Overview

overview

7

Static

static

3

2026-05-28...ar.exe

windows10-2004-x64

7

2026-05-28...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    28/05/2026, 14:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-28_6913de06cf89eb62be3bf7528811e033_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
  • Size 7.3MB
  • Sample260528-rt744aa17j
  • SHA256 7470e9c496dcd3123e1262b8b829ea2c3e2a91dedba7357a5a5880fc581df9d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-28_6913de06cf89eb62be3bf7528811e033_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-28_6913de06cf89eb62be3bf7528811e033_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4668
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2012
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3624

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 7.9MB
        • SHA256 c02d05a40411669215fcb0a96c7697c94dfefa136812be01e7096f8bb6d59691
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.3MB
        • SHA256 d9f7a4ad991cdc289211552c17c0252dc37350b1460e5ab57b55d92af2660767
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.4MB
        • SHA256 b1e98e1784282759ca49cf90333fe5527ee0d32073d5f665443ac62999ff3fba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 13.4MB
        • SHA256 9b44951f9df23cc84c5f21aa359f1e6d5e2e3aa37f968c2bf6825d66c5de63fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 10.8MB
        • SHA256 056066400bb766f162f5bb6cb60f23178c86114a3226f8de4e1f78da50a69970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 9.0MB
        • SHA256 0977c1eb2b4d91e98d4b6fb3520eb0f55a0fc4122761a0dd29d45f3ec586c27d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 9.2MB
        • SHA256 8f6aa11fb1d4004e391e740d2190b9cba21030ee507fdfee0fef40fdcc414290
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 8.8MB
        • SHA256 56e01312b4ffa568d624297d6f912df2a7888797ab2bec7140e0f32ad3486dc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 7.4MB
        • SHA256 c04c915ae9b04a7a640ad926f2f3b5addb8d145b0b78ecace23e690d4572f594
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 7.4MB
        • SHA256 00b91319c57783500151486f8eaffc6118148421f3382fe459902eb2fac58ced
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 7.4MB
        • SHA256 b0869ea2af9d4d2c831c9382698f739ad317cebc90ef4fcfe04db6673ee846f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 7.4MB
        • SHA256 29a8edff328f4cc0610cae5edbb3b8bd8dbb9fb042a374aad95099a97c374bc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 7.4MB
        • SHA256 ef16bedcc2ad802cccb7f0abd2a5eb0d39afb45e52768ec5ab1473fc4ae73cff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 7.4MB
        • SHA256 e420f4b6a0c87209b1fa76f5cbfa46de8a5a3779cc6063c830145d0780ba55f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 7.4MB
        • SHA256 227604d465b8a0204c7914c4cdaf146e50757ce6c066e607231db45b28b37038
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 7.6MB
        • SHA256 742c3b568ccbdadc6b07fceb7c62c4e1ece887da761e24e5cab18a6b22fa98d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ResetRequest.exe
        • Path C:\Program Files\ResetRequest.exe
        • Size 8.2MB
        • SHA256 8313c44946d0856c24b802c5d573932e8ada4fe7a3e380bbea3ef2cbe16f9f28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WatchSync.exe
        • Path C:\Program Files\WatchSync.exe
        • Size 7.6MB
        • SHA256 31d1300d7e507a310913c507d86a871cf428cd1c2a5fb30ab5728ff0aa6ca6b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 7.5MB
        • SHA256 cfd818e4d639fb76e15586119dcfad230736e9f328fe63e9b5e1ec1d396b4495
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 7.4MB
        • SHA256 7b2887eab2a610acd7ba7a55a849c4e2c6163bd1decf0159cc63b7cbb28b63cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 7.4MB
        • SHA256 4e5384549f4e7c5284db783773b2c3c5f274420b8c4b4b8c747b32d3dacf1f16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 7.3MB
        • SHA256 7470e9c496dcd3123e1262b8b829ea2c3e2a91dedba7357a5a5880fc581df9d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.3MB
        • SHA256 0d07ab68c62458c7031c0e75c5d65cef715ffcc8abda33568e6630d895cca079
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.3MB
        • SHA256 3890be86bb82e1fbfafe8706092d1974ad382efe855ed63fdac79e562d244f86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.3MB
        • SHA256 080725d19a5fcbef22aa80e5f31c8a983a96839e1886042558debe31a259e205
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.3MB
        • SHA256 f4bb578e0e65b9f80ae2f93cca97294530a8072f8ac0226b6b317ebffac7089d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.3MB
        • SHA256 ec40715b50c08050b3b52d7b15d94ee2428791de9a491f33573b7ff192ee86a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.3MB
        • SHA256 af3a8369e9058b7c1c7a5e765d51ef0aa39324432eef7bcd9df62e1daa70da91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.3MB
        • SHA256 5eee16b4ee7f814e1400d5898bf7a0a8bfde47fce3346ae28116a427c99c9256
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.3MB
        • SHA256 a7fdd8b8679ba07275fe933cb938a9f06224e9326c57b08fcf419054e0aed098
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.3MB
        • SHA256 97b12a55e5ea5f445d8556d3b80c33c6819d305c46b348d05af80a80221b8adb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download