Overview

overview

7

Static

static

3

2026-06-03...ar.exe

windows10-2004-x64

7

2026-06-03...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    03/06/2026, 02:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-03_828438e541484bf57bef68a8917ac115_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
  • Size 710KB
  • Sample260603-c33hmsgx4z
  • SHA256 17b420267d1d07d963569f943eee8dc4d0673d56f456ed606857f17fd897c9c5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-03_828438e541484bf57bef68a8917ac115_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-03_828438e541484bf57bef68a8917ac115_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2404
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4348
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3944
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3248

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 1.2MB
        • SHA256 3353e542f15797e6cb77cd0496821ee464e697989f6654679fde8700d4d6b175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.6MB
        • SHA256 6a77d7839d718011b9d8b668e12d5ed29142af338131cc4bf2daf57d9f1344e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.4MB
        • SHA256 08840c27900b058526903986d4798f0d29fb1f3e1df202d8493cba7f2e7bbbc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 724KB
        • SHA256 066e2d795f50c40b81ba2874780b7ba60b9715a233516949ec2ae7befd487ee0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 6.8MB
        • SHA256 268f04dd8cf49253e067ecf66ae2d55bdf5cecf19e718f46080f82695c5b0bc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 081440cbb836a8c1c7a276fea3d6389000295cbef649c46aa6dd2941c9c9ad39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 2.4MB
        • SHA256 5bf3bc40695bf16ec6f1a93575052235e47282620f8883ec1330a0166856902a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 4.2MB
        • SHA256 7c2cba8c44c713391fa626b81586ac9d6550f280934fd4f9d43895ba32f41dcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 43cc68f9cce69c9e6be97e958f437184262113b401d9a66ba96b71aad1c29a76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 2.3MB
        • SHA256 dcf0fad91fb7a52f02412c1b257fd16a3ccb4a90effdc9447c26f51491cae271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 2.5MB
        • SHA256 7fb234a30c080d622a18b80338c5b2b318d50c72631df1967445214ead6b6354
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 3.8MB
        • SHA256 935b47143f70819f7bf52b61a26ef8475a4106f060b1f41f72f70c57d737dfd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 2.1MB
        • SHA256 deb17099b5910d46964fdda096c1ef8439dce5eb6249ecc29af9860f6a933513
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 733KB
        • SHA256 92255ae53e8021e49e46090cc19576b1b509a480fa58c13b86b90d3ee3ec8a7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 733KB
        • SHA256 ea26845d16e53d6d64e00ca3fbda16e8d8fb2be23825c0d2a6005393a79929b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 733KB
        • SHA256 5f30527e1306ba5d3d28d1dd0ba6722196f132ca7eeb82dd996c354a033606ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 754KB
        • SHA256 66eadd44f02b0cc19db3f4bb694ea46bd4ff1ab999b9337f988c9cc30a5ad3cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 733KB
        • SHA256 90ee42449a55c65942a110862e7fe1889d085fe387fc0f41aef05843adf2aa4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 854KB
        • SHA256 5f2f8c061222f4cf1fd4226fb2828dd5bb539b3e73afae68bb54de13141752e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 766KB
        • SHA256 d268bd60c35f9d2f91d8d042f6225e2ce4765748835cfc50d9dac37e2e0af8ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 774KB
        • SHA256 7feb50b5c03c779ee2b826055d8e815e94ca9c32d0a87c5b1835437adfb871b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 770KB
        • SHA256 468937734c588ceada5a22ed6e0c23fc0636c98a7abcca1dcc9466f030083d14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 710KB
        • SHA256 17b420267d1d07d963569f943eee8dc4d0673d56f456ed606857f17fd897c9c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 710KB
        • SHA256 6aa00625d43bf3df9cbf8f5b5acf1fd75031622db5e43c0003333080bae888db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 710KB
        • SHA256 5a5dfce55505c8297638aabb0ce15a657a30cd222894624f050a88d30d1787bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 710KB
        • SHA256 053a454e17b66218f5e90acceeabd5623801e25a90da780ac6967b70b62bc4ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 710KB
        • SHA256 16e11f6e2e88a03bd983a5b43ce938f5dbfb3d232504da680ced14733326b132
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 710KB
        • SHA256 05549ff6945dc83235ae5382d32484dabc3e7ec84f232da7864f7ffe2804a2a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 710KB
        • SHA256 5ab74ae11eeebf697841882dfa5105aef25ef6d2e5307f9b66547cb6251faa5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 710KB
        • SHA256 7fa7d00a9eff7adb9142fb55b9f08d7eb4742d644d2f92f19b68916ba846ba54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 710KB
        • SHA256 05a18de03f9b9479c615f98f137f9bfe70cf2e76f2076304ab41dfb40bd33e5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 710KB
        • SHA256 06192faebc30e32397d399312c473723a564756745dd85539b4430370f0932c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download