Overview

overview

7

Static

static

3

2026-05-16...ar.exe

windows10-2004-x64

7

2026-05-16...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    16/05/2026, 02:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-16_e03e0af9c42f4a89695e90477496023c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 6.6MB
  • Sample260516-db36jaav4y
  • SHA256 299d78a0f35dcead3f80776b68753c72071f208c5fc177fb2992b2aecd0ae30c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-16_e03e0af9c42f4a89695e90477496023c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-16_e03e0af9c42f4a89695e90477496023c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5036
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4712
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3628
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3516

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 7.1MB
        • SHA256 5898a1b98647eded03da5aa2365917a1b8f76b7de7422d590653e05960651f9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.5MB
        • SHA256 a880335e8d61f50204316077aa456066ec237d120e1f0b01cbc790a882d43a6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.3MB
        • SHA256 c21205868bef5f121af3d6adebbdaf3f7aba1093358567f9ed528bd76712e5f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.6MB
        • SHA256 684433a96c83a8fd2f4f4b98917b739637e58c57c4a75a95586edb76c095bbbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConvertToReset.exe
        • Path C:\Program Files\ConvertToReset.exe
        • Size 6.9MB
        • SHA256 2fa9e8018f544d4d5dd136b676e1b608ecbeaedb173b3aa1aeca830dc4647159
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 12.6MB
        • SHA256 e57226a2328e430964a917b8c40fc1c440ee41e8f6d778742d5d1861408b4645
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 8.3MB
        • SHA256 0eb9dfef7447d4db423d916cd58103864e541eee54f166016eff6435f5dcc0e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 10.0MB
        • SHA256 c6c9fa9ec79259ea68ab15e06189d6ec9bc8fabc6c199c08a80efc586365f30a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 8.2MB
        • SHA256 fa171887246b0a43255446adf441d044a69b42a04ee2e5340319ed08096c03a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 8.4MB
        • SHA256 9edeb13bd1f5bed3f4b77f88a913d7258f61388a42a66b95981f594125d36b42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 9.6MB
        • SHA256 4a575cee3fa19ad8b4787a71e20c98fb52a4a55ec9b52516d6f5f2b7bf785463
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 8.0MB
        • SHA256 9aa3c17ee0035af0cc03aad57d1f3e1a4acb24b5f4788c64790fa1e462ed97cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.6MB
        • SHA256 3e5d875ef9a0bf5aca6b9f98f294f579bf1babd15ec83c2a6d2722f57c2c0eaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 6.6MB
        • SHA256 6fd4dabf843857cfdc63e942fde099921072b0857a3451f0dbfa57020764b4d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 6.6MB
        • SHA256 ef677202cd694dc964d56b1aa2db8b323866b310a7b107d796898201d2039077
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.6MB
        • SHA256 00ac6046a51cf757dbc9460fe0e22ad46b37f296aa77031974f04293973a35b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 6.6MB
        • SHA256 79e9a1b1539e626913d68f3855b2b9f25e43fb1bbf39eb60bb06d0f470cd74df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 6.7MB
        • SHA256 bef3da877a4de1740be6329931d053023f8962b20a53dd96b27bcc8191a14f36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.6MB
        • SHA256 1f65cba26e904762608a359c723f9b56ab34948ff9a31eb1e097749873d71bfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 6.6MB
        • SHA256 99c36edd46398073000f86963d7427e05f469013e053d9e6ea166400bc0382df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 6.6MB
        • SHA256 be7adfb49a6baa9c8ca5214e0356a5bc13e76863c432686d4fd2197e875b8b26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 6.6MB
        • SHA256 299d78a0f35dcead3f80776b68753c72071f208c5fc177fb2992b2aecd0ae30c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.6MB
        • SHA256 83df0907a06d8898ac8abb89b9607efe46d4243a2066be649b031fdd74d75750
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.6MB
        • SHA256 6942fd86a8de5fd8170c8b43c2b456a7052d1b558efb1ea9bff1159b44ad5639
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.6MB
        • SHA256 aa648a1df3d9b31114cdcfb2e624851c6b832bd5358a8fccfaf72ec821b0ed3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.6MB
        • SHA256 3facc5a2f3365d78c70d33c236fe2fc4ec60ee8dc06727eb216c178d333d3661
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.6MB
        • SHA256 80080e350dbae4e406287ba50a73d57f601f2804e5413b0a89a3c3a14570a13d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.6MB
        • SHA256 08c4aeebafede93b896b775be1b7034652604ad10a4cf619fe05c5a6e35fe8d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.6MB
        • SHA256 5c071f98c70080a6f9cec48b1fa07dc20e5d2a6fe9a7e4f0661bf7b4474a51cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.6MB
        • SHA256 43658cf7a34f5dfa74552b8af33ffbe289462c3ae9e5cc9c577bde8b9fe0354a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download