Overview

overview

7

Static

static

3

2026-06-02...ar.exe

windows10-2004-x64

7

2026-06-02...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    96s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 16:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-02_332dd9dd25ee93a5c1a3db4d4d1758ba_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
  • Size 2.0MB
  • Sample260602-vb3nfacs3m
  • SHA256 0f7c0624bede4d0cb06726dd0be9f62ae35ee73045de9060843286c2f6495db2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_332dd9dd25ee93a5c1a3db4d4d1758ba_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_332dd9dd25ee93a5c1a3db4d4d1758ba_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2816
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1800
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3692

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 2.6MB
        • SHA256 cfcbd1b2596739c2e12c82c2a88afdcbd5b5fec28838e7a189e615fb8591e576
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 3.0MB
        • SHA256 061dc78b2643c0ac3ff26a32cae5f2f6bb858c28048d5a003f797ffe2b177c9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 2.7MB
        • SHA256 036666f13c797b4ee67a242938ca354a2d439aabc900c737b6527ee0c99cc79d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 2.0MB
        • SHA256 bbe303bbb55a12cc85094f113c119e8c47cd91912ca9abca08147279d6e5f003
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 8.1MB
        • SHA256 cddcedf61c5be5234eaf9f2eb8f507baedc958e2d4f72132c4312e4f19083a76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 3.7MB
        • SHA256 8f955ed7220fdb1074b99248625777af52e32b49d82873a08ad4c70fa8e63248
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 5.5MB
        • SHA256 583dae8c4612babfc588f9e51038ee8398e116c8a32d2eea70f0496be79e4659
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 4.3MB
        • SHA256 5cddbe1adb906239f264f16555d677eb2a4d5d8274a2fb6678e177957417d52e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 3.7MB
        • SHA256 d8b1f2b813372850a7e2351b86aa85a489fb2b3497a393b9be4feffd0034abef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 3.9MB
        • SHA256 f1f3fcdf576e939c12436cbc6bc9122d9e9c7616506c68819d147b02398fa10c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 5.1MB
        • SHA256 53433cc98aedf190da91f562da3aca792e4054766ebdd226d9dec172ead6e0db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 3.4MB
        • SHA256 db2fb801ff199f204afe86aa1360c3f1dda6d856532fbbbbd3791eff8bee2907
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 2.0MB
        • SHA256 aab59fbc025ebc7396ee2182d68b1c4660d9812224705ba1857af7e2059c5b9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 2.0MB
        • SHA256 7b69969aaf4a6189a34aa99daf27933bb65c5bd24ad15d94511c2b4064da790c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 2.0MB
        • SHA256 6325ea4451742aeb6515c35ddca2ec779759cc4eea3a24512b24c40e6b37d88f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 2.1MB
        • SHA256 1ff11b5ae3e62bb49a7988bec2e44cccef503f7c8d96989ae2922065b8a73f76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 2.0MB
        • SHA256 78394b4a9b8279486525057c361e8d5ca75c5969dbc285f959d9f3791a6a3344
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LockSkip.exe
        • Path C:\Program Files\LockSkip.exe
        • Size 2.8MB
        • SHA256 8a3ef096b0421f7f3f43eaad22ffcdb276625d4880bf9203b905684bf0f8626e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 2.2MB
        • SHA256 3c481662026b8579f10779eea94d8057edd8f8658dd4074f6e86afeb807afda6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 2.1MB
        • SHA256 a53f4a2d3829b46947a7384809a0d81ba7810f15f02df7577f0c122481576d97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 2.1MB
        • SHA256 13a9d2e6831d24ed280fbc5d2b0b486565a17e2fb89e80875920b753fa0944af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 2.1MB
        • SHA256 c75e5155892647dfadb842d652ada9d8e8b0b42bb56860e9595022ba12a19965
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 2.0MB
        • SHA256 0f7c0624bede4d0cb06726dd0be9f62ae35ee73045de9060843286c2f6495db2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.0MB
        • SHA256 0d1f020de25f49f029121cdfd6d9c06a84224ca36289e491c44b1c789b3a8398
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.0MB
        • SHA256 71d7c5944f5f08b38820e3837554641d5211281f6deda8d54833945abc74497e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.0MB
        • SHA256 ba63d3140f2a25ae3025b0adec49e0a4e98c69ebfea291c778f3180f53f7de2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.0MB
        • SHA256 f2574d1efc5ef7013cc0548de210232737685fdc96571db72d5471b5ac4cfa07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.0MB
        • SHA256 f0b2f2a905ecefb475bac36132f9edc66dce50811d932c86533d1a6207dbb09c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.0MB
        • SHA256 0d9a639bf6ea8055de80431e2549075983b60cf5423912d688294be65fae2e0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.0MB
        • SHA256 38e4708602abde256cbb1800d528539dea896660c690af9c166fbf86cb427316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.0MB
        • SHA256 c1fdc3de9823bf923388ed34596e9101d5ca334fd13f7202e9504d7f21ba0adf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.0MB
        • SHA256 4c70e37204158825b6c3556ac143e9a3456c30e013134beab3b45149c841ab7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.0MB
        • SHA256 8491168f55cfe46b7967f5903194a9d665077b1370bf49d990a2e3665cf59e16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download