Overview

overview

7

Static

static

3

2026-04-18...ar.exe

windows10-2004-x64

7

2026-04-18...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    18/04/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-18_3807e3f85a38268d548911117bc95f36_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 7.9MB
  • Sample260418-phc4gahs8x
  • SHA256 2f32ccba2617e526d98b5e7463c265bc6b8936c38568485456e3a3b37d5cea05
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-18_3807e3f85a38268d548911117bc95f36_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-18_3807e3f85a38268d548911117bc95f36_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5064
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4948
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5920

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 8.4MB
        • SHA256 8961e190d7b0f90264760bb38deb7fd7abdbd6d4e25c34954cd0fd12c1d9d8d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.9MB
        • SHA256 43505649a8b286e103fabeb4e8adb75ef408518f12f5be1afb8d910628d8308c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.6MB
        • SHA256 d8530c3d1618f2e0884d805004492ad30d4bce55a7711d69394192c7ee0a4879
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.9MB
        • SHA256 f86c60a5d970d7b0ab4a08a67f586fff1790a16d9d90b42addb0d9e327347d54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 14.0MB
        • SHA256 6677fb8ed18a100049f00071f56fcbefa062dbdf86dc39102501ec9727aa6ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 9.6MB
        • SHA256 a30defc2e0f80015151732b8b0286a6b54e22a8765baa993f7ff51bc07482f50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 11.4MB
        • SHA256 6617c379c667fc87b0660e59eb19c686a0ea09db8a5e69ebccd623736fa8092b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 10.2MB
        • SHA256 96d1186a5b79a3336b30604c51f7f8c047be0c07b1f9d0fa4a358f6d3a705bc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 9.5MB
        • SHA256 5d507e3842417b74780ab46302562cb443bdd6567a69c85f8d7b75559d759a57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 9.8MB
        • SHA256 e4ac9c54745b8d70b5933431e27d4ddc67a4f108ae281f9915966c79c8c4ca6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 11.0MB
        • SHA256 1017b428e8ab3e3032a66b6b20d4af41dd8afe4e7594f9184c47f9ccb08fac36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 9.3MB
        • SHA256 5a5d4c4fe9c1b8863a3b87f004df7ecd144e3f7dfda1ac37eb45705de7eecd57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 7.9MB
        • SHA256 3ca7c7ff77c0d79ba7663639ae1379e46e6900c8dd75d08d16b13b1caf3f719b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 7.9MB
        • SHA256 11df87e5452a0c187b304ba5498b7417f9417529725961733e8d0a60efc180a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 7.9MB
        • SHA256 e11cce86566e1f49916719950a5a3f4e1f2d77b0e94ec502ffb6e1e9aaed19d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 8.0MB
        • SHA256 ad6d273b35855980133c422cdf5f796d44553c4fcf3005d20a69a062db371188
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 7.9MB
        • SHA256 94fa4cf6cc631f3106c768ae1dfd2d359ad644462a76ee843a3b1df1cd63eb78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 7.9MB
        • SHA256 a8728bbaccc6ff9465d7516f499962f6f8c57b71b03ca831b9194dcc6529552b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.0MB
        • SHA256 7a2ad619e57f45eb4cabca05f9eb799b0aa7ff212732e80b03b11cb1ecc94c2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 8.0MB
        • SHA256 554f60ea9a6592b66d11ccf5b18fa60170f9a887c8962dcc0a359907eb8853ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 8.0MB
        • SHA256 00c0bd41eb261096269ca7308f76015498cde30928fd7075d4b2ae380130b31e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 8.0MB
        • SHA256 32c8d3e9061f6d417330abdd4a2a7608c8d42ea328e7127fd35fce1c90b307c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 7.9MB
        • SHA256 2f32ccba2617e526d98b5e7463c265bc6b8936c38568485456e3a3b37d5cea05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 73.6MB
        • SHA256 1ad85c3d569b2596a94e5f8e7b6a58108e91a276d29cea5a9fbd23f84ad031a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 75.2MB
        • SHA256 177c6454df70a196b511df2b353daaf1ed7b7ee225ca5627bb463a863c0c2f5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 73.1MB
        • SHA256 9aa882ea58f242005772ff64ce938164ee015ec1d89c1cfe385c6e9ee75eb86e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 71.4MB
        • SHA256 2001bd50034e24cf3320c5d0774e69ed82947b967aaf810a1c1fc5d4c4d8d3ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 68.6MB
        • SHA256 34620f535da13c62f13d992e4f9301ca4348b7c8d8c359b07197b5313b3a873c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 70.9MB
        • SHA256 221859f481384cd48e33d081b9ebc2508edfa39b1b873043225c82f2acfd416d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 72.1MB
        • SHA256 4215dd3f16ef6458be2d24decf9575cb2f303c7a2436f710ea87054c3e5a5f48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 73.5MB
        • SHA256 484f4a1f2cd6a6afab845d7d81cabd35d34ce663df43e1c7bbbe1e1bdd9c402c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 71.1MB
        • SHA256 d328dabe8916ed469297bf74ffeb78065e01c474eddb10d95c5baec08bb20989
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 70.9MB
        • SHA256 74a4accf17cef69f130ec6b10923294c13056338c04cf817744c8971f0d52051
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 70.6MB
        • SHA256 c50ec6e0c26f45d4947f8d540aac01473c3cc02e14f5b043b66ec985d8320dfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 68.4MB
        • SHA256 585b0277b999acd6f330bdde1589575580774d407a95fb3c177b54c2faa3969a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 70.9MB
        • SHA256 7f3e676a299979ced1843720b86d3a0790b3f5644df7c712ae4fe76d6d7243e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 70.8MB
        • SHA256 0026d91dd1f1eaf3670a553ae9de0f1d90cc8f82f1a9886675e16cc26839fab4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 69.1MB
        • SHA256 6a71112439d4d851f10367256cc35e4bedcf226a4b6f430b67e1c087bf5616a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.9MB
        • SHA256 f0e020a6a19c28e8c3f088739192870e6e8af91745065ccc9a87d7ae0f74884e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.9MB
        • SHA256 a8b52fc0a42b142e52874ba7d952870a8d4e6256bb62ddf58ae1f4daa9564f95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.9MB
        • SHA256 aecd52cd4c80c618fdb5d9dfa9632eb398676dbcf03d4a41f8fd515a014f0f85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.9MB
        • SHA256 03a53a2601abf0c60ed0ff0241f58332a1c5f881c8329a249f55fe1323a7155c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.9MB
        • SHA256 c00ab2d8461ac8aacdcb5ac32cef161eb4ab900c271a76a35cb2ccdaf9f13e04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.9MB
        • SHA256 b8f8dbc8482376927e31bbf79a09f90fcd4367d4fc650e157118f0dfa9e2a032
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.9MB
        • SHA256 1189316179d070e3c0119ed845993ec3bc448523f0951a63e4a6146cbd89981b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.9MB
        • SHA256 cfe82826739094058280fa11eaabfa690db440356e5abc7846de459deaa4906b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download