Overview

overview

7

Static

static

3

2026-07-11...te.exe

windows10-2004-x64

7

2026-07-11...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/07/2026, 15:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-11_dfcb1b9f30ed7ca5dd03750b0a71d434_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 6.1MB
  • Sample260711-sdmc5ads5n
  • SHA256 bc053e20c8f7399cea67fcbfba45c76f786cdc1b4bb5ecaef4a60482408c62d7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_dfcb1b9f30ed7ca5dd03750b0a71d434_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-11_dfcb1b9f30ed7ca5dd03750b0a71d434_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5096
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4900
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5960
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1476

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 6.6MB
        • SHA256 e46ee04707dfb786b432318afcd4684aa8a6ca7d9001b3d0bb6dd15d85d3be3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.0MB
        • SHA256 b3d659de664326794e4635d47a24958980647739962283ca8cc54d740ae28a8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.7MB
        • SHA256 79ed5c6ca9236dd3753303cb0cfecfdbc1c846107374b16049f85cd98b19ca0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.1MB
        • SHA256 351340fed08554c2d7de9133ba9759426ac212cd0adde5edf7ef5337980dc04c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 12.1MB
        • SHA256 ac60e84a3920070dd8467d8a3067673b92bfeb659c795134f3c1cfdab6fb0ec2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 7.8MB
        • SHA256 908d1d4eb8b55e423cb4c2ae7d793d6ef02d2f3821ec34e468c12fdd75ad5b96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 8.3MB
        • SHA256 1b7d904839d378f941cdda42ed9f35400367ecb11d39ee86cb807daec66ced97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 7.7MB
        • SHA256 0b1f19ddbbf24b37242b9f070300b74a7dd247d24249c4fa224326847a188737
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 7.9MB
        • SHA256 8df6cc121e4a4129ef31c5066d3e3543a76eb4398d65f6047fdcb4769cf5a485
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 7.5MB
        • SHA256 b03c4eab6d3125111312ccd21c821f2ccdb29b802fe4cc97247352e595873d49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.1MB
        • SHA256 b929c373dba9b311554900d90f676bd731cbdd6ef78cbdc13dc9b4786baf2416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 6.1MB
        • SHA256 b15b6a735963cc87b31b2c79957c0b53f4a5f464e0795441b3d5a728d80e688e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 6.1MB
        • SHA256 e4e14649ed2548c1371737e84477124238f2ff0f48749277454167d03ea5ab4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.1MB
        • SHA256 a56ba51aad7d094a73b499c22b29b14c6f21f6f81d2b647439822e2106a02e05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 6.1MB
        • SHA256 232b031203ddb1e5e76c44fa5b28f7ce02ce739dc5688612f09512e677cfda4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 6.1MB
        • SHA256 f1547dfcb5408b7bec5fffc3b3cafd73de2f5b466b157031adc9dbe61c627985
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 6.1MB
        • SHA256 bb626cb92093d3872a0ad121c00d9557484c74e6ea24f4767de0df560b08e866
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 6.2MB
        • SHA256 e7d7b36ecce7b249e3a061e54f70d73a6ce0c95d9e0d3e2d93948fdf218a10b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.1MB
        • SHA256 c9e346d3431f204c509868743925c7ab6cd99f6c5751f6d0f5287fcd1e0e85a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 6.1MB
        • SHA256 0bf7340b755a43e60c529b0648c3e890ef55642ffcfe4a84e610903fbffa0576
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 6.1MB
        • SHA256 172dd99513e862bef00c1efc070cd1b25571e967e45dc9f0427af11e2df740b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 6.1MB
        • SHA256 bc053e20c8f7399cea67fcbfba45c76f786cdc1b4bb5ecaef4a60482408c62d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 e72e098b8f9509e99c7eca78119e49f11503c50d6ac0b68e7e4451e1bdf99de0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 b293f56ab9f1bfa735ff7ef4de68dab3a49cbc170a1426df9313e4b2748d98bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 f5ff993f4bb74c16bc429ef3d1d24dbd9bd956aaf2a89cd77ebac3af18926518
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 b944984709c58eb0863b9753058a12c5783b8c0f6f3fb43646d82a153e91bb55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 537ddaf57d34a0bf7b34760e77ff856a08fbfa87d9a9455fcd0c7c9d27417969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 d084c151a70c5f5f3026f1ec0820d5c8b4b3113685be300a9bfc76f45b5ffd1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 e19aa870df6596cf29f3ca93fee6b6d5e2491cbf75aaea8bae1cd49028688c9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 6ef0f205b6f79c225ebd5004f3129fbd87dd25a7f5752114034833829b43e8a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 39a2f7ce1a6534d10f52d2172c91813a85dedfb1d12eb91d997f389f64404649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download