3kMuX56rDeW4SkZP4sz9Mb
TLSH
T1C1853A16F2784B62D07BC079C5D66A5AFA333C455F308BCB03459B283E276D19A3A736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 9 IoCs

resource	yara_rule
behavioral2/memory/5516-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5e1-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5e2-10.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d000000000433-100.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5516-161-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1268-162-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-432.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bb19-430.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x002f000000019cc9-1260.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5e1-5.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c5e2-10.dat	aspack_v212_v242
behavioral2/files/0x000d000000000433-100.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-432.dat	aspack_v212_v242
behavioral2/files/0x000400000001bb19-430.dat	aspack_v212_v242
behavioral2/files/0x002f000000019cc9-1260.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1268	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$$	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{0AF901DF-08D6-4B70-B8A5-E1B085E881A8}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5516	2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
1268	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_e88eb4aa1db802d6d26f5adce2d1d0ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5516

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.7MB
SHA256 7a9eca8e02a15882ffde9a458387025fd4ff270e4b7cb56447daafc661052f48
MD5 e88eb4aa1db802d6d26f5adce2d1d0ff
SHA1 caec3f2bf06aeabe549099ba57773ce491623e78
SHA512 73d7de37a48f4f7cf39a3771b74057b041448e8afba0aac6355bc6a0448c6ce9d136280dd3c0bf5d28abbcd0fe89d8c112abb36f574e82d4c0fb75173b031a31
SSDEEP 24576:A3mnXoZjzyacNVEuzyUD5TvinrmycNkZe0p4Ek4niOkl/A04szE87JKTvm:A3kMuX56rDeW4SkZP4sz9Mb
TLSH
T1C1853A16F2784B62D07BC079C5D66A5AFA333C455F308BCB03459B283E276D19A3A736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.3MB
SHA256 1d7f87e7ef7d98478ea49191e7d137c966e5952d2a9450bcfba3a92074cef05f
MD5 eb282d2cb204c6f129cdcbf503ff5598
SHA1 a7d4072bd62b44d13eda3054e420da90d19f0326
SHA512 dfc8f55769967fe6fe8fad80474214017a19fb48b90891b23b34a3efdaa0a5a02693175b469ec56620b8fce7edcf52f002e88d69552ae9b91a64b655eb619bf8
SSDEEP 24576:A3mnXoZjzyacNVEuzyUD5TvinrmycNkZe0p4Ek4niOkl/A04szE87JKTvmy0Le5b:A3kMuX56rDeW4SkZP4sz9MbBPji0Aj
TLSH
T192B53A16F6784762D077C0B9C5D26A5AFA3238465F308BCB03459B283F277D58A3A736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 1.7MB
SHA256 d3561fbc46e30cfee4ee4640eccd6541afea75838caf9cee580faee5f0e32465
MD5 9bed2d0362e2aad4408b79b8ac38be02
SHA1 d1a08652dc71b8f6d038cc98ac1f89c3d7f864fa
SHA512 f0f56f033add02b6d0b1f22dd604b1e5dfbc056a51d09c5343f530582b789ea6a0f1397db300acdad918c9b583ac7208fa28ae2f3e44dd802bc6e782163b79e4
SSDEEP 24576:A3mnXoZjzyacNVEuzyUD5TvinrmycNkZe0p4Ek4niOkl/A04szE87JKTvmYQ:A3kMuX56rDeW4SkZP4sz9MbI
TLSH
T1BD853A16F2784B62D07BC079C5D66A5AFA333C455F308BCB03459B283E277D19A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe$

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe$
Size 1.7MB
SHA256 7cd60f02e63dac60d4ba92b0c90c1d0e38160d2fa28efb8612944d64f18bc77e
MD5 09563775be166768c1c5579d600512ab
SHA1 5f294c5edcf4bbf580db120e883787c415e55872
SHA512 7cef10df933a15023665875614f1de97074738a91798d17c59072b1fb8e4ea7a537c886239934023c73953747e7e0175d79d7eed73dd53b4313eeaca6f6fa112
SSDEEP 24576:A3mnXoZjzyacNVEuzyUD5TvinrmycNkZe0p4Ek4niOkl/A04szE87JKTvmA+:A3kMuX56rDeW4SkZP4sz9MbI
TLSH
T195853A16F2784B62D07BC079C5D66A56FA333C465F308BCB03459B283E277D19A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe$

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
Size 1.8MB
SHA256 d5c7b1ccfecc7e60cc160f5f4510c2c05074d61a03e1917b97aeb5b2afe092cd
MD5 51937781d10b14f2c78e8c0306498345
SHA1 f92bcc469470e55e89728727168e8708d394985e
SHA512 444b2304ad77c1aded65e94bab8d5e07ed2b6adf54e40f5a2e05ec52939a101bc7803570e89a76f75721767d7c6a8c2ed23783d7b5b8b101a6920c0422acfdd7
SSDEEP 24576:A3mnXoZjzyacNVEuzyUD5TvinrmycNkZe0p4Ek4niOkl/A04szE87JKTvmwF:A3kMuX56rDeW4SkZP4sz9Mbj
TLSH
T14C952916F2B84B62D0BBC075C9D66A55FA333C451F308BDB0245BB283E376D19A39726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe$

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$
Size 1.8MB
SHA256 2b5e0bb157f259d50bc40a682aacc2565d19bf883b83f861e83d7504b13dcb34
MD5 3803da05dbcc63cfbc8a2a75fba65328
SHA1 d79577564b8fbd6b5f3d69df9d485ab0f8aa203f
SHA512 0a44866ab8caee0ab9ff471b0a250459ac3ed6fc946a75ff2ebabe2c76b4bcdefd0101a6d6e9f88728dec24d47c3c39a82d158674d80a658ea49611171b45c52
SSDEEP 24576:A3mnXoZjzyacNVEuzyUD5TvinrmycNkZe0p4Ek4niOkl/A04szE87JKTvm7jv:A3kMuX56rDeW4SkZP4sz9MbgD
TLSH
T1CC854A16F2784B62D07BC079C5D66A56FA333C465F308BCB03459B283E277D19A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1268-162-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5516-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5516-161-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads