1c931cf17eee9316ab89edffbfdbae8998a0a98d869a90009a00406472e3af4a

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 4.4MB
Sample261018-sqlmcsfx6v
SHA256 1c931cf17eee9316ab89edffbfdbae8998a0a98d869a90009a00406472e3af4a
MD5 42db7e6cd5960ce54d29ed49989f09b3
SHA1 0c285c1c3973922a71902278cf14a5b6f47540ae
SHA512 00513ae86246c7682ac130e3b731b568038fc33d1457880bb54e486f7a2ac5e5111c08f0b884e145c3ed9d2c412c1559594a4b6aa3052f5ef85340a7769f9390
SSDEEP 49152:F/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:GWQtZ/K0tGOFWVRuLftCT
TLSH
T145264A03F2ED52A9E0AAD178DF39A2219F727C598BF165DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (256) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 2 IoCs

pid	Process
3908	Logo1_.exe
1516	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe.Exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\RCX3E0C.tmp	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX3B30.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCX4E1D.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\RCX4BF4.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX3BCE.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCX3F81.tmp	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX464A.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe.Exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Logo1_.exe	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1388	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe
3908	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 436	2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	86
PID 436 wrote to memory of 4576	436	net.exe	88
PID 2132 wrote to memory of 1388	2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	92
PID 2132 wrote to memory of 3908	2132	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	93
PID 3908 wrote to memory of 4208	3908	Logo1_.exe	95
PID 4208 wrote to memory of 3460	4208	net.exe	97
PID 3908 wrote to memory of 4336	3908	Logo1_.exe	100
PID 4336 wrote to memory of 3992	4336	net.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACF4.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1388
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3460
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3992

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe.Exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe.Exe
Size 2.8MB
SHA256 9d4459f5ee85f8779ad93948bb65288b2bdce8ff7f9c004e880a7943d04489fd
MD5 17161db29a92e6f2af8f101a1adf9827
SHA1 8c2d2d7e9c108bfb75daabc898e0614519cc7427
SHA512 242d7156a8758918404245eb44929bc95b54eba78e930032726a9687020b2a2ea2b25e7d0373209c0a46bb8468695ec2f612f152d3a1d7af653730cdc2827291
SSDEEP 49152:6TfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJS:6TfiG/nzU90m
TLSH
T1B2D56F1A52C8D2EBE5A42170CC5DBBF904442DB8AB92CEE7BD447E06B5307D2953393E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX494C.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX494C.tmp
Size 95KB
SHA256 360f4404145991217d81937241803db905191e890c83269e939d605a81172bd2
MD5 90ff3e74ff52a271b4b692a2047d3625
SHA1 5251ac95c004b24c2e0e5def4d6a6e5eaf30b275
SHA512 562c6f87bcccaaada3f203838ed8f7187f040e16cf663480640668610353d0e602b00a4bb83f1068ef73cb3129260e5b4f1fd0bc9b73536b65052cfd8f8bf51d
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxnZ2HQuhtjRQXtNz:oCSjGoLpWM6VbBVjxnZ2wuhttQ9Z
TLSH
T1D8933A5AB28CB376D0E259BC8E0FF2E1BD353E201E1D189FB6992F0DEE761C15518186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disabledupdater.exe.Exe

Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe.Exe
Size 5.8MB
SHA256 e59980bca3e574dc941edc8772bc68a4151f31c4a4b5018ac775027da2263620
MD5 3b9ddaf3514845c0abd9f8fa5e940be8
SHA1 5fe78212bb42da0d6352ab59f4fed2d96d9ba5d8
SHA512 7f5e4de612aac55d5df70795b62212009e05bc1c9f29fec3248442eec7bc9d83b05f491a0bdd21f0ee244326c21d2afcf188c450bfcaa6fc3f3fc31b980cce3f
SSDEEP 98304:Rog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7ws:Rog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb
TLSH
T14D567B23A4E46130E5F332756D2CA7395D327FA29F3145CB86906C946FB82D3293936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX4DFD.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCX4DFD.tmp
Size 104KB
SHA256 2281ee5b674e35fb5f0135947fc386816ae1b8763024124b0e0ee92fb16543ed
MD5 1f10b4d2f7192916a73df42ba59262be
SHA1 6aea36cc1d957284ee5943aa006dad5fdf8ad2d9
SHA512 a53a7b03f7f442dcbc9c3fec69db5df226c64f6d452fb546159fcd104b412b8f0f0bf90fd0a16950717fd69bbd97acde144de7319c77385b4ca4dea96be5ce04
SSDEEP 3072:ACSjGoLpWM6VbBVjxiZ2wuhttQcdtPlLqO+:2Xq1Vh9RLq
TLSH
T1FAA37C6AB28DF376D0E29ABC8E0DF2E47D257E300F19185BB69E1F0D9A775C1190C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe.Exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.Exe
Size 4.0MB
SHA256 aa8fcb25ae531e5d5be9e6b077dee4c53d558deadde6de53245bab2bd8e2dbb6
MD5 1caa35edb4c803ef16bc573b512fc924
SHA1 6c620a5068043180575758c84ef4c1f0ac74b113
SHA512 380f2575533fcf1da795a3a48c44e3828a461e4599063a697e9662c73be8d51d55399cdf37f66c155c0c051717bb4a54c158f6f3f5e1e8f4b84676590c8ef70d
SSDEEP 49152:zudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:xijnUdYd+RaAj
TLSH
T1AC164903B29D62D4D089C074CE5AA232AF617C8947F161EF3690B7DA2A73AD47B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX3BFE.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCX3BFE.tmp
Size 93KB
SHA256 f02fe1c9a291335b1661d0d3b6192b090d08f6a70b44e51137f0110841963687
MD5 76dfc017cf7475e6ba74d5534154b60e
SHA1 4e783328007782898780450a273c2e0dda5d3526
SHA512 c5740ee72e17d324652c242d10709c49ba090d4e87b0f82c874650cb6ce2dd9f361e4a6bc6d3ce6859ebc6dc2806e0ac78750529f2bb2a22f59f0322617a5ded
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxXZ2HQuhtjRQX7N7:YCSjGoLpWM6VbBVjxXZ2wuhttQrh
TLSH
T137934B6AB28DB376C0E259B88E0DF2E0BD397E301E19185BB59E3F1D9E771C1190C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX3EFE.tmp

Path C:\Program Files\Microsoft Office 15\ClientX64\RCX3EFE.tmp
Size 157KB
SHA256 f554856bcd57db5bf493f54d47d21644bf565ef1076df4727733e0e72c421339
MD5 a72f78eee5bb8db9b7f83f9f078673ea
SHA1 1211f8d4a79c1c3af7a88fba2cb1868de6fd71f3
SHA512 33a4a99ea02dbe997cd798db2ec993279b69894dec756651a00327bb93452d7716e4e0d8b6daccd6e8eda67ab646e246073b1499a3917f875e2c09f6282e27a6
SSDEEP 1536:o7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxYZ2HQuhtjRQXPn5Nj:5CSjGoLpWM6VbBVjxYZ2wuhttQf5J
TLSH
T157F3A376725CB776E0E199B84E0DF1E0AD2D7E201E2BCC6A755A3F0DBB761C11A0818D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX3ECD.tmp

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX3ECD.tmp
Size 92KB
SHA256 af849ff678b5f93995f76949bde9bb71c029941843f59ee54ccedcc2290f0fe2
MD5 f69ab8725faae421404c96f21949ff86
SHA1 fb5334d7a5d4a386c17a7eb38929a8f09b7776d0
SHA512 3c1c15bcd294633b1feb1abb78196fa935c4a288d63fdfd5db613671f3036710c339785a8030631b4a3f997e18e44f86c7f446b635f2d424d3206ac5c8bdd11e
SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjx3Z2HQuhtjRQXcN7:4CSjGoLpWM6VbBVjx3Z2wuhttQMh
TLSH
T1C4935B5AB28DB376D0E259B8CE0DF2E07D297E701E1918ABB69D3F1DDE761C1090C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice_installer.exe.Exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.Exe
Size 285KB
SHA256 cbc0afaf72bcdd094d423a5996cfb547fdec1896ab78384f70d4eceb4e0dc7c1
MD5 a989deec5612e34af28a2ccd2aae21f7
SHA1 4165148d6cf80c3095bcff9cb74e420e47aa18fd
SHA512 791f80b9eedd3b25783b1a8e1bfd3e76a70a18611749419abcca29f407a6114f2bb332d0b5e02ff59e44e3ababd1f820bd564c713a6f814153b70996b7bb4e26
SSDEEP 6144:WXq1Vc9vUTT4DtOUjD5FGv9oU5DOY7y4j9KA:cvUTTDUjD5F69oU5DO69KA
TLSH
T1A7547C02B79CBBB2E4F20A306C7EF7656E31BC211E908A4B7395770DDD72381592935A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX3F92.tmp

Path C:\Program Files\VideoLAN\VLC\RCX3F92.tmp
Size 93KB
SHA256 69048b647e01eb8ff7e90ba4e50920ca035200b1e10460e75caa8ee2e10de9cf
MD5 0eb687ccb2bafa8e38168490a34c0d5e
SHA1 4faff4ef57b7349e66accf13066d87d6f8d0a587
SHA512 992e72d56231eb022a8eacdcd4f9b2d93fa84315457662ccdc3c961411117b7df29da8b9e1a0ce10ec8a08db093698736d99b9f84362f1bc23742fb8f885109a
SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjx/Z2HQuhtjRQX8Nz:ACSjGoLpWM6VbBVjx/Z2wuhttQMZ
TLSH
T18F934A6AB28CB376D0EE59BC8E0DF2E07D257E301E19185BB59D2F0D9E761C1190C19E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe.Exe

Path C:\Program Files\dotnet\dotnet.exe.Exe
Size 237KB
SHA256 e87681c72965b851aa904baffa0901d38143bf7dcd827c4c64532a02c572d496
MD5 775bf0803f85d0d6047b801201f4c045
SHA1 94831d11e08ad6c10eabc7e9a0839b273ea475ff
SHA512 d07dfe34504fa8536c66e7046ff6e6f110ad29c1efa5fd408574740950b474c64b67862695fdba4821a65577feecbfc805ea5a65b09c5d154b5f9142d3853c8b
SSDEEP 3072:ACSjGoLpWM6VbBVjxfZ2wuhttQzG1vJ9psmeIBcV8pQFq4XKF3QP6:2Xq1Vi9f3psmeI+sQFqT3Qi
TLSH
T11434C35AE29C73B5C0EE5174CB0DB681BE273C214BE1928B62D4FA3D1F762805DE9643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX54AD.tmp

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCX54AD.tmp
Size 93KB
SHA256 912173cda97507e7ab75c9a4c576c3b2acefed4db32cca52e64ceb7d9d3cbf82
MD5 abae489beb4a62452a4c663088b67565
SHA1 ddb340d214f858c43951215ade9d26984cb38f7f
SHA512 5c06890e2ae58cec941b76c0a47d29b89ece658a8483acab2407566982b069076c4795e1345f3e55faf1642548948d4f5862d374bf9ddc9ac7476b541762bb52
SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxJZ2HQuhtjRQXzNb:ACSjGoLpWM6VbBVjxJZ2wuhttQDB
TLSH
T115934A6AB28DB376D0E299B88E0DF2E0BD397E301E19185BB69D1F0DDE771C1590C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aACF4.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aACF4.bat
Size 902B
SHA256 dd6633e9c524d8c43060be60689d15e51ffb7889eef6556778ab2150a600b3d2
MD5 5e7e5c71f77c2ca3a6c93a6340b7639d
SHA1 243122a68a91a627f905aff5bf77af71e0a6277d
SHA512 1fb3e4aa24e1f89d1e01529a3b19e627d90d78d312b7d048399cba0ec48f925307dc82cdebcf9bfe8b63b08a24c385e1c607962691429ba5d67944cff736247d
TLSH
T11F118C13C2E6DDA84064A6530D5A9E99C01622593F0E3266D71DCA2E10C7C0CFAE1766
MD5 SHA1 SHA512 TLSH

Submit Download

2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 4.3MB
SHA256 bb8a7677d93c96131f967920334c5d278a8ce0912275b0c4cc56c6260b0ebda5
MD5 7bf1f99a57a0b6c93536dfe93a8d0621
SHA1 7e23e72ddb587a9149af78c31e664dc9afcf1592
SHA512 1dd0682505e79b9ab876afa93a4d087f083769f77c51b9a2f6746eb9815af8f698d70f0d8c3fe3678b9d811f1eab4285fa087a171cd1d2daa1b11a2b7f3cf897
SSDEEP 49152:i/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:NWQtZ/K0tGOFWVRuLftCT
TLSH
T1FF264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 497759c0c30a42afae516926d071cfaabc0831b1c8a02b0969346e64e9e0ad10
MD5 0a472ec3b1acd83b9e41ac974309396f
SHA1 b1a12461bea2a32deb5e22755af93d80cd7f5c8a
SHA512 62a3e93a1c3bc7c90914fedef63b4a2f99d103ac2a6222e6f79d2557f43f0da2570cbd3337654691fb1bf04ee6dea1ca6eb64c0c3d94d6b42a6a3ab8b88ff018
SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxHZ2HQuhtjRQXFNJ:wCSjGoLpWM6VbBVjxHZ2wuhttQVf
TLSH
T172935C6AB28CB376D0E25AB88E0DF2E5BD397E301E19185BB59D2F0DDE771C1190C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1516-16-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2132-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3908-908-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3908-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3908-1527-0x0000000000400000-0x0000000000429000-memory.dmp

Download