1c931cf17eee9316ab89edffbfdbae8998a0a98d869a90009a00406472e3af4a

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 4.4MB
Sample261018-sqlmcsfx6v
SHA256 1c931cf17eee9316ab89edffbfdbae8998a0a98d869a90009a00406472e3af4a
MD5 42db7e6cd5960ce54d29ed49989f09b3
SHA1 0c285c1c3973922a71902278cf14a5b6f47540ae
SHA512 00513ae86246c7682ac130e3b731b568038fc33d1457880bb54e486f7a2ac5e5111c08f0b884e145c3ed9d2c412c1559594a4b6aa3052f5ef85340a7769f9390
SSDEEP 49152:F/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:GWQtZ/K0tGOFWVRuLftCT
TLSH
T145264A03F2ED52A9E0AAD178DF39A2219F727C598BF165DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 2 IoCs

pid	Process
5760	Logo1_.exe
6080	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX5DBF.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\RCX6BD9.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\RCX6AC6.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX5926.tmp	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCX67B6.tmp	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.Exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe
File created	C:\Windows\uninstall\rundl132.exe	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4456	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe
5760	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5556 wrote to memory of 4140	5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	90
PID 4140 wrote to memory of 3016	4140	net.exe	92
PID 5556 wrote to memory of 4456	5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	93
PID 5556 wrote to memory of 5760	5556	2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	95
PID 5760 wrote to memory of 4376	5760	Logo1_.exe	96
PID 4376 wrote to memory of 5440	4376	net.exe	98
PID 5760 wrote to memory of 3604	5760	Logo1_.exe	101
PID 3604 wrote to memory of 5512	3604	net.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCABD.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4456
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5440
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5512

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX6744.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX6744.tmp
Size 95KB
SHA256 360f4404145991217d81937241803db905191e890c83269e939d605a81172bd2
MD5 90ff3e74ff52a271b4b692a2047d3625
SHA1 5251ac95c004b24c2e0e5def4d6a6e5eaf30b275
SHA512 562c6f87bcccaaada3f203838ed8f7187f040e16cf663480640668610353d0e602b00a4bb83f1068ef73cb3129260e5b4f1fd0bc9b73536b65052cfd8f8bf51d
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxnZ2HQuhtjRQXtNz:oCSjGoLpWM6VbBVjxnZ2wuhttQ9Z
TLSH
T1D8933A5AB28CB376D0E259BC8E0FF2E1BD353E201E1D189FB6992F0DEE761C15518186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX67F6.tmp

Path C:\Program Files (x86)\Google\Update\RCX67F6.tmp
Size 91KB
SHA256 c32ab8ab7d7e5f686a686b6f5fa495ead62c295569bc201035f04a687a6f3240
MD5 fb13f732685f4c26899d50741071dc1d
SHA1 d358b27258574e9ad2de3fded72636c58b8550f9
SHA512 605225a6fd6f2c036219047d09ae9f3a1dfe742868f242111728f02272aa67a55ae92b656d26b32cc63d293dbdb52ed54717a6895d34b0e82faf4ba98aff149e
SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxYZ2HQuhtjRQXaND:wCSjGoLpWM6VbBVjxYZ2wuhttQKp
TLSH
T1E7935C6AB28CB376D0E299B88E0DF2E5BD397E301E19185BB59D2F0DDE771C1590C182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6984.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX6984.tmp
Size 104KB
SHA256 2281ee5b674e35fb5f0135947fc386816ae1b8763024124b0e0ee92fb16543ed
MD5 1f10b4d2f7192916a73df42ba59262be
SHA1 6aea36cc1d957284ee5943aa006dad5fdf8ad2d9
SHA512 a53a7b03f7f442dcbc9c3fec69db5df226c64f6d452fb546159fcd104b412b8f0f0bf90fd0a16950717fd69bbd97acde144de7319c77385b4ca4dea96be5ce04
SSDEEP 3072:ACSjGoLpWM6VbBVjxiZ2wuhttQcdtPlLqO+:2Xq1Vh9RLq
TLSH
T1FAA37C6AB28DF376D0E29ABC8E0DF2E47D257E300F19185BB69E1F0D9A775C1190C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6885.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX6885.tmp
Size 119KB
SHA256 6e4973859bb4712b7217abea89d6d2ef311b9759c1fbaf1e9fabe243ad3fc684
MD5 ed8092bf5dbcf40704770f6e6435af89
SHA1 2b0b6df877cc744ce421e33c1b3b3a1cc636a7a0
SHA512 2c656f3f95b2ba167f72d62a68ff9a3a7196b15b3f461853b844c5ac2e787eb43df2e17e65a40f07b7b638c248b9c465fde900032675796957665a328bc3f269
SSDEEP 3072:NCSjGoLpWM6VbBVjxoZ2wuhttQPe5BV0dX:XXq1Vz9ae5v0p
TLSH
T18EC39D6AB68DF377C0E299B88E0DF2E47D297E301E19185FB5992F0DCABB1C15508192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe.Exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe.Exe
Size 2.1MB
SHA256 5ee759396a179426d87fc515e392347f15fd340b3e22f2b0efd9a11b9d7b534e
MD5 73f706a44f593e6c1e6aa66805490beb
SHA1 e6a895448c279c6ada203ab3e7cd7e9eb4200df3
SHA512 72df0897b2ce12de31710b91f0e57eef75ef20bd1e5f59e77d2cc2447802e3a2c6b15e77f5457ef2bcb03d2e785c4da66e002240a3d9692321f4eafa0bdd896b
SSDEEP 24576:1twvLof6SRQ+rn/fDboqxN1nnh6z7DaHGTNHu7PNU3/5W/ohL01:H68Qg55nhoeWu7PNU3/Q
TLSH
T10FA5813771FB2299C48DA1769F4A67219AD17C71CFE1D3DB8105320A1BB29D07A3A60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5A44.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCX5A44.tmp
Size 93KB
SHA256 f02fe1c9a291335b1661d0d3b6192b090d08f6a70b44e51137f0110841963687
MD5 76dfc017cf7475e6ba74d5534154b60e
SHA1 4e783328007782898780450a273c2e0dda5d3526
SHA512 c5740ee72e17d324652c242d10709c49ba090d4e87b0f82c874650cb6ce2dd9f361e4a6bc6d3ce6859ebc6dc2806e0ac78750529f2bb2a22f59f0322617a5ded
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxXZ2HQuhtjRQX7N7:YCSjGoLpWM6VbBVjxXZ2wuhttQrh
TLSH
T137934B6AB28DB376C0E259B88E0DF2E0BD397E301E19185BB59E3F1D9E771C1190C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5DFF.tmp

Path C:\Program Files\Microsoft Office 15\ClientX64\RCX5DFF.tmp
Size 157KB
SHA256 f554856bcd57db5bf493f54d47d21644bf565ef1076df4727733e0e72c421339
MD5 a72f78eee5bb8db9b7f83f9f078673ea
SHA1 1211f8d4a79c1c3af7a88fba2cb1868de6fd71f3
SHA512 33a4a99ea02dbe997cd798db2ec993279b69894dec756651a00327bb93452d7716e4e0d8b6daccd6e8eda67ab646e246073b1499a3917f875e2c09f6282e27a6
SSDEEP 1536:o7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxYZ2HQuhtjRQXPn5Nj:5CSjGoLpWM6VbBVjxYZ2wuhttQf5J
TLSH
T157F3A376725CB776E0E199B84E0DF1E0AD2D7E201E2BCC6A755A3F0DBB761C11A0818D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5DBF.tmp

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX5DBF.tmp
Size 92KB
SHA256 af849ff678b5f93995f76949bde9bb71c029941843f59ee54ccedcc2290f0fe2
MD5 f69ab8725faae421404c96f21949ff86
SHA1 fb5334d7a5d4a386c17a7eb38929a8f09b7776d0
SHA512 3c1c15bcd294633b1feb1abb78196fa935c4a288d63fdfd5db613671f3036710c339785a8030631b4a3f997e18e44f86c7f446b635f2d424d3206ac5c8bdd11e
SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjx3Z2HQuhtjRQXcN7:4CSjGoLpWM6VbBVjx3Z2wuhttQMh
TLSH
T1C4935B5AB28DB376D0E259B8CE0DF2E07D297E701E1918ABB69D3F1DDE761C1090C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5E62.tmp

Path C:\Program Files\Mozilla Firefox\uninstall\RCX5E62.tmp
Size 101KB
SHA256 e169e38fa18e06af4927ffd8bac24524d34b50bda32adc137ed825cb19eb1382
MD5 2869c3c2979f82838dbadb6f08dd96f6
SHA1 5909b3a00c3a5759c8349d5e6694bed86291db02
SHA512 65dc034f94cda60b8d1762b7f4592dc69ab83c360ca916af0801fd29d19ead3b506e93ba0b7ab618101f44c7dea2746e4b29cae6b03242a8b5c9ff04ab2b576f
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxJZ2HQuhtjRQXeqkSZZZ3SNT:gCSjGoLpWM6VbBVjxJZ2wuhttQgUS5
TLSH
T12EA36B5AB68DB3B2D0E18AB88E0CF3E1BD397E301E59185BB69D3B0D9E77081151C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5EA3.tmp

Path C:\Program Files\VideoLAN\VLC\RCX5EA3.tmp
Size 93KB
SHA256 69048b647e01eb8ff7e90ba4e50920ca035200b1e10460e75caa8ee2e10de9cf
MD5 0eb687ccb2bafa8e38168490a34c0d5e
SHA1 4faff4ef57b7349e66accf13066d87d6f8d0a587
SHA512 992e72d56231eb022a8eacdcd4f9b2d93fa84315457662ccdc3c961411117b7df29da8b9e1a0ce10ec8a08db093698736d99b9f84362f1bc23742fb8f885109a
SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjx/Z2HQuhtjRQX8Nz:ACSjGoLpWM6VbBVjx/Z2wuhttQMZ
TLSH
T18F934A6AB28CB376D0EE59BC8E0DF2E07D257E301E19185BB59D2F0D9E761C1190C19E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe.Exe

Path C:\Program Files\VideoLAN\VLC\uninstall.exe.Exe
Size 382KB
SHA256 cf6a9f3ba87e8daa0c066498c610d7fcf5a2a8cd41ff05ffef887a03af34eabc
MD5 672a1ede4992b2edfade7804ecad1f13
SHA1 c97ca05fc33bf01728c90f15d7134bbb06223cd9
SHA512 7616feb5cbb66308ff4f409db25819c67ec213a30506951544eb8f697dbe17a6e3c65ec2bfcb9bca419b9d14bcc8bf10efca98290c0f0c5424d8dade5afcd061
SSDEEP 6144:nXq1VT9Vk96iT0TRmjV6HkR4JYWk96kADnA27X/z/vzGv4Woo:gYSq6EfqNX/rvzS4WT
TLSH
T1BC84BE09FB8EFBB6D4E905388E0FF29B1E20BC204D194917F7451F2EFC725955A1928A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.Exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe.Exe
Size 546KB
SHA256 a03e7d8d9d979ae818187c88542d85375c92c568fecee758a034e0b06d186d2f
MD5 14ddd08953bf0a5d70d15540bfd18ccd
SHA1 f239387864a713ba8354a112969fe9a761fbaff8
SHA512 0d455d2471140c301ada51e058ba79684bb84b5174f6a25d1393d2c06cadfccc69214643c3e4d9e6329e2456aba47e85054a11c9baff5d5014d06a826ea9716b
SSDEEP 6144:2Xq1Vc9F78n5Qw0tneDA/sqhleIc0HftDrkYY1hj63hgDonsogCh6NEpAFM:8B85bM3npxYfj63hgD1ZiL
TLSH
T116C4D502B7EDB335F2F31B31AE7DB2515E7ABC619D35860E23841A0D49B0580EA75B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aCABD.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aCABD.bat
Size 902B
SHA256 3ef6024e20af91fee279e9e447f7c1e22ec8083a81e32c13e48d996e2bda71c9
MD5 345d996b90e4f8d073956b6bf11e4b0f
SHA1 ea7cab2a9f07dd0e990c7804501711eddd925176
SHA512 c2d82f71e0092c07de4752343260fed5249196270399e03d68f8c546c61dbbf99fa7e223435906f7f41db2fa722db1f39d438f6d6e563e49d3e42da9b5988b2c
TLSH
T144118C13C2E6DDA84064A6530D6A9E99C01622593F0E3266D71DC62E10C7C0CFAE1766
MD5 SHA1 SHA512 TLSH

Submit Download

2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-18_42db7e6cd5960ce54d29ed49989f09b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 4.3MB
SHA256 bb8a7677d93c96131f967920334c5d278a8ce0912275b0c4cc56c6260b0ebda5
MD5 7bf1f99a57a0b6c93536dfe93a8d0621
SHA1 7e23e72ddb587a9149af78c31e664dc9afcf1592
SHA512 1dd0682505e79b9ab876afa93a4d087f083769f77c51b9a2f6746eb9815af8f698d70f0d8c3fe3678b9d811f1eab4285fa087a171cd1d2daa1b11a2b7f3cf897
SSDEEP 49152:i/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:NWQtZ/K0tGOFWVRuLftCT
TLSH
T1FF264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 497759c0c30a42afae516926d071cfaabc0831b1c8a02b0969346e64e9e0ad10
MD5 0a472ec3b1acd83b9e41ac974309396f
SHA1 b1a12461bea2a32deb5e22755af93d80cd7f5c8a
SHA512 62a3e93a1c3bc7c90914fedef63b4a2f99d103ac2a6222e6f79d2557f43f0da2570cbd3337654691fb1bf04ee6dea1ca6eb64c0c3d94d6b42a6a3ab8b88ff018
SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxHZ2HQuhtjRQXFNJ:wCSjGoLpWM6VbBVjxHZ2wuhttQVf
TLSH
T172935C6AB28CB376D0E25AB88E0DF2E5BD397E301E19185BB59D2F0DDE771C1190C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5556-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5760-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5760-988-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5760-1531-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/6080-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download