Overview

overview

9

Static

static

3

2026-06-04...te.exe

windows10-2004-x64

9

2026-06-04...te.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 03:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-04_64b32fcbb466b0907836f30bb3640a46_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 5.2MB
  • Sample260604-ejnlgshx3y
  • SHA256 f771a802e4e84ccbd428811e60f9f1befe237f55a7b0450efaddce5c876dd9ed
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_64b32fcbb466b0907836f30bb3640a46_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_64b32fcbb466b0907836f30bb3640a46_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:420
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2224
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2436
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3088
    • C:\Users\Admin\AppData\Local\Temp\2026-06-04_64b32fcbb466b0907836f30bb3640a46_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
      2026-06-04_64b32fcbb466b0907836f30bb3640a46_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
      2⤵
      • Executes dropped EXE
      PID:3256
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop sharedaccess
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3936
      • C:\Windows\SysWOW64\net.exe
        net stop sharedaccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3116
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop sharedaccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2680
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop wuauserv
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5036
      • C:\Windows\SysWOW64\net.exe
        net stop wuauserv
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1968
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop wuauserv
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4312
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop wscsvc
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2316
      • C:\Windows\SysWOW64\net.exe
        net stop wscsvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2876
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop wscsvc
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3476
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop srservice
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Windows\SysWOW64\net.exe
        net stop srservice
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2084
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop srservice
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3064
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net start TlntSvr
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1488
      • C:\Windows\SysWOW64\net.exe
        net start TlntSvr
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1440
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start TlntSvr
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4620
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net user helpassistant 123456
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3944
      • C:\Windows\SysWOW64\net.exe
        net user helpassistant 123456
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3696
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 user helpassistant 123456
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1008
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net localgroup administrators helpassistant /add
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:772
      • C:\Windows\SysWOW64\net.exe
        net localgroup administrators helpassistant /add
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:352
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 localgroup administrators helpassistant /add
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2340
    • C:\Windows\SysWOW64\sc.exe
      sc config srservice start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:3440
    • C:\Windows\SysWOW64\sc.exe
      sc config SharedAccess start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2072
    • C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:1888
    • C:\Windows\SysWOW64\sc.exe
      sc config wscsvc start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:3288
    • C:\Windows\SysWOW64\sc.exe
      sc config srservice start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4008

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 4.1MB
        • SHA256 27971898147099221e1c44f78462f23195060f648c70611a44f3b636cdc0bf10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 4.5MB
        • SHA256 29634a34d16f0e93f4b0588ed6e0e830647e17c6e64b2b1f71c5bc696b06b30e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 4.3MB
        • SHA256 0f7b441ecd07d734b799ab09390be243dca3638475e672ca74edf3e9cbfe0639
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 3.6MB
        • SHA256 cac884d791ab569a787b8654e4a3f7b797d1a64448c610440bed1d4cb7957f1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 9.6MB
        • SHA256 6b519ca618759e56752d61e9f38aeaed616f09d3de9954a1064e0ab3c7c8a4dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 5.3MB
        • SHA256 8e4894bd3af47fe672d82c07526ae61548387c96fc3d81312f962075de32ef1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 7.0MB
        • SHA256 911090011d680f739b36caf2370a3d1b1242d4066eb58aee1934c08962ec6c7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 5.8MB
        • SHA256 e0f83714551fe2a64cc41af33ef87e64f9bf39b2202ccd7ac23102a08a2aa27e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 5.2MB
        • SHA256 95cb5d4e6ecea50bb3b5003db3d226f5853773396040b248569f068da2eef93b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 5.4MB
        • SHA256 4cd12b6c0f3e46af4c9cf010e46e43be098eda41940e46f2468f787901669f22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 6.6MB
        • SHA256 97ffaaf65105e43b4bc899bc33bed567487284693dde93a0445f51892724f133
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 5.0MB
        • SHA256 8f8f6e62e5470e8326f7a5b89616bd03ab475c8c27a91e66de52e6498847201d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 3.6MB
        • SHA256 382850138d212ef23703470724a9cd38e7936925054ffc0af3a0d4aeba5234d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 3.6MB
        • SHA256 dc85384e02119c54a01567975451b5fefa041191c01ce5c6b8ea1ea6bd4b43d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 3.6MB
        • SHA256 85ec768f17aeddb69d00fbd003294441deec7500c45c04cea0f66449c377588a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 3.6MB
        • SHA256 a4895950b8491c33544712a173f4726eec3c06d00435b030fefcecd572f28adc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LockSkip.exe
        • Path C:\Program Files\LockSkip.exe
        • Size 4.4MB
        • SHA256 17ce84a77abce89dfd161210da1b10d77ebbae26b065ef6a245b48644f624869
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 3.7MB
        • SHA256 c019f39649d5a91a06960e2f12b88f561fa8ef85a11814e24a16ba68d6f1c4e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 3.6MB
        • SHA256 5755263df2b4f29bede4f927b0611e344d75481c42d5875cb1d0d0323d8f5b82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 3.6MB
        • SHA256 bc2dcc3e85722a7d7f63ca6628ac3216aaa8dc809eaf04fffb52283b6a4a896b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 3.6MB
        • SHA256 6f671122b67b9b8931b688233499f596401db3f769e804b5655e151af2af6846
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-06-04_64b32fcbb466b0907836f30bb3640a46_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-06-04_64b32fcbb466b0907836f30bb3640a46_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
        • Size 1.6MB
        • SHA256 814cc0aa61ca1827c3c38a4619b974db6c7325c41cb1facd6aec57fd97c54fc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 3.6MB
        • SHA256 4dc30dc24933a050a1d7b135d1d87f8166d8788e72f207dd478ca8207d3f78d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 3.6MB
        • SHA256 36b6f2919d63ec7c8d052689177957047539dbfcf92bbdd4ae2fac8da93d742b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 3.6MB
        • SHA256 29c8b64326cd804c7c482e026581031dbce9314001069af8c2edeb70ed5d64fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 3.6MB
        • SHA256 15811c32c698f85fa70a7ee0b073bd1884d62f2e0d4f42fa294ab7a1a287425a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 3.6MB
        • SHA256 471aa2096b594976008bafd370d06c58b4cf0f4944e28f44d5c6165fa23827ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 3.6MB
        • SHA256 ea53425c3d51755fae1092436cfbe95feb3cf1e0a59f53a50835a805d07fe039
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 3.6MB
        • SHA256 8e324747148ae33c81ed77b4befd6962a22c6e26422126ccb69688e9963f0b30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 3.6MB
        • SHA256 efe69fd1170383c366c8ca351036cbc737238122be0b4f8d11701abef756c086
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 3.6MB
        • SHA256 8d41884511f5f5c742ed25b57870a9657301086371b8ad16ead088d6f633eb42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 3.6MB
        • SHA256 02524065a84bf3cbfefd2f7a669fee2c6a35cf9f9432e680619a954e2b37b19e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download