Overview

overview

9

Static

static

3

2026-07-02...ar.exe

windows10-2004-x64

9

2026-07-02...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 16:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-02_a0784937369d315fa74c44a8fd775401_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
  • Size 1.7MB
  • Sample260702-vgfe4aas7t
  • SHA256 72f7d9f1d07bad472a9c511b3194c7f025035bd48f440c5048fdc118a0618377
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_a0784937369d315fa74c44a8fd775401_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-02_a0784937369d315fa74c44a8fd775401_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4672
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3440
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4308
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5412
    • C:\Users\Admin\AppData\Local\Temp\2026-07-02_a0784937369d315fa74c44a8fd775401_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar~4.exe
      2026-07-02_a0784937369d315fa74c44a8fd775401_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar~4.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3592
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop sharedaccess
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4652
      • C:\Windows\SysWOW64\net.exe
        net stop sharedaccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1900
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop sharedaccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5432
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop wuauserv
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5176
      • C:\Windows\SysWOW64\net.exe
        net stop wuauserv
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2596
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop wuauserv
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1848
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop wscsvc
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1288
      • C:\Windows\SysWOW64\net.exe
        net stop wscsvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2892
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop wscsvc
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2764
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop srservice
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1776
      • C:\Windows\SysWOW64\net.exe
        net stop srservice
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1380
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop srservice
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2544
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net start TlntSvr
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Windows\SysWOW64\net.exe
        net start TlntSvr
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4748
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start TlntSvr
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3456
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net user helpassistant 123456
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4260
      • C:\Windows\SysWOW64\net.exe
        net user helpassistant 123456
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4076
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 user helpassistant 123456
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2424
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net localgroup administrators helpassistant /add
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1464
      • C:\Windows\SysWOW64\net.exe
        net localgroup administrators helpassistant /add
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4392
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 localgroup administrators helpassistant /add
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4792
    • C:\Windows\SysWOW64\sc.exe
      sc config srservice start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:5836
    • C:\Windows\SysWOW64\sc.exe
      sc config SharedAccess start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2016
    • C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4648
    • C:\Windows\SysWOW64\sc.exe
      sc config wscsvc start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:5900
    • C:\Windows\SysWOW64\sc.exe
      sc config srservice start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4764

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 2.1MB
        • SHA256 c41a0ad0881f616cd5898cb2d9fcc82fea2d505f347f20d563438c3d5941e4fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 2.5MB
        • SHA256 7862cec00dbe8e00698fdb25ec3e7f275f7dbf54e8e3f62a711e004ea436f711
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 2.2MB
        • SHA256 c92df2ef6c587397ae203e8db77423cd4f00836932c03f04ff5c74837bbfdda7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 1.6MB
        • SHA256 4d67f594040417cbb12c0d4b5688047aec30af1b2c5f1fabd7c58cabb11d5c42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DenyBackup.exe
        • Path C:\Program Files\DenyBackup.exe
        • Size 1.8MB
        • SHA256 34c64ddd47a66f086505726c0c56ac48412528c89b2435e8f946b0c4d32d8688
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 7.6MB
        • SHA256 04f3329fff34bbe9ff01a37a3ece83df864a76127b03d32055c423431be7fe13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 3.3MB
        • SHA256 1b42ec7f2ee0a5090add979cd25f3ba648520de308434979873c132b0dd93b00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 5.0MB
        • SHA256 4a93cf3e6408a232d55bf1edb91c543c9fff86381951b67a06494e31c49ffb23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 3.2MB
        • SHA256 be7bacf245b4b641109eb7ae8b5932dc5f199d0912e266b115e32071720a8ec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 3.4MB
        • SHA256 cf26f188c05bb89caf1a560c6e42e8d4f73ad7106a6a851464d814104c20dbf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 4.6MB
        • SHA256 5e3fc6d192e00ffb1f718fdf74860b11721c55b8a2d6c3e46b34074ab8e74d83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 3.0MB
        • SHA256 2f46f2d923c27ba6d00f00101e6c0e3ef035abb2f96139c6cc93ebfe69632323
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 1.6MB
        • SHA256 bd1ba2c6e327c1806c839252f3e4d87977a3f22cd78c3bce3e2a4a59768fb962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 1.6MB
        • SHA256 40b18b6eac519cb7ca116fb17825d0acac00712c012240357a36977fc34f06d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 1.6MB
        • SHA256 deb9ca44cca96d23417f762108943bb32dfd591bc475867692fc2b4eda9781f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 1.6MB
        • SHA256 ba09a59b83eb71b8ca7b55d8730103db2c291b4602ac61094978685e8b972591
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 1.6MB
        • SHA256 0636ab36e16d8bd356d9f68cdeced339fe7c4c20d1040d10bc27d2578a02ce72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 1.7MB
        • SHA256 274d050c977ec4caddd5002df138b0de58c05a39162186595ebbbca7d2ba0e8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 1.6MB
        • SHA256 f0e23c28890846f31249c354c5d402837a01e7ebce982829792748e3d08fe13c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 1.6MB
        • SHA256 749f47cae63a0c601cf107913034903c29c913cd8dfe593b224088397dd3ec8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 1.6MB
        • SHA256 878772950dda9bf9ec90cb16c4cf48653ee026a5cb5e6a2b61ad2764332ef1c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-07-02_a0784937369d315fa74c44a8fd775401_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar~4.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-07-02_a0784937369d315fa74c44a8fd775401_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar~4.exe
        • Size 147KB
        • SHA256 820f7b8fcba857f6c99736db09bf996d8cfa34d4da23f79700f7c0ebd0f4c74b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 1.6MB
        • SHA256 7c44b7b30c4313642d2ffc1ce2240f044f652d106e0c2809097437b079338153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.6MB
        • SHA256 088c465ba4c649d6e22e8473aafe829f7eb07cb1e766ca4ab6cf135746b5b2f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.6MB
        • SHA256 6260f59496455de0de22e6ea19261627d506c19259bd9ef6210da2f1dae1a169
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.6MB
        • SHA256 250fc5f7b1c0271db04d68103cfc1c3897b2c96257ec18a05a88e3e2287046c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.6MB
        • SHA256 f90c5e08c52dccbd94c2aeca35f9f38044c44e0327cb121ff88db18b1f4c0347
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.6MB
        • SHA256 0315970a7f264be5c9a4189aa9c91f609e2b12b5aa2cd3aeb6ef0b68dce389a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.6MB
        • SHA256 10cf34b45e83f76d85439e9f1ee53831120b89ae594fc5259ffc4e4e04318325
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.6MB
        • SHA256 007f7978ec741dd1144db1766b614cc37fffab9dddde65b0c6e759071ee1d49a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.6MB
        • SHA256 570d2a037423efbbdfa1e859cdec329324aca581d5f13b1424c8c02ad3ad375c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.6MB
        • SHA256 9386e2256261fcaabd51621eeb9f379b50272e5837b132763665b32cb688d5f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download