Overview

overview

7

Static

static

3

2026-04-18...ar.exe

windows10-2004-x64

7

2026-04-18...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/04/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-18_3807e3f85a38268d548911117bc95f36_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 7.9MB
  • Sample260418-phc4gahs8x
  • SHA256 2f32ccba2617e526d98b5e7463c265bc6b8936c38568485456e3a3b37d5cea05
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-18_3807e3f85a38268d548911117bc95f36_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-18_3807e3f85a38268d548911117bc95f36_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3324
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2944
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5884

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 8.4MB
        • SHA256 8961e190d7b0f90264760bb38deb7fd7abdbd6d4e25c34954cd0fd12c1d9d8d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.9MB
        • SHA256 43505649a8b286e103fabeb4e8adb75ef408518f12f5be1afb8d910628d8308c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.6MB
        • SHA256 d8530c3d1618f2e0884d805004492ad30d4bce55a7711d69394192c7ee0a4879
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.9MB
        • SHA256 f86c60a5d970d7b0ab4a08a67f586fff1790a16d9d90b42addb0d9e327347d54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 14.0MB
        • SHA256 11e47ef6be3ce16113d982a71b194b77e0d858f58a2b3d5a2391c6254aafb76a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 9.6MB
        • SHA256 a025bb55010d0bcb4c503a470dbe114349d4b4086317e88398448605efae9a20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 11.4MB
        • SHA256 059fefba82c170290efd1ee6965333a50bda43cd7824c0e4d80c8900e57ce604
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 10.2MB
        • SHA256 1cd5e14ab23a27ece975bc9ac595f5530730f6408f8458b0f10b3b41b5064d2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 9.5MB
        • SHA256 118d85c1765465b3c16b1f3672c280985ace6c3370b9ebcd83fbc6d707431be3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 9.8MB
        • SHA256 b6862a33055d08cb34751539e9dd0231d0bddda722b70041d81d7999904b5dd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 11.0MB
        • SHA256 866a85c80b9c4fd6c91dbe243bce626792bb8caaf256929b3bf817bea1d78d8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 9.3MB
        • SHA256 9a891af8a6121850bc318ed3aad6b4201b4e79a3c49b53c481a56356584fa964
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 7.9MB
        • SHA256 ef647af3f878abd4936f6277c30010d2bb2d7536e958c07bac4e8d8a410272be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 7.9MB
        • SHA256 751687d2bdb31e3d7a30972f74a4348f5dbea60e0231ed86b3380c65415a01bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 7.9MB
        • SHA256 42287f0333d9f8682a3c8c57846e2d183661096c7d90a1d0c9c4e6ff44134600
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 8.0MB
        • SHA256 faff44ee2ea843e306034ad0cadaa26c9f7f09a8a2b60281133748cd914cd826
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 7.9MB
        • SHA256 b35bfc195b64fa856d359e1769f5bac2a2bf8dd1e394dfbd469067066ce33705
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 7.9MB
        • SHA256 5b080bd6594f7f32b5af8c94cb87ed166e6aa77d183c187feb6081b278ec38a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.0MB
        • SHA256 7a2ad619e57f45eb4cabca05f9eb799b0aa7ff212732e80b03b11cb1ecc94c2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 8.0MB
        • SHA256 554f60ea9a6592b66d11ccf5b18fa60170f9a887c8962dcc0a359907eb8853ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 8.0MB
        • SHA256 00c0bd41eb261096269ca7308f76015498cde30928fd7075d4b2ae380130b31e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 8.0MB
        • SHA256 32c8d3e9061f6d417330abdd4a2a7608c8d42ea328e7127fd35fce1c90b307c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 7.9MB
        • SHA256 2f32ccba2617e526d98b5e7463c265bc6b8936c38568485456e3a3b37d5cea05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 66.2MB
        • SHA256 2467616410c615f29a8b52f6854ad0197fbc445fe81197c9d8d6978dca1f1770
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 63.3MB
        • SHA256 9aad69816217c03c36a40382b89b32d94f020e635929fbe73c5e29766f79dd57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 64.9MB
        • SHA256 0baa16cb1c9c29859855f0d9ea7e0422d7131102fe4072dfd5ec03407a0e5f6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 64.3MB
        • SHA256 3ccb25f3a11eb3335264f6bba56c2400baad580f55eef6fa390c565b31c583c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 60.6MB
        • SHA256 a9fdb9859e08186de442fa6665ace9e02a546742649c247663d7cc8aad399054
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 62.9MB
        • SHA256 43f721a771d2ee0fff4a32194c3c457d580fd2235ed5b23b5973c6d1d04f7807
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 67.4MB
        • SHA256 af3b5162e7b23da50e4eb4b7320f0829db21170753e430bbe05c9dc7e2e9c989
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 61.6MB
        • SHA256 2976f2f04a7842a2bfd4f7cfecdaa0c6e5246ec68e1e497ef60a61b76cc521d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 64.9MB
        • SHA256 78587f86f46d0a06e683f3d14ef5ff04b5a77be3174334a05bcd581c37b22146
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 62.6MB
        • SHA256 dc725b54abd0fb85346b8b1281067cdd6eb01759d319b4ed4503916d68da5610
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 62.6MB
        • SHA256 92b1a6b8e22c7cfd4cf2fd972f9d20ac6f6ce350bdd89fdfbac76eb6a323aa46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 59.9MB
        • SHA256 10e62e1602b605f3818db179f94452f21d20a10d8b68a2af6aa00e4645ecbf13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 63.4MB
        • SHA256 5c3fb1e56295b8a05893b965c214e891b99c92cb17bda44a0c81dee849693636
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 61.9MB
        • SHA256 a80c932fff0468b06fc9444a084a816e4225f3fd17906f1d4cb16614fe0c6ecf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 58.6MB
        • SHA256 443288dbbe19caacbc3b9cf64c8b4f649d8cb5afdd32b94093760acaa73a2041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.9MB
        • SHA256 a8b52fc0a42b142e52874ba7d952870a8d4e6256bb62ddf58ae1f4daa9564f95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.9MB
        • SHA256 f0e020a6a19c28e8c3f088739192870e6e8af91745065ccc9a87d7ae0f74884e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.9MB
        • SHA256 aecd52cd4c80c618fdb5d9dfa9632eb398676dbcf03d4a41f8fd515a014f0f85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.9MB
        • SHA256 03a53a2601abf0c60ed0ff0241f58332a1c5f881c8329a249f55fe1323a7155c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.9MB
        • SHA256 b8f8dbc8482376927e31bbf79a09f90fcd4367d4fc650e157118f0dfa9e2a032
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.9MB
        • SHA256 1189316179d070e3c0119ed845993ec3bc448523f0951a63e4a6146cbd89981b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.9MB
        • SHA256 c00ab2d8461ac8aacdcb5ac32cef161eb4ab900c271a76a35cb2ccdaf9f13e04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.9MB
        • SHA256 b3f0c0e3c9fe9d7fbf56d652ff4bda69ff7a5eb63a980251f2df4f43c610e3bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download