Overview

overview

9

Static

static

3

2026-07-09...ar.exe

windows10-2004-x64

9

2026-07-09...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    131s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 16:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-09_dc3516e0f1e264bf97d6312886d39e5e_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 5.7MB
  • Sample260709-tr7fwsdt3q
  • SHA256 68e13fe724ff581d0e0ea269161dbf6850287391911786e12ea6d19f763a7373
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Drops file in Drivers directory 1 IoCs
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 1 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_dc3516e0f1e264bf97d6312886d39e5e_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_dc3516e0f1e264bf97d6312886d39e5e_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1412
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:984
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5644
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Windows\system32\drivers\2026-07-09_dc3516e0f1e264bf97d6312886d39e5e_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.xls"
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:6024
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop sharedaccess
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4364
      • C:\Windows\SysWOW64\net.exe
        net stop sharedaccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:700
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop sharedaccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2492
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop wuauserv
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5336
      • C:\Windows\SysWOW64\net.exe
        net stop wuauserv
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2424
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop wuauserv
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3044
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop wscsvc
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4768
      • C:\Windows\SysWOW64\net.exe
        net stop wscsvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5848
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop wscsvc
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3172
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop srservice
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5772
      • C:\Windows\SysWOW64\net.exe
        net stop srservice
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5156
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop srservice
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3356
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net start TlntSvr
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3244
      • C:\Windows\SysWOW64\net.exe
        net start TlntSvr
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1812
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start TlntSvr
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1652
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net user helpassistant 123456
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:908
      • C:\Windows\SysWOW64\net.exe
        net user helpassistant 123456
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2552
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 user helpassistant 123456
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2288
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net localgroup administrators helpassistant /add
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4388
      • C:\Windows\SysWOW64\net.exe
        net localgroup administrators helpassistant /add
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:992
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 localgroup administrators helpassistant /add
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2032
    • C:\Windows\SysWOW64\sc.exe
      sc config srservice start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2128
    • C:\Windows\SysWOW64\sc.exe
      sc config SharedAccess start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:3796
    • C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2832
    • C:\Windows\SysWOW64\sc.exe
      sc config wscsvc start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4340
    • C:\Windows\SysWOW64\sc.exe
      sc config srservice start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4820

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 6.3MB
        • SHA256 455873ebe163966d5d564c3fe06cd74a735949befaac99e75ccd28d83e7fc361
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 6.7MB
        • SHA256 4461b0ed7483cba0453d5c1d569256bbfa63f06edf1bda7a084cfdbd216a9987
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.4MB
        • SHA256 fa97e8ea0992fb52cb851c25b4d18edcb2e355a63780fb6455fb22b7e22f0754
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 5.8MB
        • SHA256 9a44d5bb805b07d1b9a2505adbf18af9e0966febb8e809db4b5c386d9bfb9f0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 11.8MB
        • SHA256 79b742d58812c655d663419501cc6f0222b7a3e6bbdc2013bf1b3e9a711d4184
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 7.5MB
        • SHA256 23bb8fd80506cd98bbd0b4fdf07022bf6dfc234e8a2bfaa6a80070bb938dac00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 9.2MB
        • SHA256 7c7b3ab9e0d61b0e374dec80ce62f12e67929a3b784b25d62dd603dbd10de528
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 7.4MB
        • SHA256 c093601f636ad56a7501a04ca80851b040ea6a0a30d905e969e5977931fc0146
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 7.6MB
        • SHA256 6a3100586af146f7531da00a5fa73c94c95398e4b7eb7821c624995c35241bca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 8.8MB
        • SHA256 6cd5a40fe88090ab2365d07059f5cfb83d37041c8b32b10dd60f296e1601f120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 7.2MB
        • SHA256 060b557ca050e9ed9187f7c44aab0a6121fcf4e39d9e213f134edfd407400a3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 5.8MB
        • SHA256 baa31030ea316c0b9c4c2c36b3e30f198d1a390a7265dac5cd9e21401727b870
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 5.8MB
        • SHA256 47c51ce9a8644b1991909f2b2edde73e5012bea43ad62ac8ff40201da3802039
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 5.8MB
        • SHA256 edeb5e86338d1c477ab208cb9c576a63fd811c13124bc4f1ff1782d7e1311388
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 5.8MB
        • SHA256 b87a8c75e5e9daf1dc58e8742b9d79a055a7c719b19e331974d71be822fb805e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 5.8MB
        • SHA256 6b0a80e706fa42935193ef21b9cd29436cd89691c02909b74eba636efeb99be5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 5.8MB
        • SHA256 6aab9a0d36d54cf5e8bc02616aef793defaa4ce94f06c81d563db3bf42fdbe00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 6.0MB
        • SHA256 f48b9964d242362249925013e9e6ac9b0005e576c2cd36da16bd8b8c207781b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 5.8MB
        • SHA256 228e94a2448d7ea362c1b223e140c3336c3f186d07673e294d3ac04a860cfebe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 5.9MB
        • SHA256 1e6f9295f77753759376d86097cb52ac761a0d580e30c4e33fb70a8bf2b8005c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 5.8MB
        • SHA256 7b06ea36956457c53fce184cd9a0105ee84e6af9d8cc3a1bf0471bf559b86be6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 5.8MB
        • SHA256 beb3dded7bf71d305759789fa7fa741ee5760955c2cbd6844294acfad55e531d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 5.8MB
        • SHA256 e25060b6d9f19cb2375f75240cfd78663652e5e46ab66b36b0dd003f63e2c972
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-07-09_dc3516e0f1e264bf97d6312886d39e5e_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.xls
        • Path C:\Windows\SysWOW64\Drivers\2026-07-09_dc3516e0f1e264bf97d6312886d39e5e_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~1.xls
        • Size 7KB
        • SHA256 fa21e0fdef0c47e0e33bed92c5c30aea19e33b33f45be82681051c1c8e6bfae9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 5.7MB
        • SHA256 dad786641c777205d896ac4c324ef94e5c0acd6eb125c045146bbfe5ecd85df5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 fbccfab9dc934b8723acf12edf791888a33b800f85ae7d56b9f127b69d6a5fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 09633e39cf18ea114c0bea2fac70431afe9ebb289b9b2e7063693fb26a54cbfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 64985de3d72840ead0ca3917f77a178261815bdfd3d70961fd1a533cd24b937f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 e5184c3b6a434ae82a9dffe93c7e8a170c99d77518e2d20d0c024a9f5ba7f793
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 08f3869771c2c2d0c2b66a875ad275c87089cae074fc2a5e5877e10df7aafb98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 68702328a1204356f636dc3ff4557b5696775f89268a82368daa9899e546b7d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 4226b89f8071518f5ad9f12be3050b0387a61bb7bfd7fa54e6e90fcbe181232a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 bee07c1c0c53148d99fe6174b9b02e9e48018b8b6e8f410bada2ffb53d7472b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 354811b8a807905f1c3690c0105f33c9feb4ad7f1662296d27c8f2b62c7e49ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 fd6828c6d91b9d8e860d77231d0a85d02e22dee577482d8c748150c6d11160d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/6024-42-0x00007FFE0D680000-0x00007FFE0D690000-memory.dmp
        Download

        memory/6024-41-0x00007FFE0D680000-0x00007FFE0D690000-memory.dmp
        Download

        memory/6024-47-0x00007FFE0A9D0000-0x00007FFE0A9E0000-memory.dmp
        Download

        memory/6024-44-0x00007FFE0D680000-0x00007FFE0D690000-memory.dmp
        Download

        memory/6024-37-0x00007FFE0D680000-0x00007FFE0D690000-memory.dmp
        Download

        memory/6024-45-0x00007FFE0D680000-0x00007FFE0D690000-memory.dmp
        Download

        memory/6024-48-0x00007FFE0A9D0000-0x00007FFE0A9E0000-memory.dmp
        Download