Overview

overview

7

Static

static

3

2026-05-05...te.exe

windows10-2004-x64

7

2026-05-05...te.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/05/2026, 04:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-05_ff30dd2809cb5ebc13e764f44ac909a8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 2.4MB
  • Sample260505-e6v9vacv5k
  • SHA256 1041b19e40e598910c2c32ff81469a4754b90ec37b106fc30a459c6f36147baf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-05_ff30dd2809cb5ebc13e764f44ac909a8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-05_ff30dd2809cb5ebc13e764f44ac909a8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4880
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4908
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3780
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2856

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 3.0MB
        • SHA256 8d00908eb5c9a3a1636f533cc8bb83cd254c64e7da4a1b1b12e9d0a25cc70f8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 3.4MB
        • SHA256 df8b4d8b05a3c04d9f65054a1e9997bb004baf448131cb6855178493a00ca62f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 3.1MB
        • SHA256 c648d83152d97c6af7d1f3dbf969ad8dbe93ebf7f92dbcafb075726bd8f4c99f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 2.4MB
        • SHA256 8df8ff41e0d3c271640f7af56f03303907f3a365c483658cf92f1feb600cca3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 8.5MB
        • SHA256 2b4d8657a0999eb9c70535fed0307f751a13c2d4c28959e18286d1f17cef128b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 5.9MB
        • SHA256 25fd0deb782260b00925dd5b52900f9725b88f9e7d29221e4edd97d07f526362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 4.7MB
        • SHA256 4c1240782ee05b41402734f3403d11ba04604e6bbca2dd34dce515d3961f44b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 4.1MB
        • SHA256 7c7cbe018a35cdf6caa0df364892764c971e4ef6b0145caa4e0385dc0fd3ab76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 4.3MB
        • SHA256 4d3ef190adb270f2d00014c63fb21495daa78887a7d8248cc95a6cdb35cb9468
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 5.5MB
        • SHA256 005469db8ff61c9f4737f0dad4d7967cfeb5e599f539c4e79c83902c715e2b30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 3.9MB
        • SHA256 e35c377acae2c18d26725aeeb4bcc7fab8b7830f830332d242977da41b1438e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 2.5MB
        • SHA256 e0c7202711ff5bda426df3adf156deec9864c1cbde756eaa520735f439db5feb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 2.5MB
        • SHA256 45171cc445bb25c8cdb911173be28ee8fd4154f3155e47bfd28e33e60f08c2ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 2.5MB
        • SHA256 629f13313b368b7fa7e0b1110f5b0ff2642e9eb76b3b8a291267130239b7ab01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 2.5MB
        • SHA256 1c403f95a472b9e2bdedf010e8dec61d6711465f68fc53e7d06e22fd64009454
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 2.5MB
        • SHA256 fba3f45778ccaae8901d0c85f4072003853ca07e3019f6a8ed3fb3c104a35f6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 2.5MB
        • SHA256 8f119307484cc6e749f49f0d7359612d3f15e07e83c4f211e08595f8fe6f5cbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 2.5MB
        • SHA256 cf868b56356c291f4c5fc25e6ada649405b7538fc92af829cca25538c5e804d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 2.7MB
        • SHA256 65c62b65a9830bde931591585802d66b6b560db2a00493d85ddccc6e361184a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 2.6MB
        • SHA256 6e5053f7e28d0a652921263da67eec1b939ff2b9e7484473ee0e9af673765016
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 2.5MB
        • SHA256 01566bc851453b7a6aa04976b9c2df1684f06e5fffc33ac121c76b69eb41ceb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 2.5MB
        • SHA256 61e69d59cebb5cc5aeb8b4935b68c8f67b9cf8279076e47171b1fbdb8bfbe12d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 2.5MB
        • SHA256 d69557e33f3a3700c399c893d222dafb9ee8f2351b24ba1b3f3d455443dd5203
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 2.4MB
        • SHA256 1041b19e40e598910c2c32ff81469a4754b90ec37b106fc30a459c6f36147baf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 f8909b34eb05d7c06c8c4ea2e858fb84c4a18650ffc9c9eb066653423fb12255
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 1172bf5f9840b8c1cebb82962884dae8b0471dbaca17368ad5ba31799afe8d37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 7ccbdaeeb4104748dacfe30a3f96750c761a93156faa59e84c0520bb676031fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 e15ae8d59798dd62de6fd6ade04f56c3726ed7468599e87025644863be834b94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 5b025ac17f3ba682dcdc7ddae9b7740b5ab4ab7a00e7b5a39b16faced8fb507d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 be00677d85ae2142f20e9f5c0dc6c3fcdb07ee11c29f7ffaa85c4a8e7feddf85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 f22be00b371699273ad89741ffec3286dfa049a0e4359c9fdaea06296780b6d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 6819ec68c77e75a5dd318941d3f6287a7e682f7027f4b1e4c51ef074c5ba51ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 e375d41a2e9fde5c1f419906a4343c1d475f14a765f79815139344029ac1abf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 bbac164c6d4ff73c8ebe88690aeebfdeb29ff42d0e935a6817e9797bf6afcad2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3780-81-0x0000000000860000-0x0000000000AE1000-memory.dmp
        Download

        memory/4880-66-0x0000000000860000-0x0000000000AE1000-memory.dmp
        Download