Overview

overview

7

Static

static

3

2026-04-17...ar.exe

windows10-2004-x64

7

2026-04-17...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/04/2026, 03:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-17_8004fff0426bf5f6ef2997d6a84449d6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
  • Size 6.8MB
  • Sample260417-d64esahv2y
  • SHA256 f600a2bb48d09bba0ce0ec20edad00fd0a5ebc53b616d2b47f7b702ad42e1726
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-17_8004fff0426bf5f6ef2997d6a84449d6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-17_8004fff0426bf5f6ef2997d6a84449d6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3904
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1664
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4848

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 7.3MB
        • SHA256 48364ee72f7bd7049dce5955ca7b7739e5d943213f337c1bc7858cd8b8f8b8a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.7MB
        • SHA256 fdf735c86eb6126aaa4ee5ac2e7cce36a9787c50f3c45daf8be78bbe04a2b70a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.5MB
        • SHA256 7077a39e6e95f884599ef1cd80bcbfcfc87bdd4938a9babc240f261f845dda45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.8MB
        • SHA256 522fa913f5a79f1e33abf90a8b3d42696ff1f16a0d03f3d77d408f8d3ac6a75b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 12.8MB
        • SHA256 60949e3fee96951561eaa4c67ba5d085f7e0a2762e3e10abf3212ef36e6760d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 8.5MB
        • SHA256 d6956890e40dcaf026f5d8aa618650dde08c9759e066562002adf8e7ee2d6be9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 10.2MB
        • SHA256 ca1dd0c9850ee7e5104c6ad8737e5a698b88a61784c4f7717bebec8602c4fdc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 9.0MB
        • SHA256 c2c4d446a500719a47623b43dd4d951c4d192e1c9b9b30a88bb9dc4fcc326d53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 8.4MB
        • SHA256 416c3097494c02ba500b7c7463cd2f1fde450aeef61e3d98aab8830429f8f189
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 8.6MB
        • SHA256 c6d46938997ccfcca6ff164500250ce45a1036b162007aaaeec608f5a0ed8571
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 9.8MB
        • SHA256 2f07645fa3b020bbe326f26a1be28c6ac43964f8a94467fed713177c604c0c4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 8.2MB
        • SHA256 226ce1aba17694e7c7b0d2d2777e1d24aca8647cac57f640a6d933300498402d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.8MB
        • SHA256 33431b74d5d138979dea942e909752d99c5d8224fec8dfb1cb86ba123f66356d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 6.8MB
        • SHA256 ba1d3259eaae5627d8c785482c5600d95a33938a4f130fa08178293fb9a14238
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 6.8MB
        • SHA256 c83f94488e6107b05a466bb800b2ebc4c3f1e62cb57156019255d33c005a9729
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.8MB
        • SHA256 ae2bcbc4bf21a0d7283d833184eec8bd73aa7b4d164ca1e2186a9d4579ae0a02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 6.8MB
        • SHA256 c500ba9c538ad363b47654c4580c080eefb441d180ee722fd0873fbe715289dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 6.9MB
        • SHA256 07f194a28b0c0dac28d0f7eb60ab4689ae3c06a71999e58f2eff06562c5650cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.8MB
        • SHA256 e7d74e569b71f8acd006ea7ed4f4cd0d8cd52e04a1bba909b85d832877fca392
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 6.8MB
        • SHA256 ec62a9b010c8e1751300270476f6d4addb3ee6ed720f5ede16ba0e23b3f2bee8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 6.8MB
        • SHA256 d927989eb7e71a745d829a0113b8f989ed586ee5d066aa05ac1ec57c9ecb6a7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 6.8MB
        • SHA256 f600a2bb48d09bba0ce0ec20edad00fd0a5ebc53b616d2b47f7b702ad42e1726
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 0488b2869cc8d1f15938d339c6900713b497867b238e55ca0f95d4cb4b36f650
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 31f21c99156df9ed51644e61e3096571b95938559734cf22a3fe9e3f109cdec9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 cca70c4ed278d5cffe51c7ceb4a0a44e179775029b6fb93c9bbf3da1a232d173
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 220a90fee7150de025faad0240463c04259f8e50bc9d413253eeca63fdb745d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 9d3a18af8a5a229bcf2898ffca9cfa2e84bc97050dc083a8fd73a121f943a834
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 751a1ba7fabeb14a4ad331a82dd5986878de37ba9c94cddb1470ea58c09d12f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 f516624230be6fb43f47a30a8e39f21d261eb45d91b77f6c185034861c376fcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 4c101b9977f4a3e78060969beaee98280eafa9b681b5cc2ceacb5fb8e734c7f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 544f1edc8ec23d23ac2383ac4d634df2a8369a318949bed704c21e4580c55085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download