Overview

overview

7

Static

static

3

2026-07-07...te.exe

windows10-2004-x64

7

2026-07-07...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 07:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-07_65fb73472768aa29edc359e7724e11de_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 900KB
  • Sample260707-jthkfaat2l
  • SHA256 0736cbab488f9bfe7f356dec35ae9244c40db304523856eddfcd3b479213ac27
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-07_65fb73472768aa29edc359e7724e11de_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-07_65fb73472768aa29edc359e7724e11de_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3764
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3604

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 1.4MB
        • SHA256 e27c69e5957c34ce76d57e22e6ae177ba3f238ae9d3de1211ee75eca777c46eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.8MB
        • SHA256 bc4909ecbfff37ff2219e1f92f3786a1bf8519a2639d943bff81acbdfae7780c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.6MB
        • SHA256 7716aa67983355403624145f59d2acf97cf61367459f389fc2463027c989644d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 914KB
        • SHA256 f029ae49dfb701c3d9aaedb1236badc2783472d0a1c25244da24d74549957726
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 6.9MB
        • SHA256 5111ba93eae31fabef80982e89d2157994a6bc264baea39a462a84c92b60435b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 2.6MB
        • SHA256 056bc546c0d2779f88cda3701b8eddf9c40ea8b2d5c6684402170013766a0a02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 4.3MB
        • SHA256 71cb205e9fa2a23623a0e2a9a9257d9a03d55852bfbe2c3b39196722778a5582
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.1MB
        • SHA256 a795eefacbbf59132aab9c061af3978a73f9f9f7b34f513991054407c366f555
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 2.5MB
        • SHA256 861d4b280550a21e7c430fece8d87b2a7e6b790e42dd2b3dbb67e233ee9773ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 3.9MB
        • SHA256 713c6199e8d7ce0a3cc3511c7ed6a3fadf47ff3bd94534d9fa0cb2212db76e91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 923KB
        • SHA256 ef3c92f8789a46a7bbcd7cc8df08130ade79f8b5c2e676849cb398a638ad9d51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 923KB
        • SHA256 a365c971348a20568fa3ca16f150e4f4b0c109ef1246c68c8e611ef577f6be20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 923KB
        • SHA256 9b981e244d28ebdc36e33812b39c9bcb3b3a4bd23655184bad79c81bf83195b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 944KB
        • SHA256 36db0ac4ea40c558be6cfa62e955fc1efd1c0930b52fae8fb5e0ebd31ac669ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 923KB
        • SHA256 fc0e9cf92bfa61bbb173a297f0a01534b58a8cf730256594593c9fb4ff0f3fca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StopSave.exe
        • Path C:\Program Files\StopSave.exe
        • Size 1006KB
        • SHA256 52ea3837d1ff68dfc21f1b97a348f2cfc625f11771c3088f1a6c135afe0dd0e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UnlockAssert.exe
        • Path C:\Program Files\UnlockAssert.exe
        • Size 1.1MB
        • SHA256 c854d28efb040a3c73bd8a12e45cfa675da9b5010c9e679bf6ab9201fae2eccb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 1.0MB
        • SHA256 0b362f5ffd76638aca745b25d2a15cadf8ffe25f7da39f87bc24edd6e51e2879
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 956KB
        • SHA256 825a78a23763589d60026550a9df246a6f68e02957e7c885da37e2bead43302f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 964KB
        • SHA256 d27134563d31da900669e0d5e9e331b3f6641253f90b7a686df223b63d2c0d22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 960KB
        • SHA256 3cce17c2eaabf15adfc2d2fde012360f4d3be025f7984e89ef0f67544927f696
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 900KB
        • SHA256 0736cbab488f9bfe7f356dec35ae9244c40db304523856eddfcd3b479213ac27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 900KB
        • SHA256 3d17ef9fe66cc1a08b5abd166d8252d1396281770612dd7fabf05a4fb44f5840
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 900KB
        • SHA256 4270efe60f112eb57f0d7af8d709886d4b4886455cdaf8b961b412e9f7f88248
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 900KB
        • SHA256 6b371bec2710556597b573e18b135f45aa1dd5b1101f4707f7d1040dfd9c50e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 900KB
        • SHA256 42a61679657c825a0a1343386b6b5e420cc66b962cf576933bfd11a8d546c5fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 900KB
        • SHA256 c6fbbeb72a96ceea9002cb81ef5c75670a29b155a907ea2098a822a91f46a35d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 900KB
        • SHA256 ad915a62d04d47740d8482c6e4889797ed7d84350a8e01304b7fc64ce29557d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 900KB
        • SHA256 8cdb524e5ae64998d44750ceda8c38f03af7181197addc0d9e40cce264bf8a95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 900KB
        • SHA256 a3dac3ea48798f9b6c39e48686930ddfba1f15444476f17af06a1665981c6d42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download