Overview

overview

7

Static

static

3

2026-04-21...ar.exe

windows10-2004-x64

7

2026-04-21...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    21/04/2026, 07:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-21_28ede72fe8267974873e9a400500d2d6_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 5.1MB
  • Sample260421-jkw2gadz21
  • SHA256 5390db76b70b46bd5bbc877803d614a0dccb5a5355508ac4655d5a568594829c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-21_28ede72fe8267974873e9a400500d2d6_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-21_28ede72fe8267974873e9a400500d2d6_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5020
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4424
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4896
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4988

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 5.6MB
        • SHA256 3b4209b796368ee8a406e33090f4cc4112551ab79322ca68373c112c4e499e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 6.0MB
        • SHA256 8a79af944f6473678b9d852cd7ad74a73eaf6d0112b11a99713bd5f3a07e933a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 5.8MB
        • SHA256 a35c3eeefffe02690b772101aa7a5f9ee72113788612d49cbe4565cb893a1d0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 5.1MB
        • SHA256 06c0f9b2ba165b02f8f416fcb06be16437598ce8476ecd2ffa889e822a6abb75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 11.1MB
        • SHA256 711fbcf8aae5ed8b5aed241a8fe53e848673c44e85b7b7dcbfcaec92d3c79a69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 6.8MB
        • SHA256 4752279ed417e4b50d22c90b74abb610cdcba40ebda00bba1dbd3cb3b77f9e23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 8.6MB
        • SHA256 367158b8338b69ba9741a93e2e3da0ef01af3c965c29ac767214262a90432163
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 7.4MB
        • SHA256 de9583bc6faafa86aa4fbd65a20ec29af21f8829d6070644563db6e8ee54e3ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 6.7MB
        • SHA256 a7f2d422932f5ac351cd826f811c4a15dbf391afa763cdd1f9941874125cda4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 6.9MB
        • SHA256 b57a6f7c8552d037df3c86c9003cebe8ce8be0ef8c894e918e0ad9da866d5ffb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 8.2MB
        • SHA256 509bb53f29dffa38aaaa58d46141553c4222f18e95543935e31453c5694931de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 6.5MB
        • SHA256 f36443f2a950e19c685cc8e37e351cbfae9c968f0b38f195fe6597be0cb81fa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 5.1MB
        • SHA256 519bc409c3de4f20b384bf9fb3580fccb2d41d9a2fee0110acefe50b7757b421
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 5.1MB
        • SHA256 9eb4ce3c1919184ccd700cf7b51f707890d82aec9ef711bcc7cfee95638e3ee0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 5.1MB
        • SHA256 ea88c063323b7f83bc7bf0ea56756d51b80f943ec92bc9023e3d73209f06ae04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 5.1MB
        • SHA256 b429ae93db49592a99a9b01f2876156a1dfed75cc6b7c34ab47940d8c6d481e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 5.1MB
        • SHA256 cd6709d3dbf96ffff6fc6f5c06d987abebf56b8ed7396363f37bf81e2f75c1ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 5.1MB
        • SHA256 e678de799632647ac47a77eef667dd23ac63ecc8d80984b7b042877fb2f55934
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 5.1MB
        • SHA256 1bb4c2a421cd1bd16b01912145b19b28d762af868ad4f8b933469acfbed78e94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 5.2MB
        • SHA256 b69598b02e5eb70396ec510cef9111bf89da36b58b85d64654fe63cd234314d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 5.1MB
        • SHA256 5ea7cd8c54822b2928e210a1fca0f394f4bc169e85e2519cd3020ff19f8cde34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 5.2MB
        • SHA256 abda6612d0151247a7b0b6c1594b5ea61f5810fa6df1f0162631451071599879
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 5.1MB
        • SHA256 28dc0d28faa7654dd4d1790a187fec972e09f947482670c1b89291fd5bb516ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 5.1MB
        • SHA256 5390db76b70b46bd5bbc877803d614a0dccb5a5355508ac4655d5a568594829c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 cb64916a03fa5dfbb702b4b82aa93431492211056e342e17dc802636a841ac4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 139e5aede60ccd33d21d055359fccd01457e4fa9df87e4134af7e5df39e8d731
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 23b22fae5037ee1c594709b0a0207d37901f8f4739c9c09fce1e80398c107ef3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 cd5f5c65936345213a7492c37de0fbd836a85d3e652433e7c518fb21661f4729
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 255d5e2c0c21191c2b9931c9d893426b2ec2d71cfae640bfbb364a705b8f447b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 ee294a21c323f208bd5f4c518608ed08006eb107f2e23d0dab05b2880d270d40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 65d66f9a49adb54a7cc79164776c35b8b017cf586dae3f22b9b2f52aa97eda55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 0069a80ebb076a0bb41b3a82f989c7bcab4f8c4a7566b02eac6cf7bcbe4eb75b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 201f1b0fb2a2682de70542f1853e9054994cfa70a9615d70832e2bde8878d5a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4896-81-0x0000000002060000-0x00000000020BE000-memory.dmp
        Download

        memory/5020-66-0x00000000020D0000-0x000000000212E000-memory.dmp
        Download