Overview

overview

7

Static

static

3

2026-07-06...te.exe

windows10-2004-x64

7

2026-07-06...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 22:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_0314740fd5c7ad738c9707fa42a25a95_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 6.7MB
  • Sample260706-2sxbbaas7k
  • SHA256 d39865a78127ef45d13805e8da3001c307d18777e734407417f9a3f5b446656e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_0314740fd5c7ad738c9707fa42a25a95_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_0314740fd5c7ad738c9707fa42a25a95_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5508
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:916
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1252

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 7.3MB
        • SHA256 b7aa3075189fdc3413b8f11d1c6434f78c6e9fec8ea8d8f6b86aedb023d3004c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.7MB
        • SHA256 5928a9b63b9a6ecf7fd577fe1a22d1d6736e9aee9a8544975e4ba86d80e698cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.4MB
        • SHA256 fa2b540b3f6fe4b678a02f1d733699f58a3372a0269c7c46ecfcdc8d3d2a3c28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.8MB
        • SHA256 55c6e8986ba8fe7ba7aeb9553a5c9198dfabeecd603627804dc8546cbb80a37a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 12.8MB
        • SHA256 0b15d61b65f8f1539ba5b0f3a2d64ac599ff956aa3362f9d064d5f8eac8ef2ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 8.5MB
        • SHA256 ac5cee8be889e6e3b13328f6eb1214747813bf447b65602d99c74fb7f3b1a616
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 10.2MB
        • SHA256 139b6673ddd85e3bcc6a4281b89b9ff583cc4dc57363154a8902d0ba518c770e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 8.4MB
        • SHA256 cd966bd9b10e14b8e3683b4fe5314a04dfc430305bc0af5b52686521fa6c64c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 8.6MB
        • SHA256 17d687857bc0df3a74fe7cbe5a4b6ad4735dc190195ed5cbac39339d3592d195
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 9.8MB
        • SHA256 11dcc75935d412b2c11684c6f44fa3b3f4a9861cde2058dd4d841b967c7e486e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 8.2MB
        • SHA256 5a53139597fcad9302b0be0509e450cb49a5f2949c5792f3810979b9816a293b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.8MB
        • SHA256 18b480db0942e51453e2c841d5c0ee7c9eb460bfbd892710c07e46d92af78e5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 6.8MB
        • SHA256 8ac6f9910bffa771ccef726f6021aeaa19a344322ead64a07f65a2c799611d3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.8MB
        • SHA256 633a566565223b4c6d60f498e0efe6702813e1a13d9c6ef909fb14fec9ce5268
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 6.8MB
        • SHA256 d066091d7f0494a276759a224cf5b837b597e88058d82838e70936c60ee54f22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 6.8MB
        • SHA256 5d1d24598f756df99804601737150a73664986e13cf8ead5d3e7d540262259ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 6.8MB
        • SHA256 3f79dcb62bffc4dfc7be9c12b1da597244148c8d43791a35ff129aaead962e11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 6.9MB
        • SHA256 b9e6836bc8316e6e2db38651512e0805a74cbce20a934e148e9739c19f856446
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.8MB
        • SHA256 2d642c780b5e53e636382854d8442d3c392130aa9c9ce4cf3b4544383bd06088
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 6.8MB
        • SHA256 86110ec557e2263b59bd1ca42768ed333f3580af476406633ef7bfe9f85cc44f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 6.8MB
        • SHA256 21115c4f30f07584edfaf5f632055ecedd7b647698507f84317da1cda5138f9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 6.7MB
        • SHA256 d39865a78127ef45d13805e8da3001c307d18777e734407417f9a3f5b446656e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.7MB
        • SHA256 3e487dc6406bba842837c1b441f42dd575c9a3416e93859d4d24f92180058734
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.7MB
        • SHA256 c006387c1dd4c9f8e56eea6bc340477509d1fe8b8827450a045cec585f5fdbaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.7MB
        • SHA256 cbe767549c5d4d50384b41a2830eed8ccc34380cfe2869e74b01f2282713c333
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.7MB
        • SHA256 90abf3f6368902cab727702ac3b9956619bef213a269e47e1bf15f81f0809544
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.7MB
        • SHA256 359051130cfe520309c33ee849b5ceeb8a265fbda0e0b4030aec90cd44c7ee47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.7MB
        • SHA256 0bf82f55d72580568741c1ad8e737363b09ab93769f80a8c76929dee810784fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.7MB
        • SHA256 df177ead7733d4d73afd4abd8064a9966fdb1efa07294528f2188249d1854e98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.7MB
        • SHA256 a49bc28353ca504a227715da6b84826ac6c15cf2511c8ab576fc95ebadd600ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.7MB
        • SHA256 c098988eec4d630aa875269c5f149a351906ec3f322e13e91fd32a903f2d10f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.7MB
        • SHA256 7508e4fd77d26d8617b9e1c60febb447b0c70da863b2a1a7cc67f9951e1aa70e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download