Overview

overview

7

Static

static

3

2026-07-08...te.exe

windows10-2004-x64

7

2026-07-08...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 18:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_4bea81ea74a1d24d50bbaf2a50076ca6_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 3.8MB
  • Sample260708-wl6nhsd13m
  • SHA256 61f046e54c1c21291124539fe96b6522d64bc688abba32cafb264623e064098d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_4bea81ea74a1d24d50bbaf2a50076ca6_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_4bea81ea74a1d24d50bbaf2a50076ca6_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5900
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:760
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1680
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1376

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 4.4MB
        • SHA256 a10d1f23e0f54c450cb99518718622a65ec26a8c326ddc7f37838fd3e95856cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 4.8MB
        • SHA256 a8a9d8bd57fd6205aa5c6c04dae01f6cdef7852ad24897f3f9bb826587b4bfff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 4.5MB
        • SHA256 3b0baad66393297328c88ca9df2862fd8995aa89c75ea3e36830db8714ed5e48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 3.8MB
        • SHA256 a6153ff6b749f89ebbfe94d2dd037ff138c86c7dfc31d21787af34f621aadfe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 9.9MB
        • SHA256 084e5258a8cbc373f0e75a2e45125801489eef0d34de2f21a60b32aff2a2750b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 5.5MB
        • SHA256 11277b27a06b7f843bb65ba66092ad1a2ee12ec7351eaf59fd364f440b124c5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 7.3MB
        • SHA256 ac5c22f28fb6e15da31e1247caef8d12978bbf98a138eaf82f77cde9715e9c2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 5.4MB
        • SHA256 4d0b3d150f3d917fc8fd59cffcd03b50da01694a045571a69758afe2dd74f249
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 5.7MB
        • SHA256 0304a012ddb05ad78c427b2f65c792d6559c215eb766651fbe5ea2abae658362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 5.2MB
        • SHA256 5c1f5a89886e23b609567ca314191c83c508832b9c367f9487f52df0de773f6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GroupCopy.exe
        • Path C:\Program Files\GroupCopy.exe
        • Size 4.4MB
        • SHA256 74e40503811544cb3e8070b71fb0bc74a9439a53bbf597689c2e8b7afbc16ddf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 3.8MB
        • SHA256 3d9384c6f6d1b06a97bf4e2b02aa4044f405479c661dbf21d53c5ebdf0ac836d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 3.8MB
        • SHA256 a9172fb1ab14ad0e5325d1c67da40ab9f5fcaf3e4ec7fae73c42bd85a7170b6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 3.8MB
        • SHA256 2919e7544bdc60e3ea275431b02ac99e6b6b355f30acab0f1f785218c65434d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 3.9MB
        • SHA256 2ffd2bd25c7eca89cd4e30afa5aafc8e02320decf8a29d5d30bb3b230311cf36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 3.8MB
        • SHA256 c6a78f1c5613e8f54427568a042ec2ad8f689aa1f6bab9aab17275ff20871277
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 3.8MB
        • SHA256 04c67820e0311e6c55456e5b6eaf92bd6b1634c3d16f89d6c1f3a740504f6d50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 4.0MB
        • SHA256 b4e4371d933e8a1db6cf0b40b3a89253777f1d325a3ee73e320aebdf69b3fb10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 3.9MB
        • SHA256 b91bd55bc0a8a39ad720252c6c6a9cb856c8f739a75d48620eee7e39815487ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 3.9MB
        • SHA256 50f55c91f86f949accc78936e5cf043cf4397b720f1f60a3636a1119bb01d994
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 3.9MB
        • SHA256 0f4bcb6c636ed7b790f7e33a8fc72a0ec54b8d8c3fd331e248a7e42137c12c5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 3.8MB
        • SHA256 61f046e54c1c21291124539fe96b6522d64bc688abba32cafb264623e064098d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 3.8MB
        • SHA256 2582619c413e654a93477fb20870bbe330ac58185012849fa2a20ead89174b0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 3.8MB
        • SHA256 74274c837cb2d8ca33a5a255b26cc93cdc682b44ab99223645e651784d351b85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 3.8MB
        • SHA256 1c8a73491f06ba5732b0222b26bb2dcc71bec88333e59da31f6ea8de622a8a89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 3.8MB
        • SHA256 a694042612e6947129745418c52a3d3671b2bf7df5e613c251b3ee69b86f1a37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 3.8MB
        • SHA256 f33247e73064513b80b4662c6e3131bea64b71d27b0ff3f855af2e64822c3e7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 3.8MB
        • SHA256 823bbb4a5d88933f90a71890660297993e65a1dff049c773b9a88fd67c680bb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 3.8MB
        • SHA256 2aaf02164b57c9bbfc0e6297cbee9aa64c76cc084063c59449151c474647d3f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 3.8MB
        • SHA256 780d54b7be434ff5c34baac0ed0f95654cb9f9dba4d8cab8ace43d8c7c197a1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download