Overview

overview

7

Static

static

3

2026-06-02...ra.exe

windows10-2004-x64

7

2026-06-02...ra.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 16:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-02_15a8a471b1e54b231e924b7db0f02257_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
  • Size 19.0MB
  • Sample260602-t4vmvsaw8s
  • SHA256 6142e7250a74d16f2965f9999db41c947d412fc824b6112555eaf18eccdc6e58
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_15a8a471b1e54b231e924b7db0f02257_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_15a8a471b1e54b231e924b7db0f02257_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3096
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3464
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3600

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 19.6MB
        • SHA256 549b8efb3eb6c7df48e4d91d3167d40489ecf0a28a1f45b348d6cc442a15cb10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 20.0MB
        • SHA256 9f5c28eecffacb27d29cf249d757e50fea0f702a204fc47e4e10fb476aaf61fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 19.7MB
        • SHA256 8168ef0e70e360f35f9e451ab7fbc0447bef51afb35a9e693e5d11a5d7d311bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 19.0MB
        • SHA256 6746ab3c76f0832b04ec4c6e6432afef773f46ac3d16c9e48c57c4f8dab9aa14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 25.1MB
        • SHA256 5ed83b21d5ad54f95a176dffcbcc140d0bea04aa45cd111f041b910be0cbee61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 20.7MB
        • SHA256 754242caf4e9128e90e186c7b6a2c300e024231e981cdf6723108ad6baa9b30f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 22.5MB
        • SHA256 5d5d9c585272634eb385cfafc39074eace0ea92cb9b98cc62ad33ae9a77a7c45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 21.3MB
        • SHA256 21bac8643708d318e50fb4084f8a482d877347dce1f1494c3c4a529dfb155083
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 20.7MB
        • SHA256 70e934fa530ffeb7064c387243587536df86895e9bdd42e1b549cd9524a21496
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 20.9MB
        • SHA256 85ee7a6359af11339447fdc9af465dfc75c08b1a3b99487b7b021f0528f222a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 22.1MB
        • SHA256 f4303c4b3ffa3c516bd7ee6e7dd68b8c7db76a2e1d1e320620a04c62b240d68a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 20.4MB
        • SHA256 2a82fe7402614590657245283dcc0e9bbd79522b247a2ec3213d6a62f369ef68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 19.0MB
        • SHA256 b12a4dde17d93796be7614771820c5bc413048e62df0db35562b1cb680d8f624
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 19.0MB
        • SHA256 00a0c3d7a5e61c6f7a0d27e9ea06bb40c7c843e8104b14e57479f423266ecaf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 19.0MB
        • SHA256 f2ce6eeaf894923138a9dbb505c8ae3e181a758f764f164fa90ea4f430d57719
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 19.1MB
        • SHA256 ca285a2af7406f171ae3147dea1c678bccd4839fe9043950defaee4c14ab8cd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 19.0MB
        • SHA256 bb1681b60e8cc900185ea916469c273feadd0b58eaedd699bcd128b6192eae33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 19.0MB
        • SHA256 3f8b04aed69cc49fea660c6edf114cad281a8ef8456f43c46395750027d9326b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 19.2MB
        • SHA256 4e992deee969a40fd1182f4829b78365f0e3b98bdbc244dd9730819ce7237726
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 19.1MB
        • SHA256 b32ef6673621d1dfcaee24164e56173be96281ea9342286c3d6da714a3e59bc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 19.1MB
        • SHA256 da5ea8e8d56833de1ab214c3fed68828c432fee0847156488e2f2b83854a0023
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 19.1MB
        • SHA256 48c41873fd9839edefc782a2be3738ddb8013654e34f61da5464db9222bd7c92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 19.0MB
        • SHA256 6142e7250a74d16f2965f9999db41c947d412fc824b6112555eaf18eccdc6e58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 121.2MB
        • SHA256 c4ecfb6acb21f169166c62ad8f6ca24fc6ae70e7f3283e2d87821bcaa25b473c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 114.6MB
        • SHA256 8d2ca286edc986aa88965aa6221cde3be8ab49385fdc2f25d87107d74d72ac86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 115.3MB
        • SHA256 db757178bc0e50556dcfde2c318cca11485e1a62f0fdb3f0a25bd0207d0217ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 113.2MB
        • SHA256 d6c9a826fbfbe784b5591ed8f9fa28537eaa8945e87664460839eecf1e96b517
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 108.1MB
        • SHA256 9aeb32c963eb6c295bb52ed28d76ed9fec2bc4b144694c6e67a3cae1d7a0667a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 113.9MB
        • SHA256 533057d3c3bec0b9baf5eadf427d837fef8f6707c04c1f003b0dddeab8b6e155
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 112.9MB
        • SHA256 7938d703c63b853e7fdcde89925ba2f34a9c93697e3e031e85b70663204c0035
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 110.8MB
        • SHA256 dff8bbb42665f588a447e8b6f9e7a105899c731da9eac7fac96796fc9096859d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 114.5MB
        • SHA256 d59f08ee0ee77a7a47366dc4a78eb65dcd7bd097172633cc6170a3e5af43e070
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 116.2MB
        • SHA256 f04594fc683c9426ff6277e1b59009c37d7348fab11c2770953a02f9ed5e9599
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 112.5MB
        • SHA256 d542d0b9fff93c925c5d9e2e59298598dbe0c3c01526c62d1e6b87a3c4ac6e6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 107.9MB
        • SHA256 b9ab9a787dc94bd226d0941f51937559802ce01339766fe8ecc24f9ba6abdc31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 112.9MB
        • SHA256 2501a1bcf6e0340cc65cefbfdf95d465e0995001390bcf461ce1663e7f9c1d2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 111.8MB
        • SHA256 c2769818303de12d93d06ef0f909a75b91cc050a8bebe635e5e489f185a26042
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 111.6MB
        • SHA256 d8a3592bcbae78567cc897494bb25bcb3ff5bb4263ef48de30dad7f4c2c35d31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 111.1MB
        • SHA256 fc75f6bfd99b05ed5c489a0672445407686bbba2015d07cac39b7ca0ee4973f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 109.7MB
        • SHA256 6194b867985a074ac9913a2e0982b9211000240b7a149f52279ecfe24069ee8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 110.8MB
        • SHA256 88524e5c7ea75891eba599453e58196959725316615b5c37f40fdd280dcbc75a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 19.0MB
        • SHA256 f9ae858b4ea7d23773c8cb1d0fc1e1c2cc4a3c4daae5b4e5d5b461cf548a183e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 19.0MB
        • SHA256 2b8fd3c6009f63daf43e6312f25ab6a2d439d4fd66f2b7d4db4e0b637e746727
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 19.0MB
        • SHA256 b8901e0521087a9b521a1ce21329ded00d49101c12e11de8028963ae85fb5e31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 19.0MB
        • SHA256 855d30040e7b4b623c877a0412b3082029bf3ea2767732500728640266eefbc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 19.0MB
        • SHA256 ac537f5611a514e15edac55c3726e11e6101754eed34b6ccab5863b6f5882844
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 19.0MB
        • SHA256 4ed98e93066282e475bc1cba38b060be8f9d6617ce5a33cea4e644e455b9e9e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 19.0MB
        • SHA256 4dbd8d9e821558de70291f105c73164e116fc75932d45a8e9fbfa7575c0053c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 116.4MB
        • SHA256 c3eb5a814ace6e8f76904a0f73ef6292e59e1733bb7ac9bc8363bb28c20e4af1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 119.1MB
        • SHA256 0c41e01b03ccf100937e299e688b7bb0f8e5bfc10e6b52624928e29416c537de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download