Overview

overview

9

Static

static

3

2026-06-25...te.exe

windows10-2004-x64

9

2026-06-25...te.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 21:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-25_7831e06cc344bcf58dff4d5432eb738e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 7.6MB
  • Sample260629-1f72lsgz2n
  • SHA256 c2ff96e8be01b01d0d13d5cbc382202a4be5802a3b39fde292c5aa54a286ee2a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-25_7831e06cc344bcf58dff4d5432eb738e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-25_7831e06cc344bcf58dff4d5432eb738e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5532
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1012
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5916
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3600
    • C:\Users\Admin\AppData\Local\Temp\2026-06-25_7831e06cc344bcf58dff4d5432eb738e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
      2026-06-25_7831e06cc344bcf58dff4d5432eb738e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5396
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop sharedaccess
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5948
      • C:\Windows\SysWOW64\net.exe
        net stop sharedaccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1064
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop sharedaccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:6476
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop wuauserv
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2548
      • C:\Windows\SysWOW64\net.exe
        net stop wuauserv
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5304
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop wuauserv
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3972
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop wscsvc
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5932
      • C:\Windows\SysWOW64\net.exe
        net stop wscsvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1212
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop wscsvc
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4472
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop srservice
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\Windows\SysWOW64\net.exe
        net stop srservice
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:800
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop srservice
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1416
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net start TlntSvr
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Windows\SysWOW64\net.exe
        net start TlntSvr
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4768
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start TlntSvr
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5800
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net user helpassistant 123456
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1188
      • C:\Windows\SysWOW64\net.exe
        net user helpassistant 123456
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2752
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 user helpassistant 123456
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1100
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net localgroup administrators helpassistant /add
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1260
      • C:\Windows\SysWOW64\net.exe
        net localgroup administrators helpassistant /add
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:468
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 localgroup administrators helpassistant /add
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2824
    • C:\Windows\SysWOW64\sc.exe
      sc config srservice start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4400
    • C:\Windows\SysWOW64\sc.exe
      sc config SharedAccess start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4712
    • C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4456
    • C:\Windows\SysWOW64\sc.exe
      sc config wscsvc start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4388
    • C:\Windows\SysWOW64\sc.exe
      sc config srservice start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2488

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 8.0MB
        • SHA256 c3792aa145c8c25a8cbbec9a13badb086c8574f7f1330c90f27c7b6bf287a7d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.4MB
        • SHA256 415c4ff6d07a0c7ace6fd5ee4b9b2908b7e29f24fa99cd95c8726ade8ee03d11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.1MB
        • SHA256 2ac48922484e74814f061b34ca22bf04ba71960f77da9ec4c7b9070c7eb98ae7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.5MB
        • SHA256 fb8fd58ba59f67305bf3b88b5ac201c36b205e21797405529c6c654ab769c9be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 13.5MB
        • SHA256 44a670495c2f3bf6782a5889f6c38ff234926c9e64dc8148ad2c7f7e1cba9efc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 13.5MB
        • SHA256 85d180381d039a1c758623e6f64b1b984ddcf9c92cc03797cc41b2feb2899894
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 9.2MB
        • SHA256 098989da72d385f341d081413317c8ae530c6c72274ee2b51a8c117117abf122
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 10.9MB
        • SHA256 a3d757c34d4f12348494d67be0d13efdc121eb905d48195703e0908975a7073e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 9.7MB
        • SHA256 f254996870652a5ddeb0b480ebc4bfeff92dc58b4f995562a13ae7140d46f73d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 9.1MB
        • SHA256 46b7f2ce43963ce35db1727808237048f49f215a981a59a25c206bc27d689c62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 9.3MB
        • SHA256 a6b225562e63a909eadcba8cc4218d7d08e9103b89915f6b7213544f35166343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 10.5MB
        • SHA256 8b8492d54bba7ee41b2380eee3d7a437c59debd97594dd89b56c74a2afa86300
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 8.9MB
        • SHA256 12764b2a14a5d3b968bfed8b4887e04a513b5efe4a23c6a651a1bf16ed86b0dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 7.5MB
        • SHA256 0adea05e3a16849df4b906c7e9e3ea50e040c5a1ced5d28797892aad7d5bd557
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 7.5MB
        • SHA256 7a097f7cfafac15ca68d6336071e1c6a20ab025550abed1f55f13a2fd2dd6ed5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 7.5MB
        • SHA256 5d8ca3123ead553082ff38e1a85de7108bac49cd8bd5d7958ff365ef76ab87c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 7.5MB
        • SHA256 36f569d57a6c46816a443f0b22f88bcc8a0109d2da825a399a90927a1c210c1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 7.5MB
        • SHA256 2f89cff40e7735b9f9a9d04aac0f2415f9d20c397ee61d6cab27a9eec212835b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 7.6MB
        • SHA256 b025f832432b87fe22e1016b4ef5ada5745848c91c65ebb4b2dcf197a6873dc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 7.5MB
        • SHA256 655b4d4ccc3a66302a8f80d0f854b96c989ad4ee326a4fa067ac5d022e484582
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 7.5MB
        • SHA256 ee196bcf3e70c83fa51f60e0a00fd3eabe65b4e9ee7f6d49c02a915bafa41c07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 7.5MB
        • SHA256 0a6048e5235ecd972023afec5a5e13afb08622eb14f10fb45a8cb25fe3ebe529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-06-25_7831e06cc344bcf58dff4d5432eb738e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-06-25_7831e06cc344bcf58dff4d5432eb738e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
        • Size 202KB
        • SHA256 6437dbe9b983f869ba3e5a0aee14a3249e8189fb4b8fb157c885f47dac12f480
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 7.4MB
        • SHA256 3acd086cf2b499072adc6659f9255ec88f3ef1555c641c31c4146249eccea609
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.4MB
        • SHA256 fac331059c3387ce0fb74a6f54543b01937e24d2741cfe2acf1c154242885c14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.4MB
        • SHA256 d25835eca103ca6d56cba319814ff99df471d75941936e1ee577c3f5ae8ec16f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.4MB
        • SHA256 929754aaf0588f44efffd8a73a56d1e56f3c3d372fc1db56dfa84315146853bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.4MB
        • SHA256 0db24a797884366593d51886a5dbc53b66f07d4de3e7fdafe5964b9640851e82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.4MB
        • SHA256 4522bde2c0e9218f5334dac285a68a6aff104f58b04a9157f2e98ff924c71e20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.4MB
        • SHA256 ee370daa585c39250fa739e2b4539c225e785ce7d186f0ddc79fe35feccfe833
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.4MB
        • SHA256 266c502086bd38766210be154d977b3b7b64062b3198bf322695cebb88f8d202
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.4MB
        • SHA256 c5ea3b572993e784a019d2f63dbcbf97205d647f494301aebf98e9dbd481895d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.4MB
        • SHA256 c829f7c706ed5d593df3814949fda6a32facf36c71ca60d7bab1aff3839948e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.4MB
        • SHA256 e75fc88934d42993f061aaaca1cb187625fa0b8feac115fa29e27e94d3fa975e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download