Overview

overview

7

Static

static

3

2026-04-26...ar.exe

windows10-2004-x64

7

2026-04-26...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/04/2026, 04:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-26_86584fece34a3e4aae76bf160149f931_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
  • Size 918KB
  • Sample260426-e9rqtsf15m
  • SHA256 fb36c9aecc44d975c87a77eeeb2a9c778a9433f3abf63c60e32c02e4e3077e7f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-26_86584fece34a3e4aae76bf160149f931_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-26_86584fece34a3e4aae76bf160149f931_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4588
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4708
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3660

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 1.4MB
        • SHA256 02d330db1457aa253e87377b82a136579c3f9b17b72a0548bb5a4b9976fc9c8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.8MB
        • SHA256 e9e6da2ca1bf07faac71d842f7a5003507b40c24f8f29cb58179502b93b7d847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.6MB
        • SHA256 d636a4bdb9509da6e3b06605220f2fb02c289c6a02e6b3205fe654f262dd000d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 932KB
        • SHA256 77478fb671eced979419e569f4a34b908998d16ea5ea8c28dd8a6469b4dc7421
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 7.0MB
        • SHA256 6121199b1faeeae1b16844410430e5066e0855bc751cad1d5f9362c424106347
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 2.6MB
        • SHA256 7d797418e500b0fc87e77f1730ce650016a423362b503fc3f2445683d7da9b74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 4.4MB
        • SHA256 9e9378dab75db98c75b88689526892c4b07e57d5b4910c464e902e50128dbd2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.2MB
        • SHA256 bcdb791f8b882ea114698d1388ced168e73f343258e653b92c094ef39830623c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 2.5MB
        • SHA256 995dd4e22fc6db7c5f8c54dc45e8cf524340adcd069a78187d4e203735cb0f3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 2.7MB
        • SHA256 9a2685e2f805c8718233d0c50664a426be8fce27b1a6a0b843d289eeb064b911
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 4.0MB
        • SHA256 235f3535c6eb61355d95bb96c4194dbddef68b1acff46160c79f9b3fa8238295
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 2.3MB
        • SHA256 24b3424c21b1294ca14c8acdd69a1e0e11ea0f622b990b1c2c210d3174404ddf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 942KB
        • SHA256 9d87c5396f03184bfc013ef86a2c6554fd84424f58ab1d1400104b53596525fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 942KB
        • SHA256 837bdeecb49f4d27e0164a422e1fc05fa0a9cd84e46d9b2a061152ce8bf67d34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 942KB
        • SHA256 2a4e5d0ca81bcfb3cf842504010ad8044f7fd31dfd7544948c99bbb741305a2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 962KB
        • SHA256 0ec96cd60cb0f9615ca3b05907ca66d93d030da1efcb5e91e2a952a8d0430f24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 942KB
        • SHA256 2a8e3643d5f91913f810706cd4e0dcfcb065439d50c6d3eb297b724a61c8fc9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 942KB
        • SHA256 c189ae1549607f50d9e2bfb551e2b25b8a3c4e4f3bcc3142c5aa2a164960f01e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 1.0MB
        • SHA256 98a65f5270ff839dad5fd37b2e3cfaedf6ea9d40f156dcd01c3799ad5baaab82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 974KB
        • SHA256 eda591dcaa684355048f1e1bed692a8cfd701fe39a5c1ab959fb38031276674c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 982KB
        • SHA256 a9ca8435108ed40e0c707921dc9cf5e3f267438966b5fb02dab7342611d05af1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 978KB
        • SHA256 b83e6f371e25c5d75a82f4d5823697c0621d6edc8ec5fc9ebdef5a02cb57d02b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 918KB
        • SHA256 fb36c9aecc44d975c87a77eeeb2a9c778a9433f3abf63c60e32c02e4e3077e7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 918KB
        • SHA256 b5cca18e05136eb14bbf2824447942baf70057604a2d356776f5c5e45a9c96ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 918KB
        • SHA256 9711a2d62a7a1f786b9ebc57bb50ee0bf25a02ec535044374bc336cbcdd0c20a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 918KB
        • SHA256 485517323267107bd9835721cc7dd9efecff370714b3be3122823d192cebcd51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 918KB
        • SHA256 c05b1f26be91ddd29417cbf659bcbf5f01f2a0d8aa1e8e90bd184b1a780a6d05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 918KB
        • SHA256 79ec62ccfd1b0a9ff80b442d6bb3d3afd0e1761c9500d8db99237c60e2d4b727
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 918KB
        • SHA256 2912fddabe64745c2d4cacfa258bd91928345692ef2768ad4b147b636e319d33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 918KB
        • SHA256 1f84a966db169f370df663435989522a10056a631faa1b010160ca459b3b3e73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download