Overview

overview

9

Static

static

3

2026-07-05...ar.exe

windows10-2004-x64

9

2026-07-05...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 15:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_ad8043654b9e313668e54bc073467687_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 8.7MB
  • Sample260705-td9dbsdw2z
  • SHA256 85dc444fa433e2e16993512b7c93cc869a8fad78bc0e9a8395125c770567a44f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_ad8043654b9e313668e54bc073467687_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_ad8043654b9e313668e54bc073467687_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:912
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5812
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6008
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4760
    • C:\Users\Admin\AppData\Local\Temp\2026-07-05_ad8043654b9e313668e54bc073467687_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
      2026-07-05_ad8043654b9e313668e54bc073467687_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
      2⤵
      • Executes dropped EXE
      PID:2656
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop sharedaccess
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2720
      • C:\Windows\SysWOW64\net.exe
        net stop sharedaccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:804
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop sharedaccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4788
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop wuauserv
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Windows\SysWOW64\net.exe
        net stop wuauserv
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5792
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop wuauserv
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5632
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop wscsvc
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\SysWOW64\net.exe
        net stop wscsvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3804
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop wscsvc
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5776
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop srservice
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4740
      • C:\Windows\SysWOW64\net.exe
        net stop srservice
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6132
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop srservice
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1940
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net start TlntSvr
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1920
      • C:\Windows\SysWOW64\net.exe
        net start TlntSvr
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5264
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start TlntSvr
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2788
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net user helpassistant 123456
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1704
      • C:\Windows\SysWOW64\net.exe
        net user helpassistant 123456
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5972
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 user helpassistant 123456
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5600
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net localgroup administrators helpassistant /add
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5984
      • C:\Windows\SysWOW64\net.exe
        net localgroup administrators helpassistant /add
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:872
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 localgroup administrators helpassistant /add
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3676
    • C:\Windows\SysWOW64\sc.exe
      sc config srservice start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4120
    • C:\Windows\SysWOW64\sc.exe
      sc config SharedAccess start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:5532
    • C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:1652
    • C:\Windows\SysWOW64\sc.exe
      sc config wscsvc start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:5744
    • C:\Windows\SysWOW64\sc.exe
      sc config srservice start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:936

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 9.2MB
        • SHA256 11f9457f4554a4349c7ca1ba3457d7f3a3f45d4b3a86d762d8354c566140826d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 9.6MB
        • SHA256 3faf61ba9b61bac286edef635127d18bb591e342e1cece22c901c64a474c9135
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 9.3MB
        • SHA256 c3b8a4c9f9c2a1c949de80a92f8cb173077c83ee02baa482a34bd1446d389359
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.7MB
        • SHA256 9f458c6f0c1898fe76e963888623e0f9616cfd3f7ad841162a121435973ea627
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 14.7MB
        • SHA256 8a9463a0f8f22298fcf61ba1220009b458abac0129791828e121a16f36871bde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 10.4MB
        • SHA256 9e419defe86875db3a0e76499dd42d0adbed1a96232d5bcf9cb26ed5dc5ce36c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 12.1MB
        • SHA256 bb76c0a558484cc6611f29a130378062e0fab7dbf845547a364fa12cbd5e4d1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 10.9MB
        • SHA256 f93ba8dc4eba332bbf21b2eaf660f845174b7dc29eb5dd1f3b46f4c7fa9f77a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 10.3MB
        • SHA256 41bb664edcbdae415caaa6a41f2be93fc512ef17f6ba859409026698b15e3af3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 11.7MB
        • SHA256 6e45e16ac3a84216bcd6acac71d8edd70186d0994305f2d357d2700ac3b2f0d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 10.1MB
        • SHA256 69e41474044b744a85214204bc4ce486193b82e1cf1917176d85c8ca76170ea5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 8.7MB
        • SHA256 93fdf8a10aaa9fdca12eb6a5304e696f61f3e5114cbcfdcf64128dc4c7283b8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 8.7MB
        • SHA256 1a36ed476d93c4c8e7cfc9c5d57aa0a4a1acca3ec79981677d7db263c6ee76c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 8.7MB
        • SHA256 50f9c1493e6560ae8c9ec0ced988f50f25525c44f4fe8aaba82de8202923e575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 8.7MB
        • SHA256 50f9493cba977786888311e2f5ae614c307cda60fa521147f24ad55423d69112
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 8.7MB
        • SHA256 bdb8411333c3efb2e802b0c380128b58629e49cb74c4f1dd3ef39cc034517b3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 8.7MB
        • SHA256 86287c1cfca122ecb7d9e33cf23eafef820aaa86ad4127ece76b8b2f09a55003
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.8MB
        • SHA256 d999892d1570be83a9066c1a8f05065527d652e133ad2a94f67d841143aa18e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 8.7MB
        • SHA256 501861f3b71fe63199d2e7b93c17e50784c6deb018eb8abd62dc00148bb55262
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 8.7MB
        • SHA256 56f48cc7ccb808ff1fecce68e0ad13253c6d5fad250b31da653d972c316244c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 8.7MB
        • SHA256 7a3dfac5782d634f4c81a7e7ae436199254e4ee0baaa7c57ea876ccea5f00d45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-07-05_ad8043654b9e313668e54bc073467687_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-07-05_ad8043654b9e313668e54bc073467687_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
        • Size 44KB
        • SHA256 edc771decb21316a2c28024f0427019da00cfedcb746378314f5b76cb21b529c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 8.7MB
        • SHA256 39f1170ba7b46fcc98ea18bc870df9ec55792c9ea976ca2f52773305bf39d40e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.7MB
        • SHA256 ad727eca9f2fdf6ed94ba3b47a99aaac2231e9c769c0f2f049d6af7394acb250
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.7MB
        • SHA256 33d159b0a907dc6f9206d5fde598a42e842d95aec08d2d55960ed17300be8ea6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.7MB
        • SHA256 9954389a2c54c350fd49c861a37c282b92d8dda61b9ee5ec8d4407636a870f2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.7MB
        • SHA256 90d5c4ac1a79059805e3fe0bcf963d10cc5966809b32f12bbd24037d6e3a240d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.7MB
        • SHA256 2f97837655e042309692b3234033153f0ee3b2df0ac8cdb1dacd5637e9720cd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.7MB
        • SHA256 c220c733a78420d57086be2728e89615ceba452a7293a6c39396c914701db6f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.7MB
        • SHA256 52e13d37110101eb58955a71db2602b68de13d0be56a8019ef388dac58e7fc4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.7MB
        • SHA256 b62f348bf920974e1bd37c1c2daac85f34f0373a95303a017194ca3dd78e132a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.7MB
        • SHA256 96a8b24f8d79effefc75201cb7fb955a6d43ddc5ee402c3c7992c37c6b252491
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download