Overview

overview

7

Static

static

3

2026-04-17...ar.exe

windows10-2004-x64

7

2026-04-17...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    17/04/2026, 03:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-17_8004fff0426bf5f6ef2997d6a84449d6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
  • Size 6.8MB
  • Sample260417-d64esahv2y
  • SHA256 f600a2bb48d09bba0ce0ec20edad00fd0a5ebc53b616d2b47f7b702ad42e1726
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-17_8004fff0426bf5f6ef2997d6a84449d6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-17_8004fff0426bf5f6ef2997d6a84449d6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:716
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1044
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3808
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2524

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 7.3MB
        • SHA256 48364ee72f7bd7049dce5955ca7b7739e5d943213f337c1bc7858cd8b8f8b8a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.7MB
        • SHA256 fdf735c86eb6126aaa4ee5ac2e7cce36a9787c50f3c45daf8be78bbe04a2b70a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.5MB
        • SHA256 7077a39e6e95f884599ef1cd80bcbfcfc87bdd4938a9babc240f261f845dda45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.8MB
        • SHA256 522fa913f5a79f1e33abf90a8b3d42696ff1f16a0d03f3d77d408f8d3ac6a75b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ExportUninstall.exe
        • Path C:\Program Files\ExportUninstall.exe
        • Size 7.3MB
        • SHA256 1cd9492af4328e074ad1a0ffd16a0f2b063c67fdf72c77fd6a03d14b37a4af1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 12.8MB
        • SHA256 e23a9b851c231cb8a8adfb44e34cb40fef3bd298e32cf2aba98317d5631f2da3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 8.5MB
        • SHA256 d6956890e40dcaf026f5d8aa618650dde08c9759e066562002adf8e7ee2d6be9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 10.2MB
        • SHA256 2598cab606b13bc03522a8ac8a1f61f54fd7911cb7b3b46570f01de562889988
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 9.0MB
        • SHA256 c2c4d446a500719a47623b43dd4d951c4d192e1c9b9b30a88bb9dc4fcc326d53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 8.4MB
        • SHA256 8b3490b2f7022a838f684c24b0da7a9bddec7bfa5b4fd7cb2ef9bc913c70c3ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 8.6MB
        • SHA256 c6d46938997ccfcca6ff164500250ce45a1036b162007aaaeec608f5a0ed8571
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 9.8MB
        • SHA256 2f07645fa3b020bbe326f26a1be28c6ac43964f8a94467fed713177c604c0c4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 8.2MB
        • SHA256 27d6d5ab46a0b5c2f017a1c8c768c3e8eaa0db5ca27d73d0df69a075e5e71012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.8MB
        • SHA256 de3ae2e250734979ce507be11c017120ef80ad2f97ed948c7de1f50df0f27bb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 6.8MB
        • SHA256 86053147c60239a4a1872162ffe445646104a67629619c00ed9da8c9dbe3283c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 6.8MB
        • SHA256 be3945eb8a3b524b64944c16d8523a37127fff4424e1eb74b9ca1ae7f7d31926
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.8MB
        • SHA256 5baa4f7ef0dbf0d88a41e873df57ccbcc727018dbfad9cf6bc9f4ca6bf19cbcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 6.9MB
        • SHA256 07f194a28b0c0dac28d0f7eb60ab4689ae3c06a71999e58f2eff06562c5650cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.8MB
        • SHA256 341cad0b84371e5ed47ec39b19d5c7cd784de82c789472d8121dd4c130a6a267
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 6.8MB
        • SHA256 0d00792c55817790d876565ae5175f70a06f37d31dda54b1f43c15ab2181d8de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 6.8MB
        • SHA256 f383aa755f239c5a9d143ee6a129000a252d834dbe9cad9f63f69e2828a31984
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 6.8MB
        • SHA256 f600a2bb48d09bba0ce0ec20edad00fd0a5ebc53b616d2b47f7b702ad42e1726
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 4c101b9977f4a3e78060969beaee98280eafa9b681b5cc2ceacb5fb8e734c7f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 544f1edc8ec23d23ac2383ac4d634df2a8369a318949bed704c21e4580c55085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 5b07cce9c74cc0ea43dda6a6b63e1d8bf95a32c8146ef7dfac47c0c336271e54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 cca70c4ed278d5cffe51c7ceb4a0a44e179775029b6fb93c9bbf3da1a232d173
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 220a90fee7150de025faad0240463c04259f8e50bc9d413253eeca63fdb745d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 751a1ba7fabeb14a4ad331a82dd5986878de37ba9c94cddb1470ea58c09d12f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 9d3a18af8a5a229bcf2898ffca9cfa2e84bc97050dc083a8fd73a121f943a834
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 f516624230be6fb43f47a30a8e39f21d261eb45d91b77f6c185034861c376fcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.8MB
        • SHA256 82d18d89f91cb7bf2bb9db8635d1d9e0cf7b4024f95773671e8a0fbc71a35884
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/716-66-0x00000000009B0000-0x0000000000A8F000-memory.dmp
        Download

        memory/3808-80-0x0000000000850000-0x000000000092F000-memory.dmp
        Download