Overview

overview

7

Static

static

3

2026-04-26...ar.exe

windows10-2004-x64

7

2026-04-26...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    26/04/2026, 04:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-26_86584fece34a3e4aae76bf160149f931_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
  • Size 918KB
  • Sample260426-e9rqtsf15m
  • SHA256 fb36c9aecc44d975c87a77eeeb2a9c778a9433f3abf63c60e32c02e4e3077e7f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-26_86584fece34a3e4aae76bf160149f931_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-26_86584fece34a3e4aae76bf160149f931_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4364
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3980
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3368
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4372

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 1.4MB
        • SHA256 02d330db1457aa253e87377b82a136579c3f9b17b72a0548bb5a4b9976fc9c8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.8MB
        • SHA256 e9e6da2ca1bf07faac71d842f7a5003507b40c24f8f29cb58179502b93b7d847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.6MB
        • SHA256 bb109ee3f542f79e98c3862ae33429c38eab07aa3c47df15d845d4c6d0d97f9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 932KB
        • SHA256 77478fb671eced979419e569f4a34b908998d16ea5ea8c28dd8a6469b4dc7421
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 7.0MB
        • SHA256 6121199b1faeeae1b16844410430e5066e0855bc751cad1d5f9362c424106347
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 2.6MB
        • SHA256 19bed4e28a63dc58e2a5b491e87a24b6ae751ae7c2bcfe80d9ad68997434d739
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 4.4MB
        • SHA256 9e9378dab75db98c75b88689526892c4b07e57d5b4910c464e902e50128dbd2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.2MB
        • SHA256 ac0a33500911c4a25df64bf6d2f6b0c2c6b9301e0304b339c3ee5545b0b3da0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 2.5MB
        • SHA256 995dd4e22fc6db7c5f8c54dc45e8cf524340adcd069a78187d4e203735cb0f3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 2.7MB
        • SHA256 da21b4249c853a8c07f69ece2a02253997d6b51b58c3f1dd4c46b709b010a061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 4.0MB
        • SHA256 03493dbf73db99bfd2271c3ec7fd78e0880dbae850be7bd300471678976decd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 2.3MB
        • SHA256 24b3424c21b1294ca14c8acdd69a1e0e11ea0f622b990b1c2c210d3174404ddf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 942KB
        • SHA256 9d87c5396f03184bfc013ef86a2c6554fd84424f58ab1d1400104b53596525fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 942KB
        • SHA256 837bdeecb49f4d27e0164a422e1fc05fa0a9cd84e46d9b2a061152ce8bf67d34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 942KB
        • SHA256 2a4e5d0ca81bcfb3cf842504010ad8044f7fd31dfd7544948c99bbb741305a2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 962KB
        • SHA256 0ec96cd60cb0f9615ca3b05907ca66d93d030da1efcb5e91e2a952a8d0430f24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 942KB
        • SHA256 2a8e3643d5f91913f810706cd4e0dcfcb065439d50c6d3eb297b724a61c8fc9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 942KB
        • SHA256 c189ae1549607f50d9e2bfb551e2b25b8a3c4e4f3bcc3142c5aa2a164960f01e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 1.0MB
        • SHA256 54a2d5003413d96998030285d1c8b16306e9573d5d6a284b20eba6b189364fc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 974KB
        • SHA256 eda591dcaa684355048f1e1bed692a8cfd701fe39a5c1ab959fb38031276674c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 982KB
        • SHA256 9126d2c705efecd6308cd76ddb1cf954af8d98b2975cd3790cd911aa5d8c9bba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 978KB
        • SHA256 b83e6f371e25c5d75a82f4d5823697c0621d6edc8ec5fc9ebdef5a02cb57d02b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 918KB
        • SHA256 fb36c9aecc44d975c87a77eeeb2a9c778a9433f3abf63c60e32c02e4e3077e7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 918KB
        • SHA256 b5cca18e05136eb14bbf2824447942baf70057604a2d356776f5c5e45a9c96ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 918KB
        • SHA256 9711a2d62a7a1f786b9ebc57bb50ee0bf25a02ec535044374bc336cbcdd0c20a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 918KB
        • SHA256 75fd5ba2443782e3f6c678ce4763adf289d18742a22bea65422af84708914e43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 918KB
        • SHA256 485517323267107bd9835721cc7dd9efecff370714b3be3122823d192cebcd51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 918KB
        • SHA256 79ec62ccfd1b0a9ff80b442d6bb3d3afd0e1761c9500d8db99237c60e2d4b727
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 918KB
        • SHA256 633048a268d92d796fc20f2dbd9d0565532b12d53efffbedd137398b45361545
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 918KB
        • SHA256 2912fddabe64745c2d4cacfa258bd91928345692ef2768ad4b147b636e319d33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 918KB
        • SHA256 42b6fb1386473cb7f8c36ec15dc8f140765407964d2cb502a10d93abe30827f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download