Overview

overview

7

Static

static

3

2026-07-01...te.exe

windows10-2004-x64

7

2026-07-01...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 09:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_87555ea16dc252ab930d0dcf87e1336c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 6.2MB
  • Sample260701-k3m2yscv7x
  • SHA256 84c5d2837e0e4e685fb5f328402d91f39b2a5be47c524faef0c934b863a3a9df
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_87555ea16dc252ab930d0dcf87e1336c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_87555ea16dc252ab930d0dcf87e1336c_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4488
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:588
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5872

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 6.7MB
        • SHA256 54ee1d9d5c2cf9c14c524973465efe0223cb9c6c3315977c0428aa35ab319e66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.1MB
        • SHA256 c511ae9afd2288ea5f8318778232fe0e4de5aeca1341355aa0434140cc21da6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.9MB
        • SHA256 b2b4d7bfdd4b4a5a3bef0918528b2a6b83b44ae90e4ce862efb4153e4f9d1f08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.2MB
        • SHA256 efad0af4bb9545fe60b7f11088bdb9e506aad43d9109549201b9619ca0b0d4a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 12.3MB
        • SHA256 848b5358f339ca28f587c94c25e6a72450b75c2e2d2976c87ed17358a7f39ddd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 7.9MB
        • SHA256 c56a2192882f96bec264705f406d6ae7e9ca6b7add84d00d7c3c1e6495099bdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 9.7MB
        • SHA256 6b329b7e6efff34b660b48197a64e297646294c6ef0a240bb76dc439d588ebd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 7.8MB
        • SHA256 ff726f5a7d439b99778a86ac9e8f75eb6a2df27e0d18dba50c00db9d9fd178ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 8.1MB
        • SHA256 3cc27587e508d7267b67e57e6709c24230b2562399cd1ef394199bc8d9d9f9ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 9.3MB
        • SHA256 6a0203247a257242432a1f527fb17b2952e01690ac00a7561167a640f91615c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 7.6MB
        • SHA256 1b4d957c8dae1a8cb4e15e20f2ead2b7c4edc744d2e470868d7e823bf3e5f329
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.2MB
        • SHA256 9d760c88e6361e6007a3b535dabda6d810f45e50975a798d4577bc835b397e2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 6.2MB
        • SHA256 dc9be758cb2f5645d10644b302d57726dd07586705b869bbf0194bcc88408c65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 6.2MB
        • SHA256 8a0878cdadae6c8a2d03c4748d967196c4e44d05f922047b5b782d69b48067a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.3MB
        • SHA256 35509f88c9a160ef6e66ea047354c0e772c491aafa7d198ba5a5a0f71198710f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 6.2MB
        • SHA256 24a9a93cbbd8da693b22c4a7fe4de61f23c7995a8055ded58f8daec9cf12d27f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 6.2MB
        • SHA256 00cad483982d6bbe110a677dcb5152cdba98cf40289126254db92e9fe7121199
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 6.3MB
        • SHA256 f194f966dfaead5a9d856b4928f5503312aa1ee1707c18fc7c3253a561810705
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.3MB
        • SHA256 8e003d96dfd26d6722ff25c25be2bb0a2c13fd751bdf3db25d33ac2ac8d44e81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 6.3MB
        • SHA256 a6b6499d39d37b8881fcfb7f36121e17b152828ed40f65eae875afa158b00891
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 6.3MB
        • SHA256 d238396288576f25f94c705a5e34c4b1f7c26b20fac04a7dfacf02d9d307746c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 6.2MB
        • SHA256 84c5d2837e0e4e685fb5f328402d91f39b2a5be47c524faef0c934b863a3a9df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.2MB
        • SHA256 762a8305388257baff378d66fa2544473c8b7aea6c7e4610f28ecd43437e73fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.2MB
        • SHA256 230b070c3622d15b5d0cf7ff35892e72deaa26fd74f8dc70a7167ef2b55b6dd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.2MB
        • SHA256 32065ec1ebaf4b23726c74a1c07dc5403b590b6db73450574984f1ac91781501
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.2MB
        • SHA256 3e5b522115a00c3f56e6a95c66aba7d3c822a69ed21ffc5910e3d93f8d6e7b90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.2MB
        • SHA256 fae539df517a3064f250c368a12bce1385b1ee37b2ee8ee9f1ec786b91c051ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.2MB
        • SHA256 f6aba3857d9e9ab3739de58b8f36e16abed4a9ee180933e2de4b77a7dc588b5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.2MB
        • SHA256 31e21622308e76247fe9f0dc878954ba7793fdeff4d18be3e524a2238dbb92cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.2MB
        • SHA256 d2ca7287dee28c105e8e00df903db61f8bbde8d803816ac696fa107d1065ed8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download