Overview

overview

7

Static

static

3

2026-07-11...te.exe

windows10-2004-x64

7

2026-07-11...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/07/2026, 15:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-11_dfcb1b9f30ed7ca5dd03750b0a71d434_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 6.1MB
  • Sample260711-sdmc5ads5n
  • SHA256 bc053e20c8f7399cea67fcbfba45c76f786cdc1b4bb5ecaef4a60482408c62d7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_dfcb1b9f30ed7ca5dd03750b0a71d434_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-11_dfcb1b9f30ed7ca5dd03750b0a71d434_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4124
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4860
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3436
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3940

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.0MB
        • SHA256 b3d659de664326794e4635d47a24958980647739962283ca8cc54d740ae28a8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.7MB
        • SHA256 79ed5c6ca9236dd3753303cb0cfecfdbc1c846107374b16049f85cd98b19ca0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.1MB
        • SHA256 351340fed08554c2d7de9133ba9759426ac212cd0adde5edf7ef5337980dc04c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 12.1MB
        • SHA256 ac60e84a3920070dd8467d8a3067673b92bfeb659c795134f3c1cfdab6fb0ec2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 7.8MB
        • SHA256 908d1d4eb8b55e423cb4c2ae7d793d6ef02d2f3821ec34e468c12fdd75ad5b96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 9.5MB
        • SHA256 be9888f4ec1750f5411610f4d55fbe12fc97383c8c1b832667cf7aef3d4b8384
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 7.7MB
        • SHA256 0b1f19ddbbf24b37242b9f070300b74a7dd247d24249c4fa224326847a188737
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 7.9MB
        • SHA256 8df6cc121e4a4129ef31c5066d3e3543a76eb4398d65f6047fdcb4769cf5a485
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 9.1MB
        • SHA256 b8377e539e201e2e89df5a7350b54d03ec2ceffc5eefacb1917606f20fbd17e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.1MB
        • SHA256 b929c373dba9b311554900d90f676bd731cbdd6ef78cbdc13dc9b4786baf2416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 6.1MB
        • SHA256 b15b6a735963cc87b31b2c79957c0b53f4a5f464e0795441b3d5a728d80e688e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 6.1MB
        • SHA256 e4e14649ed2548c1371737e84477124238f2ff0f48749277454167d03ea5ab4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.1MB
        • SHA256 a56ba51aad7d094a73b499c22b29b14c6f21f6f81d2b647439822e2106a02e05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 6.1MB
        • SHA256 232b031203ddb1e5e76c44fa5b28f7ce02ce739dc5688612f09512e677cfda4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 6.1MB
        • SHA256 f1547dfcb5408b7bec5fffc3b3cafd73de2f5b466b157031adc9dbe61c627985
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 6.1MB
        • SHA256 bb626cb92093d3872a0ad121c00d9557484c74e6ea24f4767de0df560b08e866
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 6.3MB
        • SHA256 26f6e0e90c817223aa6a02d7db65a88ad62f440ec36c5b8b9325b6db9fc14f2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 6.2MB
        • SHA256 31291df6d14d3c1697cc5fab95030cde2df87505e941865f32a6ca7a5123f2d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.1MB
        • SHA256 c9e346d3431f204c509868743925c7ab6cd99f6c5751f6d0f5287fcd1e0e85a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 6.1MB
        • SHA256 172dd99513e862bef00c1efc070cd1b25571e967e45dc9f0427af11e2df740b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 6.1MB
        • SHA256 bc053e20c8f7399cea67fcbfba45c76f786cdc1b4bb5ecaef4a60482408c62d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 e72e098b8f9509e99c7eca78119e49f11503c50d6ac0b68e7e4451e1bdf99de0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 f5ff993f4bb74c16bc429ef3d1d24dbd9bd956aaf2a89cd77ebac3af18926518
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 b944984709c58eb0863b9753058a12c5783b8c0f6f3fb43646d82a153e91bb55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 20f93c301f753c5a2c9d416cad2711e03003954f96fcf166ab403fc448b5e2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 e19aa870df6596cf29f3ca93fee6b6d5e2491cbf75aaea8bae1cd49028688c9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 6ef0f205b6f79c225ebd5004f3129fbd87dd25a7f5752114034833829b43e8a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 39a2f7ce1a6534d10f52d2172c91813a85dedfb1d12eb91d997f389f64404649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~8
        • Path \??\c:\ntldr~8
        • Size 6.1MB
        • SHA256 99855a64d3e86d58b95147453a7bb1ea988bd5ef44a7a940453a5566ccbdf20b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download