Overview

overview

7

Static

static

3

2026-06-05...te.exe

windows10-2004-x64

7

2026-06-05...te.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    97s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    05/06/2026, 05:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-05_9d04ffa7b83970ae32a7de261f53a5e7_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 4.5MB
  • Sample260605-f317csbs8z
  • SHA256 6175fb0f01920d417af9e6a7987f14fb52b5ce843db7c2e6faf6e6bf130ee2fd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-05_9d04ffa7b83970ae32a7de261f53a5e7_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-05_9d04ffa7b83970ae32a7de261f53a5e7_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1452
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4888
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1888

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 5.0MB
        • SHA256 103a6dbf2bee6d9979362a63392f4c29c1a98e9fa60b5d53258f8169e37f9ce6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 5.4MB
        • SHA256 8338acd653374f71117ce6cea065509e0979f1956baf86cb2c8273181ef91ab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 5.2MB
        • SHA256 48b1823ed026f3c2fac3912a8849749cff2d84100490ab9de97ec5670b23f6ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 4.5MB
        • SHA256 ae8e141db3923d8d5db7f3a310f0f8152f3a5f50aed110e412992060bd75d3f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 10.5MB
        • SHA256 589e9d698e7ea4f6a5773d66800386b5011b9e63e0657dacd15cd26b2bf1d2de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 6.2MB
        • SHA256 880671d33b6c35a244b5565141bd66890a6765b65b26067654dd45f0d872ed5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 7.9MB
        • SHA256 d258da5a8f43ecaacf416a734a3af4db0d168fbbcd08b6d40831794750911934
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 6.7MB
        • SHA256 9de1502ade191f3a4fd5035eaa4691bb1ea18170850929a92a41f51615ade7d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 6.1MB
        • SHA256 5cb660cc33239edba685080ec272aae5e9ceaa89a050a518cfb599e97e2af72a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 6.3MB
        • SHA256 c2b9f47d241eb3ef8139a72dcc0a217dbe36fe86bdefef7f0aa18860bcf289fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 7.6MB
        • SHA256 c214476eba4281a60ecb7efb3cd47bc3eed3de34c3f546be7fc8b4fecd4fde29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 5.9MB
        • SHA256 5c403ae970878f683aeabcae01b305935de843e187f6d68e4dd259b534f26488
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 4.5MB
        • SHA256 8ff95fc20271e6820d6095c19ccde284c1599059977727d94293c86b68bbc73b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 4.5MB
        • SHA256 a892e7a01a04022d303026873a9f8e3a2f95cf0f5b91da7ac3f221e9af39e1d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 4.5MB
        • SHA256 0aaea7bbb25577505f198c6562527a6cb77dd8c34a0ce23fbd49764535cdb83a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 4.5MB
        • SHA256 1efe7ec1f952b9af62523b531419ba1f8c54b906dbed9b3073733b2660206260
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 4.5MB
        • SHA256 6ce1f93eec872c284acb6f74ff30b2bd2af3b254c933790f1b2c696474795b85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 4.5MB
        • SHA256 da8ba213782ff355e14b1e6f01943c517968fefd332f6e9afb2a825174a11495
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 4.6MB
        • SHA256 7838bfba82653d9f7c4aa8fcf432ab5c09a3e5324df143691d83fae407a86fa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 4.5MB
        • SHA256 e378129e0e8b7902fb83b38ef8bc6e84347e44c115829474aef7e1cc44ad6cea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 4.5MB
        • SHA256 e8c9c5eac257bc4d65aea5fb9334c358d36a5e10d6da36f7e7632844c057eadb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 4.5MB
        • SHA256 4f9ef2aae7e736732e635d36df7d6a21db53f6f32c5f2a8ed5834f624aca6a08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 4.5MB
        • SHA256 6175fb0f01920d417af9e6a7987f14fb52b5ce843db7c2e6faf6e6bf130ee2fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 cbb15f0ed54577b9819df686da4a7f2e8db36a45b89ed8a82a6e2c7a80ccc04e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 e0e94855c712aef02c975200ee4c2f26aec2bd048b516a7d83b31754700b0655
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 70154b9b0819f5c9138929484ca60b70c9ec79aff074001fa115c0750f002731
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 7848a065f34b7c41655175ea1c416c73908960d0b2e2679780a9df81f436e572
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 e86755b27b96783082a844bcd09243f3db907a4f9ab8cf02258b5e921ecba42c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 29b05a9f499160879345dffb1c55e2b7292a710e688d385de1ccfde1a3a2ee8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 acb8f5482a63a770ac452a1373324b9f4e562b8db5bf0b3acc781751a61dc74c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 d7007169d3c9b40500cb7b702b6fd1a19343f74ee6de7af480c22ea83b235f9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 6dc06ef1b1aa27ee3e4065ca8d8abf4f28936206f14a3bab2bce126b1f1dfe08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download