Overview

overview

7

Static

static

3

2026-07-08...te.exe

windows10-2004-x64

7

2026-07-08...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 18:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_2518fc1f7ddf39de3c2a3b03e843fe32_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 7.7MB
  • Sample260708-w3vbtaey9n
  • SHA256 d25eec992dd05cab545210c290b6828950de4eec959fb32c862d7750c246e012
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_2518fc1f7ddf39de3c2a3b03e843fe32_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_2518fc1f7ddf39de3c2a3b03e843fe32_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4608
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3456
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3564
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5812

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 8.2MB
        • SHA256 f1e7905071e2818b558e49f6118789ebd10607780ba50ee07bf7a296c685e37f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.6MB
        • SHA256 ab8edfa8bb2a4e497933b76941a40b3de045a920f9cef6d4ae91de245a0f2b78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.4MB
        • SHA256 13f863c501870d2a35fc4a3ddcc8b5ce44b0b278983ba0748c69e75f6d113ae6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.7MB
        • SHA256 3ba453cd97ea74645789dcffe6f5734135deafd09a4a652f651c995332d8a224
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 13.8MB
        • SHA256 968a89be917e445209b53817a84389e189324f83704cec00c54fcea26368c0e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 11.2MB
        • SHA256 f01b5006787310e1e70fcea7dc5574150457f01ba11c863384d4bda3d2b95bbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 10.0MB
        • SHA256 72dd05b9904df57be0cbd2c09632c5bae09e02dbc2972b8acf17c108940fd41b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 9.3MB
        • SHA256 f4b961d256ce1f2bfe40fa31ae0964a3679208d8ee9011dcf2d458bcb535efd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 10.8MB
        • SHA256 6a07116dad90bb9a1c12f3a81008d39929be735dfbd1801e876803d8db83d2fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 9.1MB
        • SHA256 18be676b62927ef5c2e1a27cbdd0b1947a8831062579ee1a729433bd9856d4f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 7.7MB
        • SHA256 3d05ffa4596d3affdfa7bd545df7485557d833103f9f026268fcab2c02666d16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 7.7MB
        • SHA256 e366ed5b32901ccb43eaa0c3d628042cca8e0848f6f796fdb5e5bf1f28b624f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 7.7MB
        • SHA256 6ed9082e89b58289cbb16e25c58b15648f28ace062e3f291e07e59a7ef316cd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 7.8MB
        • SHA256 cebc395a96f71afe7c5de0f04ae12236e33e0b70d3f266afbca02d6b604f62fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 7.7MB
        • SHA256 279d3d5c34627569fb3257efdc47208510dfe9c6bcff88c037bcf290e8175e13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 7.7MB
        • SHA256 8c5422bcf9e704caa9548cd28368e390675e3ed784532d80044811621126c855
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 7.7MB
        • SHA256 e72a174df87c5ab0239296555f0b8111ba5f9db93996b24be762229c87dba035
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 8.0MB
        • SHA256 f8aa28ae2d27f415d29e0cd68a770910d53c8bc11ec2755d2c9e13d001d36cc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 7.8MB
        • SHA256 009042c22a6757944511002f68e38c0776e49578d00aaf855dec998d2b0902df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 7.8MB
        • SHA256 4afef39d3e407cd6f30033108848dd5addc3eddd5fb81e20fdc66276df53ad82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 7.8MB
        • SHA256 a274e0541004001b88ed0a5733ebdcf13c488fa22890dc953de23093f7a5abfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 7.8MB
        • SHA256 b65c7f6132988629e97ad4264bc1b3aa2f4a0f79cf0d0bf04612f936caaa96ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 7.7MB
        • SHA256 d25eec992dd05cab545210c290b6828950de4eec959fb32c862d7750c246e012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.7MB
        • SHA256 7fa69a33e4e5ac36b92ebd5a8bcf91c139eff6fe8dfcf683058de97da8c1bd37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.7MB
        • SHA256 8e3044b7753fe7b4b2bec166c479dbe60a0ab96df32cdb798224bd35148703eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.7MB
        • SHA256 c72c2bb343c22a850145b9b4e824628d7608c14d642ffb5a5d04619b437fec2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.7MB
        • SHA256 b5f3b92f95f82baece918c2689e21d941711285ac4317a11e7c94ef32f739d5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.7MB
        • SHA256 765fc52e6f2f9defc99320ecfd7ce967c7ee09e7a3d3e37004eda399896ea175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.7MB
        • SHA256 9e7768f602e1482ffa2843680d33720c28fc5ec7205c3ccb5bf1ae87a6cb0adb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.7MB
        • SHA256 72b8833e5ff30760d9f393910a74c9d527e2fd0db093a6e0377423540ea14ae1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.7MB
        • SHA256 02290635d1611b00edad8204fee5fa5daafe9ec056d9f7d6c674ad2647ce7f61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download