Overview

overview

7

Static

static

3

2026-06-03...te.exe

windows10-2004-x64

7

2026-06-03...te.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    03/06/2026, 16:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-03_8da5052edb7571dafcc8e71fd32058b9_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 6.4MB
  • Sample260603-tzwpcsbx9v
  • SHA256 9766d43a7687eed9c5301c476fc7a8cc55e0d8f10a63658f616bdf0ccf467d70
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-03_8da5052edb7571dafcc8e71fd32058b9_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-03_8da5052edb7571dafcc8e71fd32058b9_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3020
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4976
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2328

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 6.9MB
        • SHA256 66ca0677bbb23f5f91ded3182deb4af5a54b6658e3f2d71d31c04f5ca5c3afcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.3MB
        • SHA256 02f887058c89637d459b8c33a2bc32a771c9680eb609164bc99c346d9cfa1226
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.0MB
        • SHA256 4880ca0f8d449b68560fb2c2cda8f56b29935c75d8648a96a5d3e5101a2dc12d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.4MB
        • SHA256 f6fd953eb97e6c263b06bcafba771c049408c6059aa5eea87104919302b24f95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 12.4MB
        • SHA256 bb0db30459f8b5b5304b356c94c1f89966ffd05063a3aaa6ba3b30b9dde83710
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 8.1MB
        • SHA256 10caed940096c086dbdf41261b75fe7ce5ed1f03f87d5debd52a5ac7afe6ca40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 9.8MB
        • SHA256 e2d978de0233604dd7f326b47aa68b84f4c2893f36eb0b2bcfe78ead6b961bb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 8.6MB
        • SHA256 7ca93d0a91c55cdf7c1fb6d5f511307eaee32f590aa38863b7093e5fb966574b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 8.0MB
        • SHA256 24c8cb5c2a1cb1b6471f63144ecceed7bbadbbbec646a47edb2bed683bd16960
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 8.2MB
        • SHA256 288859e89a60fa441562327c36765a0ad6215fa4ae1ece32c25328a6b8ddee92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 9.4MB
        • SHA256 a98cbbc83cff5606d838743f69931fd175f93432ea49ded593285af637f8ae9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 7.8MB
        • SHA256 21b4acd7cc12897c2edd77283cff14bd3f25437b85c8b35917776c1667fd55ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.4MB
        • SHA256 7c3e997af11829ecfb387f434fcb90198270d6acaafbfe27f141e80db360f5c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 6.4MB
        • SHA256 a5211c4da508c4c248765842a70752414218f9b3d92484b1b3df86bc0f034740
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 6.4MB
        • SHA256 3b2ddc442d793047cb8d9d4e63802a4d3f85f04689012bade5d02f4371415067
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.4MB
        • SHA256 fd14a18087d7dfe66dd71b40f8e1ed11f7819f52f359c460693845a83a45df88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 6.4MB
        • SHA256 ee684b8e03cd17b106f9d56973f7bcca1f86ac45927f9c38e2792102a51fe875
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 6.4MB
        • SHA256 069b94b5e861195fcc42b8a8bdb901b6568d4982f6669a81b237ca4fb08068b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 6.5MB
        • SHA256 467b0f1d0e46c0d769fe37656cd88172487060464de9c707413ad3d8dc3bb4e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.4MB
        • SHA256 cd723d59feeb6ad34cd70dc8de6239b13d5ac888c8fbb9c962fa9d55316a37dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 6.4MB
        • SHA256 9b80806042760a2beb29774f69ef03567af948ab374d6f6ff240145cb4e04e31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 6.4MB
        • SHA256 fbe5dff19a2fcdc58fa12eb7b15d832674abce656f1e2bd1a9c1e3aa963d1b60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 6.4MB
        • SHA256 9766d43a7687eed9c5301c476fc7a8cc55e0d8f10a63658f616bdf0ccf467d70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 fe053a977df5d2c41d7289bd8a4bf05c227c33ab0b7c68575e88ce8b5e45a86c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 17ec840e0e01b158a09f6b849017df237387450b246311efc23fb42eab0e6332
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 541634442ce36aecfd664619858d309f9540fa0951188964377b01b3507d1979
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 873139446699c202d42a0de642331a774ab34a79889917a34a9cd1ec250c0a10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 40f20e920b839a19c06cc927929b472b07047dee9dc7a0b7855f7c38b9f21343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 3bd23bbaf96752f76409ad104abc202392329ab9133a14b13c5bec6fcc228b4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 0e6d20f7f17f188471f29f8be8e086d508135462a7072fd1b8f2d6253fb1cbb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 a7d27f23aed2e6223d03a18c50e52b990b3ad1aa4b26212d3393aad53a083680
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download