Overview

overview

7

Static

static

3

2026-06-05...te.exe

windows10-2004-x64

7

2026-06-05...te.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/06/2026, 05:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-05_9d04ffa7b83970ae32a7de261f53a5e7_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 4.5MB
  • Sample260605-f317csbs8z
  • SHA256 6175fb0f01920d417af9e6a7987f14fb52b5ce843db7c2e6faf6e6bf130ee2fd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-05_9d04ffa7b83970ae32a7de261f53a5e7_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-05_9d04ffa7b83970ae32a7de261f53a5e7_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2144
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:728
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1560
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1816

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 5.0MB
        • SHA256 103a6dbf2bee6d9979362a63392f4c29c1a98e9fa60b5d53258f8169e37f9ce6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 5.4MB
        • SHA256 8338acd653374f71117ce6cea065509e0979f1956baf86cb2c8273181ef91ab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 5.2MB
        • SHA256 48b1823ed026f3c2fac3912a8849749cff2d84100490ab9de97ec5670b23f6ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 4.5MB
        • SHA256 ae8e141db3923d8d5db7f3a310f0f8152f3a5f50aed110e412992060bd75d3f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 10.5MB
        • SHA256 5f3f57897681623792e5ec2bc16c038cb144ac8744cc84e2e66a9f0e827cb84f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 6.2MB
        • SHA256 880671d33b6c35a244b5565141bd66890a6765b65b26067654dd45f0d872ed5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 7.9MB
        • SHA256 44c1519a681a7c8d1f558d1c624d1667046d4076eddd3ddb86be64dd03e77692
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 6.7MB
        • SHA256 91a41198734d9072842ed07dcb4e74e8bcdd274333b619a8c0956e4ed9f16f90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 6.1MB
        • SHA256 f23c74b3bab0e3126d1006273cf35c782f29a537111ee408e71dffc511f0d266
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 6.3MB
        • SHA256 d6ff937827546f88eb6c14932c3bb9fc75697c7dfe3d94bf8666f7f501e94bb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 7.6MB
        • SHA256 c214476eba4281a60ecb7efb3cd47bc3eed3de34c3f546be7fc8b4fecd4fde29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 5.9MB
        • SHA256 5c403ae970878f683aeabcae01b305935de843e187f6d68e4dd259b534f26488
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 4.5MB
        • SHA256 84e905330fa8628dd90bb00d86be592b08ef5c0b37b7864dc07a6687c97276f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 4.5MB
        • SHA256 9c7174e23a39beb8ba146cbedf8665c99f10c2cf731c5959935c7812bfe65183
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 4.5MB
        • SHA256 13f43cf7d0a118fe59b4a2b354f61615c20746e7a96d9e5c0d570f89ff42468b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 4.5MB
        • SHA256 f50468a409257d784d46645eeb383587947bb99d068a9788d493f696ac622a97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WaitUndo.exe
        • Path C:\Program Files\WaitUndo.exe
        • Size 4.8MB
        • SHA256 69a3b23662a6a6f006175813b5dcd0a33d3a85a5fd49a363588337a99f94c9c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 4.6MB
        • SHA256 7838bfba82653d9f7c4aa8fcf432ab5c09a3e5324df143691d83fae407a86fa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 4.5MB
        • SHA256 e378129e0e8b7902fb83b38ef8bc6e84347e44c115829474aef7e1cc44ad6cea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 4.5MB
        • SHA256 e8c9c5eac257bc4d65aea5fb9334c358d36a5e10d6da36f7e7632844c057eadb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 4.5MB
        • SHA256 4f9ef2aae7e736732e635d36df7d6a21db53f6f32c5f2a8ed5834f624aca6a08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 4.5MB
        • SHA256 6175fb0f01920d417af9e6a7987f14fb52b5ce843db7c2e6faf6e6bf130ee2fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 6dc06ef1b1aa27ee3e4065ca8d8abf4f28936206f14a3bab2bce126b1f1dfe08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 855b31dfbbfce8e152643a9edf6e32f4dee6013c3f23d4915d59d53b1dc16c22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 70154b9b0819f5c9138929484ca60b70c9ec79aff074001fa115c0750f002731
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 ab313755ac010f8ca142bd7cc69a23344b023299c998d98d05ff71a2c2dd2744
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 e0e94855c712aef02c975200ee4c2f26aec2bd048b516a7d83b31754700b0655
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 7848a065f34b7c41655175ea1c416c73908960d0b2e2679780a9df81f436e572
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 e86755b27b96783082a844bcd09243f3db907a4f9ab8cf02258b5e921ecba42c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 29b05a9f499160879345dffb1c55e2b7292a710e688d385de1ccfde1a3a2ee8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 d7007169d3c9b40500cb7b702b6fd1a19343f74ee6de7af480c22ea83b235f9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 acb8f5482a63a770ac452a1373324b9f4e562b8db5bf0b3acc781751a61dc74c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download