Overview

overview

7

Static

static

3

2026-05-07...ar.exe

windows10-2004-x64

7

2026-05-07...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    07/05/2026, 04:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-07_9ff8bc16fd9042521f2dfec77d8b881d_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
  • Size 5.5MB
  • Sample260507-e3y7bsaz8j
  • SHA256 ea6943f7713d7d031c0eb3076778039c302684b13125dab2114187b42d8b6b6a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_9ff8bc16fd9042521f2dfec77d8b881d_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_9ff8bc16fd9042521f2dfec77d8b881d_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3924
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:748
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4132
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4184

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 6.0MB
        • SHA256 9956a97e6f02d05012432ed7bb24cccb505bcf4e646a4b4a9ca538587df5a199
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 6.4MB
        • SHA256 a77b49b735dbeadc236b0572e19b2275827cae9580144df033483b03f1b877aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.1MB
        • SHA256 90ac6cccf7b646b8e30133e0d061e093026085fc027147284efbef9883cea9ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 5.5MB
        • SHA256 215ab4c209f2ba2362507c3598d378cfb3244c958642ede891bef9172e5c1d25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 11.5MB
        • SHA256 e8a051bb25767bfbaf2bc9208388b0e589550fe2fe4856e975b92be408700b89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 7.2MB
        • SHA256 e9cc6f4ed60a4fb10cb675c5c7a68e5df70077d252635c9ae8af7c023b711236
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 8.9MB
        • SHA256 cce54d59df92c9ac16b50bbaacd2b93eb3db26a129cdacf5608f204d77ca089a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 7.7MB
        • SHA256 8b0d82f80a69b04cc193a1d3a506a5466eba3c8da5938a732d4993d0f5e52eaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 7.1MB
        • SHA256 964b35a67db6af42ba0031627ef0487a486a5dd7ce44ce3895b6b0d7733dcb83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 7.3MB
        • SHA256 640c8a37a570828bbafa29a6bcc1a78820cbe44c1e1f916cf82ebbe11bc27d76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 8.5MB
        • SHA256 5e628c0c271573dab6cd9168943067dec6f20dd22a7152af432bfd745aa3b3b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 6.9MB
        • SHA256 03fb2ee2d6b01d25908fa95a587041e62a990283393c82bfe88a6da16681f55b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 5.5MB
        • SHA256 7d38a199c5a8e85d77b4c49bae03a769b340a7adbea77aac8cc9da182ec2acaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 5.5MB
        • SHA256 05236b9ceecc3104622be985eab5395d3df9dd8c7a0d747518316b7aadb1408c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 5.5MB
        • SHA256 fec27f1bbda94f3c5ab05e4aa97182e67ce0364019f4d66a60a059301ffb8c7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 5.5MB
        • SHA256 28dceb6f15a0443b7d8704d4bd13e1bd813ae277fd4b566e999be2713875b554
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 5.5MB
        • SHA256 f13642ed4d557721ceece00f9f855a52a893e78cc4309270f2c0812b1fe872f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 5.5MB
        • SHA256 c58f5f690b958704ddd197b4aa8ab4b9e9593a7a7ec49d1d940136e6e47b46cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 5.6MB
        • SHA256 d91d7e45b274fa6d1514196cc69826e1511ad4408b83c2e6d966b3bb05d37b5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 5.5MB
        • SHA256 db79ad40a6aea9d0aecf1e2583f1e909e483f4f8f5bb63e9c41d9bcc1f950b85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 5.5MB
        • SHA256 3b0f900d1e4ba262d50e3a1b030f5b0812f3bad3bb7cb083a0dbd6880a087dcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 5.5MB
        • SHA256 81e9e958d18e27cd8c23ae4278485412ee11c9a705f856b2036bcca4351c278e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 5.5MB
        • SHA256 ea6943f7713d7d031c0eb3076778039c302684b13125dab2114187b42d8b6b6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.5MB
        • SHA256 662f6fb4358a4cca95103f9ffb3158a27f038be91f3cce4e4813d6454a6ad9c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.5MB
        • SHA256 f0c18910a084248126222c8a15d02af23657f45d8080073dba65d9f1ee7e8acc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.5MB
        • SHA256 e4f5b24a8a3ec5848b7d81221d1dbfdb43146ee22974a580858bc53b50b447b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.5MB
        • SHA256 e58adefc0de26f22477c9631cdbd76b1edceac71ad51d3a6ffd4fa128caf0006
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.5MB
        • SHA256 4d45fa3907824659433dc9cc248fa8086a296670cba39a6205f34469d9dee932
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.5MB
        • SHA256 08b83bb8bd1deaf1214dc970e364d52f00439fb4546e2ac7a5025e7859396b98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.5MB
        • SHA256 37c075ec46209a1d4159fd0ae511f3767a3505f3ecddb196e575f7a6d0213cf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.5MB
        • SHA256 c7e1180ad50e16d2a187fcc1e313b02cc11dbdf64c24ac264037a02bc8f14cbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.5MB
        • SHA256 9d26e54784f2d07f02d58a77283b01dcb2db611d4042a45108fd943563d313eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download