Overview

overview

9

Static

static

3

2026-06-03...ar.exe

windows10-2004-x64

9

2026-06-03...ar.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    115s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    03/06/2026, 16:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-03_757c806eceb93af1c6e1254a8861b809_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 5.1MB
  • Sample260603-tsb2dabw7v
  • SHA256 9496b753f4904fa17fe2017f9dee0020281c33fd438a0d5efcdc91551b4d1356
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-03_757c806eceb93af1c6e1254a8861b809_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-03_757c806eceb93af1c6e1254a8861b809_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1152
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3660
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3220
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2868
    • C:\Users\Admin\AppData\Local\Temp\2026-06-03_757c806eceb93af1c6e1254a8861b809_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
      2026-06-03_757c806eceb93af1c6e1254a8861b809_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
      2⤵
      • Executes dropped EXE
      PID:3016
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop sharedaccess
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2100
      • C:\Windows\SysWOW64\net.exe
        net stop sharedaccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4268
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop sharedaccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3112
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop wuauserv
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2064
      • C:\Windows\SysWOW64\net.exe
        net stop wuauserv
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1540
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop wuauserv
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4860
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop wscsvc
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2368
      • C:\Windows\SysWOW64\net.exe
        net stop wscsvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:456
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop wscsvc
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2336
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop srservice
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4280
      • C:\Windows\SysWOW64\net.exe
        net stop srservice
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3136
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop srservice
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1744
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net start TlntSvr
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3944
      • C:\Windows\SysWOW64\net.exe
        net start TlntSvr
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1504
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start TlntSvr
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1440
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net user helpassistant 123456
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4424
      • C:\Windows\SysWOW64\net.exe
        net user helpassistant 123456
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 user helpassistant 123456
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4864
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net localgroup administrators helpassistant /add
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3436
      • C:\Windows\SysWOW64\net.exe
        net localgroup administrators helpassistant /add
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2716
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 localgroup administrators helpassistant /add
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2656
    • C:\Windows\SysWOW64\sc.exe
      sc config srservice start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:1448
    • C:\Windows\SysWOW64\sc.exe
      sc config SharedAccess start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:1368
    • C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4180
    • C:\Windows\SysWOW64\sc.exe
      sc config wscsvc start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4936
    • C:\Windows\SysWOW64\sc.exe
      sc config srservice start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:3932

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 5.6MB
        • SHA256 d69f771371e01f761599c7c754e890160306089a8e062038a085b21c4fd0aa30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 6.0MB
        • SHA256 7da4f130e4f813a41abaac0a7c30bea8d2fa6cac95ff57a5d10b8fdd1341f48c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 5.7MB
        • SHA256 33de5525efb52e79751929941e724fdfd27d91f9a733e1bfe222bfa67f992c55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 5.1MB
        • SHA256 0c5211da69caac2d6ac9ea3f7f85590d9ba761c96eb45a09f111b92a911d341b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 11.1MB
        • SHA256 a63fcc45089f6c27430875c275e68cf33cea8b2392945808a90a45b13369b42e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 6.8MB
        • SHA256 48b03bd45b95dda94c7ece88180beac9e73e5beb92d7b30503b748e45e2cca23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 8.5MB
        • SHA256 be1206ae5ceecd3ff9bfaca3be2038f7b4b5d4d6fa3948cae4d8c5728f4d4d3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 7.3MB
        • SHA256 e7c8fffb67bfabff15e287b4369dbe06cc4b7eab630c9b4badb2646e35f95418
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 6.7MB
        • SHA256 6a09bfb10ca9c3e84253b023d8bb7780d457a51908f4abe21664d269e0cf5fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 6.9MB
        • SHA256 4f1eef5aa1de8624b1f9a59adede394a35e031996f639d3a314f2789f1c458bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 8.1MB
        • SHA256 0fc3e0fa7e15b87c6a6b986be3c9f3db8c80b52da19a11d865d12573bb7b249e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 6.5MB
        • SHA256 a5bb30bb14efa8fb24d7e362ed7efb70a3ae4168478148eb1f377ddfba29a2f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 5.1MB
        • SHA256 2d8b13987417f7f594aa69f79f6793730ffc8213fb1a3bdd2afd0027c1a2f670
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 5.1MB
        • SHA256 2b8b007ac1840471dfc29a799408139bc11dfbbea1ae6e9c0a410eace60c6a4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 5.1MB
        • SHA256 c358da9269d54cc1b74861e399984fd25fadb369aebe7a112c10e9dc4eac249f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 5.1MB
        • SHA256 dbac2cb99b3ffb45f7de29512fcdb9146e1dc7b3f32211de514475a742b9684d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 5.1MB
        • SHA256 942431bfc1b71f31d8036419f676ffd532d825ff82185e200df56a1287f16801
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 5.2MB
        • SHA256 c87cb99ce933e746c86be6a2ab0c93e61423e7554f5d5157608970be69d03b51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 5.1MB
        • SHA256 40f4df6331738970c9c88c866e33e1922363ee8403a442040ff877ea8b560771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 5.1MB
        • SHA256 b5f99ca32cd453058c579bc824e518d77ec4242d9000884e02e46d9aa1529c6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 5.1MB
        • SHA256 819cbfc1cf585fe748c40d5ffb65d72282f9c7bc9e561854f255cb1974cb92e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-06-03_757c806eceb93af1c6e1254a8861b809_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-06-03_757c806eceb93af1c6e1254a8861b809_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
        • Size 48KB
        • SHA256 b648a37fbb1f62094d53c0e291fd88ad548e63e8fae4e9a1528f8640fca02366
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 5.1MB
        • SHA256 8ff7f33cafc4394e3a727f9fe83b0c4d792e07b7b61320301e23a62c2b25bfaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 27bc90de188f3c41dd6d05319b08f06c439ed5bc7cf0a0fc91996d436cafd43c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 550fd35dc0bcb48f9fc7ae340c830d675e434e249f8e0beaafb831f95a044a53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 8fbafe41d2d33687ee6772b35edb1180e84e7e3ade24b5b456373a6764804657
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 e1b40cd35873fb0054033b3a5916fd6d7990070b572502bbfb682c39506003df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 6599176916bedb4caeaba70c9817ea5763571a05786fc89eafbd5e4bab8a522b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 7906d0744e606d33df9edc3993fcc2e79c935c4775594e7b3b846de0fc115d6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 37b9e58cc8c75a1892c929ca7aea32564680fe357e8f73319de36f1e511d3d51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 70d324d88eab91b48d4f7dccded2b5177c23ab7d88d0f8227df39bc7133d6926
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download