Overview

overview

7

Static

static

3

2026-06-28...ar.exe

windows10-2004-x64

7

2026-06-28...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/06/2026, 21:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-28_7a10a99d52bf0aaa88968fc20c01686d_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
  • Size 1.7MB
  • Sample260628-1bs2wsfs6q
  • SHA256 30830f145082b5a24945ef3c178a10dfc4578cda3713fa15d45c442305de6baa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_7a10a99d52bf0aaa88968fc20c01686d_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-28_7a10a99d52bf0aaa88968fc20c01686d_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4132
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3940
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2896
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1392

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 2.7MB
        • SHA256 391f780d9e2fd83111a6f53a7d49b14e5dc5f1fe54cb8aeb2eec38c64be7197c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 2.4MB
        • SHA256 f7453728eb32405f7d91c05817a9b1fa5f8a4efa6a114b11e1778b6fdefb607c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 1.7MB
        • SHA256 405e243a716f69dc63a5e222f24e19c5a2ac38f993c656cfbb3f8c49e3e55fc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 7.8MB
        • SHA256 4d3c5d6c833353e0bbe81f84c9b7f144f16bc81a6091d75643dfec63e6c26f91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 5.2MB
        • SHA256 c7ecbac9bd00dac2620050ee65ba6b5908300f44255d4c5462597afd6083efc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 4.0MB
        • SHA256 c11c04f18ebb1daa8f70580f71718688e868d813430fc9d8d824be695ab35790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 3.4MB
        • SHA256 0d2308be53844a4263644196f5492c7929fadf8d962a8d64236a0611175b8f8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 4.8MB
        • SHA256 a4035f8cddacf4e60dd68fce2de5ccd61c19d6201cedb99aefa016bd74d36e78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 3.2MB
        • SHA256 33e819cbac3860033ed425d3a976c5ff3442c9b22e168fe12d76ac167fba9719
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 1.8MB
        • SHA256 da2222c20df5672d0536b3912d86c40f92ebae81035c634da0db101649331f50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 1.8MB
        • SHA256 21bf758c798cb51b2d09db808a75f80a2f71311548d3511c1e8856e4af1aa1de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 1.8MB
        • SHA256 ee3c845a8b7d17cf4a93c6d1ba9f7531d66e8bac98b8a87f8f7d4080119e2ee2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 1.8MB
        • SHA256 f3ee3903b706cbdeedd667607019fb7d8a58a9602822de03a207dc4eb0c81215
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 1.8MB
        • SHA256 0181a663aa77fb1c694ebddf50a73628b27386d91e8f0e6b202e214cd0ad41aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 1.8MB
        • SHA256 661721ee9dc347b9944a11b6a5b283beff08952f68671c7995dcb3740682065f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 1.8MB
        • SHA256 0cf815d21e14dfb0e6510a0312a91d02a1fa42296defa40977b2db751789dfe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 1.9MB
        • SHA256 491874c59cc912f2404712ab12703d40a595c36fc8d7edf15609a169aeee0bff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 1.8MB
        • SHA256 3047c7ea6354852e99b704a1a61e8b4058bb960f50c4370d985f655fabdf7ad4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 1.8MB
        • SHA256 01fefde8cd879bc352ac117f0cb915297910fe7bf938128ef285dcacc2b3e0bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 1.8MB
        • SHA256 1ef1f4eb98a96f44b0307ac65745b6bb99e253a9d68e0ba839afed1ffc13b9e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 1.7MB
        • SHA256 30830f145082b5a24945ef3c178a10dfc4578cda3713fa15d45c442305de6baa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.7MB
        • SHA256 d3c1d76376e32c8148957cdc2f837380910f9f9d9a266206bb54c6442e62ff4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.7MB
        • SHA256 4dbd45786087a34828e3c5dd90a185a3d80f442e829eeae6629902585715cadd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.7MB
        • SHA256 efc40d20e6f2392df54c9b8c4082a91c700d97149cd666690054482da9272a79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.7MB
        • SHA256 456098c1731557cec42724141a5ec208117c398cc032c8614e3798b7f564b846
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.7MB
        • SHA256 9e51a5421450248729f95a52b80c5835005ba24b00d0a0df576fff3d5f8b535b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.7MB
        • SHA256 d476f13eb882a6f898995413f92a3ee08ee869d19708bcb4cf2567ec91813fba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.7MB
        • SHA256 bc2202bc96934518568c27ce41b90a63361474cb41876cea82318bbf27a059b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.7MB
        • SHA256 343fe39ba68b868302d2967ba797018766e638eb709ea4adfdf7b42bfc44395e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download