Overview

overview

7

Static

static

3

2026-07-01...ar.exe

windows10-2004-x64

7

2026-07-01...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 13:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_7b9f79eb46882046f8c25f904ebb454c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 7.4MB
  • Sample260701-qpsceafs2p
  • SHA256 c1ea55bc145a8307d33661b197aa60924bb3c98ab73d5b004868c486676f5411
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_7b9f79eb46882046f8c25f904ebb454c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_7b9f79eb46882046f8c25f904ebb454c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5700
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2120
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2416
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5508

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.4MB
        • SHA256 aa2ed5c0ccb19bdec2118ff6b35e0475d55fa1fcce434230d609f7f54debc702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.1MB
        • SHA256 fc54e13bffc25d6f4be7abca74ad19a52a705c3dde9ab40bf6f26923c38691bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.4MB
        • SHA256 4a4453ba3c0c81b0323b45790363fdc7f791d7e175a0932f61e2a7d01b7c4507
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 13.5MB
        • SHA256 850a92324812eae384c505c43a1c15fbee7022608a1bb1acc7b4dff3fe4731d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 10.9MB
        • SHA256 79591d9c909c54fbb3a9525aaaa7d1de6956294c1b0bcf3952a8b39c60d6b2a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 9.7MB
        • SHA256 b8d06549bb13f03639640884d454def17529ef3e6bab54bb3625f1ae88bba022
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 9.0MB
        • SHA256 f0c9b8000fbbdd4e51fdab0ace300bd7d4c74507d9b1f019965fa4da3d8a393c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 9.3MB
        • SHA256 2cdb74bface0c2f6c707569512a1d25e2c3992e6b380b308fd336f40a0d848a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 10.5MB
        • SHA256 1efb87d1feedde1af5f171ae357b93e698163670bbcadecfa5d91b7145929031
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 8.8MB
        • SHA256 6bfe7f765ed6e8a7a1e7d541ad13215d3d56752d87017d9e76f99c0bbdddbd18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 7.4MB
        • SHA256 901120d7f191cd40b0cbcbbd2017d1ce5b74c0752cd7d6c2ea20689f4280f56f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 7.4MB
        • SHA256 cdde99326fe191d1e6983e029140ad558d4be26c8510a6f428667954768f9482
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 7.4MB
        • SHA256 0e368fe004c740c903395006af94d00b7a787dcc5c085013368695273b68e410
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 7.5MB
        • SHA256 6cbe572f46c977d33e969def7954c495b207d0c95d5f68070c2455eaabae4155
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 7.4MB
        • SHA256 a02794bf1572435658c8698e6b02041d8da07f1c0e4dffae9c84efd0a56accd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 7.4MB
        • SHA256 28b2326013b8672a91fcd65378aca92cde775ae2b3e53415be60d474ad2fd61f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 7.4MB
        • SHA256 d4c0f486dea91fd546b48c990f8bf1bded1d2428cd7ee1c28f9ccd0063c5b778
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 7.6MB
        • SHA256 8bf05ecd4eb62992e00befc222778999501bdfdbec5d5ed343a326a953bb653a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 7.5MB
        • SHA256 dbb7ffe499decc8eafbb1c717faf7390129368176f585bf606b66e928457ea03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 7.5MB
        • SHA256 813e9870fb6a83d98f54c1f7948fbd535e22c6c6b456f62b4e5ba17b198cbbf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 7.5MB
        • SHA256 65039d7f19404f52e75cb178956ee42a173ef8659e9fb9382113129d3ab83cac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 7.4MB
        • SHA256 c1ea55bc145a8307d33661b197aa60924bb3c98ab73d5b004868c486676f5411
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 79.4MB
        • SHA256 7b3bbc69e4e6600eb337c89a7ca7d18ebc823895e163698c4035fc0c79dca21b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 78.6MB
        • SHA256 3a8721486893786fb306ef12303004e085e2cd76405eed358ad0358702aceb8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 75.9MB
        • SHA256 20dc5eed5959bf04cc94b4ee8520c0d2f2b772c84a9266440ef11e0f21ee6608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 78.9MB
        • SHA256 2f6c9f0bcb2063518cebb9e47a9fb52fc8e80aa2cfc62db66aca27f9083e6e67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 77.9MB
        • SHA256 a2606ad3b4e776b4ac313b3b159f83fcc77e89f4c738b4b8a82410d193b93ed5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 78.9MB
        • SHA256 f87befb2cfd140555151118397be25dd6e30070313e94b374e86f78d79f1525d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 75.9MB
        • SHA256 e3bae8835fab2fbad85197cdab8165982025936481c2f0f576e02d8bb637b3cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 79.4MB
        • SHA256 436894a115dfded5778156d2dc6ad9a048bc9d3173998c4e470a03c93dabe635
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 75.6MB
        • SHA256 0dd63d2504759b34bd771accb2d303c2c114ad985b92e3735d83e5aa395046f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 76.4MB
        • SHA256 ba85ef9df7a6932bc93d1e3ed7166e329788ddc039927e70ccb6b16e29f2c18b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 76.1MB
        • SHA256 e660ec76e1901b3eeecf95c2b38d1f7dc0e2ab563275d6f90227f7403059b93e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 80.4MB
        • SHA256 66b20e5f202088ccc6085d65c21bdc4afbf7b22671358b973f7d0ce6b7d20d7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 77.6MB
        • SHA256 9e50aabd61ba4ab59c7d27df7619fa9b9f524ec71db37ce1d0638ea5a6fd3b5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 78.6MB
        • SHA256 e679d7037fee0179469d11d7f50e516484213dde3b4808022c786d046085af6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 78.4MB
        • SHA256 dacfbd664b598831c17f829fa39ad455d4203489e35a00cba3aee2f9119f9ed4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 78.6MB
        • SHA256 08a5750a43cd7f5e9ff7f1483524bca0e0e3b4ae14e265ea3fa474adbdd9fd3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 79.1MB
        • SHA256 92c3847ef7cb0e96677c0b89caa8c355ba6ea97b0fb4cb5c5b1da1c962fc07d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.4MB
        • SHA256 6e0bee7bb550ecdb79f012bcbd316266a0f4e38e0a8883a8a231a0045403e793
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.4MB
        • SHA256 1e1d88e9a25f3ccdab9fe5fc9398a3beadb28c6f907aa11c9fedec7019c1ba0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.4MB
        • SHA256 e30366f6bac9ce9b1e39a70135e18036723d6bf2d879a167a5e8e1b0cd9f6b99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.4MB
        • SHA256 d2c7cc2b9e7a7b023b7e3a5a6896eabeeded0c40dd5c720973740594f93aeff1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.4MB
        • SHA256 a04ba0c136bf30e5ea4f105470ad9890477685c135758225233176b0487e2c3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.4MB
        • SHA256 9aba2b0cda1bceeddbc012c7386ae54fb989e929da596c4b433b6d0c9e8fc282
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 78.1MB
        • SHA256 8dc8c6ddc1ac2646d4273c25c76d99f228856b48717922a5e28efcd4c511dd38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 77.9MB
        • SHA256 f864eb4823462d7f9bc9a1341e1f4f69bfb581622e73c78f2d6bf61ce6827847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download