Overview

overview

7

Static

static

3

2026-07-02...te.exe

windows10-2004-x64

7

2026-07-02...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 17:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-02_7133d3ff40b60aed11c23c16cb74b408_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 8.5MB
  • Sample260702-vycersfy4m
  • SHA256 00347c070ad161e57beec05d2dac33cd383952a1e976e58755bdede190d43809
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_7133d3ff40b60aed11c23c16cb74b408_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-02_7133d3ff40b60aed11c23c16cb74b408_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3452
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3144
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5748
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5740

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 9.1MB
        • SHA256 bb54a29924581e7b0a8953751ec2b597206d3544f62e0798551e4712208de9cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 9.5MB
        • SHA256 d8133771589b77488b3010a284b975c6f60506bfcdd9ceab0117a230a1018efe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 9.2MB
        • SHA256 98753d759ae057498e8fd3a45031626ea8b1a52f7d1a041695c71260dca03219
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.5MB
        • SHA256 2b858b742f115ad514d95e62d1b20046d7724a515ac4fef78243c65531df813d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 14.6MB
        • SHA256 cbf1357a26136a6310295044c47e80241f9ceb2922a6d8c5b853cf195df8bee9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 10.2MB
        • SHA256 8c6f7270395740500f7557b098d4ed06bdc11c96674322b473badc081feeb194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 12.0MB
        • SHA256 ceb3577b7006546e55fc8c9f1c71e721d1bcc02e8634bd22a5f16afcd6efbe3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 10.2MB
        • SHA256 c080706ef0e4fcff67c4cdf7274491f2bee98e2fbbc5f4389c36663284f495f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 11.6MB
        • SHA256 125de508d0ef3edf645c79eea8a45bead5056033fdde9f406f8a6a678189d958
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 9.9MB
        • SHA256 f588f3da9fb2ef87c8d917484855d06cd8300614cca3b236844e24267c5d1ff4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 8.5MB
        • SHA256 91e7fa21154dbd267fa6e266c9a34e39bdacb2d674e98109f711197e58b1a261
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 8.5MB
        • SHA256 19c679ac4bc02eeda6fa47354b9442be231da3ae7f4e18c00763a970cc17b0f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 8.5MB
        • SHA256 48c32155046e2a2584740f9b434e3c29451c7bc6454460d7a3a3231cc77e86c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 8.6MB
        • SHA256 977f65ecde9188a1b62c47a2c33da84051e4cc34115f0940de315a54887b9b27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 8.5MB
        • SHA256 1c5f6ce3eb68b536d08a03a5264f556118026407f12c8bca7c0ac79bf144b69b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 8.5MB
        • SHA256 346c6c99de28081f1d42f8a2b895ec0742cc34ba82c59cd23d9e6e2d738b9b23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 8.5MB
        • SHA256 aec8b610e0219e582fb0eb660e87329f78a370bd43c7e44c0e024ae9dd37cbab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 8.8MB
        • SHA256 a251bbb3cf3320a6cd186f564f876718e5df410b949c165ce738fdcd6b35e154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.7MB
        • SHA256 3c5fe5886959de19dea5e0a7a828d170a856c005e1de20452e0af7f36ba14087
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 8.6MB
        • SHA256 2064bacd52025cb5b8920a34d7bd2a9f927ee1870e4df0842a188f3d16a0cf4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 8.6MB
        • SHA256 769c582c40063e4047c31401b5a76d722bc0443fa24c8a5469796c2738cac085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 8.5MB
        • SHA256 00347c070ad161e57beec05d2dac33cd383952a1e976e58755bdede190d43809
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 dfaae6a946a839dd0599614859a5e374b7591bef9792e24152a1e61c158f0d33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 99190dbf810080857eab48ab6465434c036bf7dd968b6756c51535514d916604
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 ec03877a4115c2d94272af3c457744a70297757bb1dc7f4737d031baf7cd13df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 d219cab4b18e1556f3f82c25a9daa6adbd20a669576b1099a4a2473ecbc34c4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 cca692eeddc31209f724f191c4778cb8dc2fcaddcd73006f76211d841de17c7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 a894e99b77e45025ca63450bf17cd2d98814bcff54f0b16e0248bc7293f3beca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 625f9cd23ba50db0564016c1646ad9b735c024c1ead772df3330aef06e0a6eaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 0a6ccf8e01333aa3643220d2d6ebc5680fde43f60d18fcc32fd25ea9021cddb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 c839aa1a10423f9ca7ba0e3bf28c295527a0a1fa3c6c447bbe6feeaa2e7fcb4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 61031e052af2e934a1615fb7906884b1193c5bc9473c1ced5ee26550ec3aa690
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download