Overview

overview

10

Static

static

10

2026-07-09...ar.exe

windows10-2004-x64

9

2026-07-09...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    73s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 21:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-09_21a2e337d4af39a85e0035e93a6167d4_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
  • Size 2.5MB
  • Sample260709-1erm8sa12v
  • SHA256 2832b89e65154166d0aae5d3aefea323ab6650bc2aca43e7157037efcf3855b3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoverypersistenceprivilege_escalationupx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 25 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 12 IoCs
  • Adds Run key to start application 2 TTPs 26 IoCs
    persistence
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • NTFS ADS 13 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_21a2e337d4af39a85e0035e93a6167d4_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_21a2e337d4af39a85e0035e93a6167d4_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s scrrun.dll
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:1332
    • C:\Windows\SysWOW64\wscript.exe
      wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\446773.vbs"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2708
    • C:\Users\Admin\AppData\Local\Temp\118.#.exe
      C:\Users\Admin\AppData\Local\Temp\118.#.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • NTFS ADS
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s scrrun.dll
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2476
      • C:\Windows\SysWOW64\wscript.exe
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\512890.vbs"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2504
      • C:\Users\Admin\AppData\Local\Temp\624.#.exe
        C:\Users\Admin\AppData\Local\Temp\624.#.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • NTFS ADS
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2168
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32.exe /s scrrun.dll
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:1140
        • C:\Windows\SysWOW64\wscript.exe
          wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\30986.vbs"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4380
        • C:\Users\Admin\AppData\Local\Temp\368.#.exe
          C:\Users\Admin\AppData\Local\Temp\368.#.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • NTFS ADS
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4968
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /s scrrun.dll
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:5964
          • C:\Windows\SysWOW64\wscript.exe
            wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\391155.vbs"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4412
          • C:\Users\Admin\AppData\Local\Temp\920.#.exe
            C:\Users\Admin\AppData\Local\Temp\920.#.exe
            5⤵
              PID:5820
              • C:\Windows\SysWOW64\regsvr32.exe
                regsvr32.exe /s scrrun.dll
                6⤵
                  PID:5248
      • C:\Windows\system32\regsvr32.exe
        regsvr32.exe /s scrrun.dll
        1⤵
        • Modifies registry class
        PID:2816
      • C:\10a0699fa37928d39c\spfirewall.exe
        C:\10a0699fa37928d39c\spfirewall.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • NTFS ADS
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5196
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32.exe /s scrrun.dll
          2⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4932
        • C:\Windows\SysWOW64\wscript.exe
          wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\452633.vbs"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3976
        • C:\10a0699fa37928d39c\520.#.exe
          C:\10a0699fa37928d39c\520.#.exe
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • NTFS ADS
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5792
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /s scrrun.dll
            3⤵
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:580
          • C:\Windows\SysWOW64\wscript.exe
            wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\707363.vbs"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2828
          • C:\10a0699fa37928d39c\195.#.exe
            C:\10a0699fa37928d39c\195.#.exe
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • NTFS ADS
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4804
            • C:\Windows\SysWOW64\regsvr32.exe
              regsvr32.exe /s scrrun.dll
              4⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:5724
            • C:\Windows\SysWOW64\wscript.exe
              wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\37792.vbs"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4928
            • C:\10a0699fa37928d39c\826.#.exe
              C:\10a0699fa37928d39c\826.#.exe
              4⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • NTFS ADS
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3008
              • C:\Windows\SysWOW64\regsvr32.exe
                regsvr32.exe /s scrrun.dll
                5⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:2376
              • C:\Windows\SysWOW64\wscript.exe
                wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\728191.vbs"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1460
              • C:\10a0699fa37928d39c\349.#.exe
                C:\10a0699fa37928d39c\349.#.exe
                5⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • NTFS ADS
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:5264
                • C:\Windows\SysWOW64\regsvr32.exe
                  regsvr32.exe /s scrrun.dll
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:2504
                • C:\Windows\SysWOW64\wscript.exe
                  wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\834453.vbs"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2524
                • C:\10a0699fa37928d39c\578.#.exe
                  C:\10a0699fa37928d39c\578.#.exe
                  6⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • NTFS ADS
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1832
                  • C:\Windows\SysWOW64\regsvr32.exe
                    regsvr32.exe /s scrrun.dll
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    PID:5660
                  • C:\Windows\SysWOW64\wscript.exe
                    wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\263668.vbs"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    PID:4944
                  • C:\10a0699fa37928d39c\660.#.exe
                    C:\10a0699fa37928d39c\660.#.exe
                    7⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • NTFS ADS
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:1856
                    • C:\Windows\SysWOW64\regsvr32.exe
                      regsvr32.exe /s scrrun.dll
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      PID:4108
                    • C:\Windows\SysWOW64\wscript.exe
                      wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\770595.vbs"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:4624
                    • C:\10a0699fa37928d39c\155.#.exe
                      C:\10a0699fa37928d39c\155.#.exe
                      8⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • NTFS ADS
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:1272
                      • C:\Windows\SysWOW64\regsvr32.exe
                        regsvr32.exe /s scrrun.dll
                        9⤵
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        PID:5668
                      • C:\Windows\SysWOW64\wscript.exe
                        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\650478.vbs"
                        9⤵
                        • System Location Discovery: System Language Discovery
                        PID:3592
                      • C:\10a0699fa37928d39c\13.#.exe
                        C:\10a0699fa37928d39c\13.#.exe
                        9⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • NTFS ADS
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1840
                        • C:\Windows\SysWOW64\regsvr32.exe
                          regsvr32.exe /s scrrun.dll
                          10⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          PID:4268
                        • C:\Windows\SysWOW64\wscript.exe
                          wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\321788.vbs"
                          10⤵
                          • System Location Discovery: System Language Discovery
                          PID:1092
                        • C:\10a0699fa37928d39c\673.#.exe
                          C:\10a0699fa37928d39c\673.#.exe
                          10⤵
                            PID:1244
                            • C:\Windows\SysWOW64\regsvr32.exe
                              regsvr32.exe /s scrrun.dll
                              11⤵
                                PID:3656
                              • C:\Windows\SysWOW64\wscript.exe
                                wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\562191.vbs"
                                11⤵
                                  PID:6004
                                • C:\10a0699fa37928d39c\137.#.exe
                                  C:\10a0699fa37928d39c\137.#.exe
                                  11⤵
                                    PID:4420
                                    • C:\Windows\SysWOW64\regsvr32.exe
                                      regsvr32.exe /s scrrun.dll
                                      12⤵
                                        PID:4972
                                      • C:\Windows\SysWOW64\wscript.exe
                                        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\305324.vbs"
                                        12⤵
                                          PID:1532
                                        • C:\10a0699fa37928d39c\193.#.exe
                                          C:\10a0699fa37928d39c\193.#.exe
                                          12⤵
                                            PID:4080
                                            • C:\Windows\SysWOW64\regsvr32.exe
                                              regsvr32.exe /s scrrun.dll
                                              13⤵
                                                PID:4336
                                              • C:\Windows\SysWOW64\wscript.exe
                                                wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\367168.vbs"
                                                13⤵
                                                  PID:6124
                                                • C:\10a0699fa37928d39c\871.#.exe
                                                  C:\10a0699fa37928d39c\871.#.exe
                                                  13⤵
                                                    PID:3856
                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                      regsvr32.exe /s scrrun.dll
                                                      14⤵
                                                        PID:5044
                                                      • C:\Windows\SysWOW64\wscript.exe
                                                        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\46322.vbs"
                                                        14⤵
                                                          PID:2104
                                                        • C:\10a0699fa37928d39c\89.#.exe
                                                          C:\10a0699fa37928d39c\89.#.exe
                                                          14⤵
                                                            PID:4796
                                                            • C:\Windows\SysWOW64\regsvr32.exe
                                                              regsvr32.exe /s scrrun.dll
                                                              15⤵
                                                                PID:5248

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        spfirewall.exe
                                        • Path C:\10a0699fa37928d39c\spfirewall.exe
                                        • Size 2.5MB
                                        • SHA256 2832b89e65154166d0aae5d3aefea323ab6650bc2aca43e7157037efcf3855b3
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        notification_helper.exe$
                                        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$
                                        • Size 2.6MB
                                        • SHA256 3f9aba8fee2697d4a143a24c043f744dfe2dbb701b5b35335ce91104b8ec1419
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        javac.exe
                                        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                                        • Size 2.5MB
                                        • SHA256 307974c7740514996100f2f84220f03b616347c50307dada62e81934ce0f3552
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        pack200.exe$
                                        • Path C:\Program Files\Java\jre-1.8\bin\pack200.exe$
                                        • Size 2.5MB
                                        • SHA256 239e08f00324da4212f43032a1eb60aaeb3cd32d20e7d137f0795a2e2c4a406d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        protocolhandler.exe$
                                        • Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$
                                        • Size 3.3MB
                                        • SHA256 ebdc5cc138997933da80ad705f9753598d89271815d1e745685b0f84449690c1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        446773.vbs
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2C10A89\446773.vbs
                                        • Size 13KB
                                        • SHA256 4c7237036fd4749e4acceab410aadc6e72feb443d89b764ede9a38d1c64f2334
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        452633.vbs
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2C10A89\452633.vbs
                                        • Size 18KB
                                        • SHA256 151df50c27eb7f183ad90af1d1d8df5ecead302b89098f4b549781fb9bf42475
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        452633.vbs
                                        • Path C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\452633.vbs
                                        • Size 19KB
                                        • SHA256 68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        memory/1244-3957-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/1272-3263-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/1272-2883-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/1832-2384-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/1840-3650-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/1856-2882-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/2168-1548-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/2964-643-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/2964-0-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/3008-1793-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/3856-5168-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/4080-4611-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/4420-4241-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/4804-1516-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/4812-1300-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/4968-3226-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/5196-861-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/5264-2057-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/5792-1080-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download

                                        memory/5820-5148-0x0000000000400000-0x0000000000412000-memory.dmp
                                        Download