Overview

overview

7

Static

static

3

2026-07-05...ar.exe

windows10-2004-x64

7

2026-07-05...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 05:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_726f7291d3fbd661617bc64af8372b43_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 4.5MB
  • Sample260705-fs3bnshz21
  • SHA256 58a7bb9a6455e4592842f99ea5bb334f0cc045eb8516342cae429f604a3a86aa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_726f7291d3fbd661617bc64af8372b43_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_726f7291d3fbd661617bc64af8372b43_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1152
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4168
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2548
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2956

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 5.0MB
        • SHA256 b5526efad0610a7ff18e69e7628099066c3b48b18c28eaf7cd8cd749b3beabef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 5.4MB
        • SHA256 5d99b5c5361f07193714153a6abab39c2d819c3d98a8a2cf8c900a9bed9a5432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 5.2MB
        • SHA256 9d0a9738be414f28b193281cfc0c113a1e1776de1b4f7c12bb2872cacd861e9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 4.5MB
        • SHA256 5305957f8320a004d537da1a480cbd9de5fbfc7687b55d233edbf50bfd2a83b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 10.6MB
        • SHA256 4a48e700bcbe4c2362ca2fe51617f173a3be8d7c00701b32e4280587b9004d3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 6.2MB
        • SHA256 25c70d8fd79bf72f2efe0ad5abfa1e190009b514ed2c7f9e1552e18b518b8044
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 8.0MB
        • SHA256 c46b56c442d58c60099d739dc20aa862f4d06d332ccb7b71f6300b1f80b9a40f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 6.8MB
        • SHA256 f86bc50e88deeda91e9a24aceaa380d24f1335f6cb73a11fad35d791e23d5c4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 6.1MB
        • SHA256 f21c8ebe38b41c48fde02c8e32d66d0b687e81149dbfa7c23a9ea046cb554c6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 6.4MB
        • SHA256 dedca022fae7c17c1f2bc6df399bc0026e2bea5cc048de23e87dd390be1ad29e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 7.6MB
        • SHA256 5f86e4bc91339e72b8d7a9d247586091d7baaf5e7747a503bf8e513f3c1bf212
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 5.9MB
        • SHA256 c3bd5754e750daabfa9013cf81205d86f0f1947c5e7a650b2faac1b8960fcdd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 4.5MB
        • SHA256 b7dd0096f59040de093253213feaa55faa35cf5c73d8a9e1b98960873d2ddd30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 4.5MB
        • SHA256 503d8808f4251b5e7affc0a1fc2525a5c41eebf20d200c9278475a17c6364cb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 4.5MB
        • SHA256 ce0288e1f3f6605693ed3c493a7f957cfb3fd8475d1a9d031e893d6e6092e7ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 4.6MB
        • SHA256 82a469ca3648dac95b9e1094298e5bb614d9ab7be96ab1831e33a100779229b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 4.5MB
        • SHA256 81cfc4f0f65bae59079e313aedc1959daac90bdc0a4a6a23d06405c4b98cc7a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 4.5MB
        • SHA256 47a6c7726d2043c27f97ae9ea37cdabac2639d6c93494da1f25cac6f2ce30aa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 4.6MB
        • SHA256 7c266ffb20946e1b759d0d0d3957b14f0faf8cd2cace0c1998ff0068843a57b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 4.6MB
        • SHA256 7143df50d5a4db04dabbaa9509e8e2beef731c3785beb259060ccb237b2662c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 4.6MB
        • SHA256 833944f1c78db51cddd75c3424a29c9ecc2b54670e0dcb3e04e74fb7b63dd0b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 4.6MB
        • SHA256 df9512e4ad5f59b91bea68095e6b78bc2bf6705389b1e2845e12b0a4cacbcbd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 4.5MB
        • SHA256 58a7bb9a6455e4592842f99ea5bb334f0cc045eb8516342cae429f604a3a86aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 ff6e714fd6269e6934d0ceafabcf04978e3d1c43ac4a4d333c4f0de799e8221f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 3124507967bca9093935da32cc880ab0db7d115fbd8cfb3d3b144b5e4538b582
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 e090c5af972aa035afb6d5f2b34a89845146b50b68d23bdbe69cfc1a1a5004fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 99c9f7b2853d2323ca0d44fb96e290be5e6bfb58cd48e803d9bfc058919e3b21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 e561e128b2ff00ba7fd6dc9da446a522ad2c82592156e1a6c766f3a6235a3301
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 a7231bd738abc853ec8d1a447ebcf53a3deb6d296083594ee8d3279d5bc06fe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 a940563a962f74d1217ff402090fc2a5c57d4f450cbc871d42a795cd2ca33588
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 c16cf88bb1007255d2f9a5cc9e26de1a31c5d9a0e1bde69f0a83ba045cb190eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.5MB
        • SHA256 ecfabe4e98f685895b14eea97382bda9a59576cd796264003cdd98a76c3dae11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download