Overview

overview

7

Static

static

3

2026-07-10...ar.exe

windows10-2004-x64

7

2026-07-10...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/07/2026, 18:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-10_42411cd3f48a62d6c7b714d4bae6c013_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 11.7MB
  • Sample260710-wpn8msgx9x
  • SHA256 a980e76c461d0a1e4b7879d506e9531c6df97a82c2dd220cd32eb1f381ddf95d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_42411cd3f48a62d6c7b714d4bae6c013_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_42411cd3f48a62d6c7b714d4bae6c013_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1060
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4432
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4268
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2684

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 12.7MB
        • SHA256 6fd443f39693be6f6e0f7755c07b9a90139870197de01834417f32062230f9aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 12.4MB
        • SHA256 d304317de2be6a749c2ff997dc17cb1537681783bb4f30a562afffdc5947ed6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 11.7MB
        • SHA256 2495649ee08d6ad8c6e150221d20e6f107e85243defc1a6a57de4b824830d25f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 17.8MB
        • SHA256 c548449396b7249846ede677bc4dd00695211d2e4b23b285954c780d3a53a9e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.2MB
        • SHA256 8ee445c9946b5fc8d83003039d227c521992965c6705e50d92bbaf726091e757
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 13.4MB
        • SHA256 a82735bc692333c7035656de6ece9ff88dd9c663837823da23f918bcb9980736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 13.6MB
        • SHA256 c0f5a4925679a2ee3cb0eb840e01a6e4ae91548faeed344f7091c286893a8ef7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 14.8MB
        • SHA256 47ce09834b73ff0556b37a3a5e4bca8aa352aadc1611b60b782206877eb1922a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.2MB
        • SHA256 99fd30ef43d4d5a162bbd5dc2877ddaad6943644c2aa252c58fe5d4753698234
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 11.8MB
        • SHA256 fd49651d17da48e14580fe0739aceccb463c5f9bde54b12ce1af98e94b484b32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 11.8MB
        • SHA256 0e51bb89e7a0f7fe24a6ef787ef2fc264297eb8b84b0ec4689218b757417678c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 11.8MB
        • SHA256 d7e8475805bafcdaf0826675ca4dd3db819d2d717e9918d9ef2577a16a769248
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 11.8MB
        • SHA256 9d7e378acf5a67a6870692c2b92740f11b25f1663bddf14db3e60d17f2d6a881
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 11.8MB
        • SHA256 9478bcb6786e12b3304c5e621bb975c2913791621f42b4ab2486e12a38fb186c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 11.8MB
        • SHA256 5c1262b419ccb08fcfda36db44666d90c39dea7b5abd0a1fa912dc23f65b1d57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 11.8MB
        • SHA256 5c776f959d6e341605cc5ae76220319e29451e92a385162f26e4cc177b143ca7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.0MB
        • SHA256 6ad5cad8aab610ad8ece59e9b70b0e237210e212ef662667e105492ea7ddfcd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 11.9MB
        • SHA256 75b191a291191aaea2b568c8de235b4f1149f11e01d50b0a6dfdb1eeec15f3e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 11.8MB
        • SHA256 c441824e32b50eb5479ecc3b2d7535bac9161c99e370a4ef3c09c7279f6554e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 11.8MB
        • SHA256 836f9a18fc7ab7ea09bb0f2d3ad4bcf2802776a15de35097518a4f7a094b13bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 11.8MB
        • SHA256 0946142c7319f2df48308e297e3f4229e3e049d742b2a12740a98af5b42de928
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 11.7MB
        • SHA256 a980e76c461d0a1e4b7879d506e9531c6df97a82c2dd220cd32eb1f381ddf95d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.7MB
        • SHA256 aeab55b32ce073bc2771029fb954a0b41f44238f4ada611d4fb8590c6eb8bcb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.7MB
        • SHA256 3f05b9e987cc028308400e1963c079ba06acd76fdebf8664c12bdd83683cb19e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.7MB
        • SHA256 9cfe3e834e342e331c26b462eec3a7bcc28b74e62c8a77497b50c5321b46e11c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.7MB
        • SHA256 e03e53a4e8d6ce5e8bbd7ff587935f76680fdd56b28edfbee9ef7606ee3eb3f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.7MB
        • SHA256 f40fe6ba30c4e1a292c3308c5592fe9834b375cf4ef3540e1b82f3318429c8ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.7MB
        • SHA256 35cfdac09a42dbb3b39295d4075d43e3f07a7c1ea40608d5b9791d651f9d9500
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download