Overview

overview

7

Static

static

3

2026-06-08...te.exe

windows10-2004-x64

7

2026-06-08...te.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    08/06/2026, 22:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-08_92fc18cefc6d8654dd36954a8eda4d1d_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 2.4MB
  • Sample260608-2e13cafx7x
  • SHA256 244bc10758524e533940c4c2f57f5ffc8ebd394793784daa4519d23dca446b46
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-08_92fc18cefc6d8654dd36954a8eda4d1d_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-08_92fc18cefc6d8654dd36954a8eda4d1d_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2480
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3420
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4748
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4752

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 2.9MB
        • SHA256 f75548b850d2329566e2e23b5e5b8d871cbe0bed1f725e2708e59ff8de48c94b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 3.3MB
        • SHA256 213bb639f581a7b332b6b3b7098bed7b318394276ea0564c39cab366606cfd59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 3.0MB
        • SHA256 a6fdf531cd9211bdafdc0243fb1bfd543670893ca32cd108b2ee74176dc40361
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 2.4MB
        • SHA256 943369c0453aeacd880a60da82f6af6f7955d971d4b6115c2bc0018fac5c64e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FormatStop.exe
        • Path C:\Program Files\FormatStop.exe
        • Size 3.3MB
        • SHA256 67a130a10fa2b3098760ea94a0e05472d8a688d3156012eead89b444b20af325
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 8.4MB
        • SHA256 92f6b8704cef24fcfa2e27c7d52c8734a706a6e214cd9160abeaa59e8185b3d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 4.1MB
        • SHA256 0d33b135d3e23e78a1f845461f113ed8108431d02a23142d3f61fef2f9fa443f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 5.8MB
        • SHA256 b54f7a424a68d7744b97b87f33dbe6ee920511eb3dcfac8ff9abba8cade086fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 4.6MB
        • SHA256 63447a7f7c39ca3909675929253a8e20fc1022a010e313a1decd5fb66a192658
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 4.0MB
        • SHA256 c214c23d752a44a8980dfbee53571d085ec4e6af5670880dbb5bf0dabbcacbf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 4.2MB
        • SHA256 2859e3d9fbd41b0379a7c55a6d35d213b8cd42e49dfdfea47f8eff3ec8374d39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 5.4MB
        • SHA256 8bb4416905dd66869c7297fb6a1c82aee27315e967e7c1a0decdb38d6c984dfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 3.8MB
        • SHA256 734e825ad7aee2b521df71cedcb14ff426c8a5541cd8d6bdda5e355dbfec13c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 2.4MB
        • SHA256 6be00f22e787ce34b97b48a6a8b51e8345f87f0180b61580b4f29c1e088bd8a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 2.4MB
        • SHA256 e7a38e44b68da5a5366064f4a217b70bb8efb26445b1ed5a364ad410c3c2e966
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 2.4MB
        • SHA256 9950abb9970439893062897277dae64af4cd4798caaf26cdb2956b84329b6b0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 2.4MB
        • SHA256 d1d6b46dc2cf8d1ce21115dc1eeafbea0513000c7119a2990b10e526aec2dd2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 2.5MB
        • SHA256 bd2cf1adf9bcd41f94565abd048ebdedf5394f202bfafda9638f4f85a10d1dfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 2.4MB
        • SHA256 d85ca652c7c300ebbdc46f51c9f2fcd94d463ab173faca43ab7df560350db435
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 2.4MB
        • SHA256 a0492f3d669a5bcec2b716e03e46b242767ee5fb0a18b4428d9a620eb96cd879
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 2.4MB
        • SHA256 a6d2b16659a1c269e44732726c8f847602f599eb47acea98deae43e985834994
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 2.4MB
        • SHA256 244bc10758524e533940c4c2f57f5ffc8ebd394793784daa4519d23dca446b46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 97b394ac2759e6df35349b772b4f3f8ebbc88e24d94c3a0f3ac74428f88957db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 4b25eb137db44d0c2c6515e762652296484da2d71f85ef99fc1e3079c2dc83f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 90d706f2f55b5f75387dfd355d222973496a1b887cd0d33968cfdfc01cacc108
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 7138d77fdcbc87df34eb10ac506f2ad47d2ea164a4c5cf62e9745a5e98529882
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 bed6d5107e039e6b7a3a16b95cc4cc4db521a31a4758f0631b7069a8c8cf3885
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 c7dda051c5b954626aca1cb7085920c46809e9b72f138ddbddf1d6e61531bd79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 7f12d492af8cb1968739e66d30a40d8e9dfa4145637805702c1441923df117b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 7c0d3ec8e8ecabd33bee620499110d0a9fbaa918ba367a0e72d17c896e9c9734
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.4MB
        • SHA256 19c03e4627fdb54eb40cddadbfbc1e782e9e0b11905af3e35ebedf9681f58b2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~8
        • Path \??\c:\ntldr~8
        • Size 2.4MB
        • SHA256 c55d4c9763d0f2952409b5fb816900d7aef104b9a6f7a3f848f55dad5d58d305
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download