Overview

overview

7

Static

static

3

2026-07-12...te.exe

windows10-2004-x64

7

2026-07-12...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 09:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-12_771d2b2489d7df5de041b7c5be77b8d9_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 7.5MB
  • Sample260712-k6ymvsft6n
  • SHA256 7e3620054b530d3e84f68218c716e4c70d6e61252f61796bde044f92f2646563
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_771d2b2489d7df5de041b7c5be77b8d9_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_771d2b2489d7df5de041b7c5be77b8d9_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5616
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4644
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4592

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 8.1MB
        • SHA256 cdb0c80fc3804a3022ca3c7c4aba738a96036d9978cd0fc1b7d7596f977a2bfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.5MB
        • SHA256 203119e0435d5fc0cb8f94ad220357197e46d715ee90b6617a1384aa8930b8ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.2MB
        • SHA256 6e694f5611018c454937802770b5a7c6c88b15ecc81a91385ee042f8acb11335
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.6MB
        • SHA256 0310f0e125d42bac1d38ce4c7a802b2ff2d97140eefa4df70965b80fbe6d2719
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 13.6MB
        • SHA256 146d5cd795c6d2bc3ea8a6d4cd05558fdb5188f704dcfa832d766d0c604da2e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 9.3MB
        • SHA256 27e5b58a9d902fa283c615e17b301611a7cf5fb461469226f2cf0c44c367fb6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 11.0MB
        • SHA256 37f5c2b32c9b4340db1b4093b42bf33e7b9943c531999202dd2663023a29c217
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 9.8MB
        • SHA256 9cadba37fc5cb29d3268f8a9e2df9bd6814f25163ae745f78589855455873890
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 9.2MB
        • SHA256 e4701b28ce1a84f9bc40883babc894de5fa55f77acb3dcaed11e51f143b3477e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 9.4MB
        • SHA256 baf11f7f91f6bc210b5fa54c1993d9374e6c6361d64dec9fe88c4039f8dddadc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 10.6MB
        • SHA256 cc3552489d33dc1e73733b0e37f6929e5f10a42c10d4d83d7d4e681e71f58926
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 9.0MB
        • SHA256 d4572a649a30e785f975119990653e9e02891962dd99171d245d9dac7ab5e065
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 7.6MB
        • SHA256 918c3eeb3704c6f9b69663ef0366077100d3ee17d0a07bd3cc2ee370ea8ed128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 7.6MB
        • SHA256 46a8aed89c8699cecd5dbcb41d09c968a40f4c6249cbd4a800b7330eaa29ff0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 7.6MB
        • SHA256 5de11ae29c5243ee1e6cb48048136a108d3dddc56f4f1052e5276eeee050802e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 7.6MB
        • SHA256 6c465fec267a579897181631894f9120c9b14d63b0086565bf72768622cd75cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 7.6MB
        • SHA256 265f3745f5d983e8e1b9dd116535eb78fd3b851e8917f7194fe6b1d37af07002
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 7.6MB
        • SHA256 ac65b5bfa1865d11e9723098bfa7e8e25be3464e47a469afa570e6e086513c2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 7.8MB
        • SHA256 55e9b8e10aab91080f230ec22cf6a9ea5c665b756c3d99b847c1191ae4b51624
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 7.7MB
        • SHA256 93dce88f7c66d0f31c72420e062d3b1372849fe92f517b1c17240b5323a3af5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 7.6MB
        • SHA256 6f9f5fdcdc5b383dd121f6c4368839fcb60c9f5f7b0676a80ff7e163af5ad446
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 7.6MB
        • SHA256 bca945dd984963199c313e7e902e2f669c82a3de16d0f6a491dcfc7e071d94d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 7.6MB
        • SHA256 cb22519ff5df02402d4b59300ffee667fc95a691e708fcabaee6083a3b85dc4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 7.5MB
        • SHA256 7e3620054b530d3e84f68218c716e4c70d6e61252f61796bde044f92f2646563
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.5MB
        • SHA256 3c542a2cad0ff600bb84a04c460316a613ede272241a540b7b97f52547ae57bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.5MB
        • SHA256 7906fc1e5d4e7bd9e4618337670f63e51e6c6b137d19c2592917cb88d7201066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.5MB
        • SHA256 38bd8468d5f4ad1035368b7ca10a7f19281c5ad2a28f96c02b32dea8e6b8e001
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.5MB
        • SHA256 5bec6eb72bba294afcb049859f8aa31eb12babd23e83cbe58bada33c4e662907
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.5MB
        • SHA256 40fe5f3cbb02c8db6310a212f8664d7eaebfba5f34cebaa7419d0b2772bece1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.5MB
        • SHA256 3e4c7693401c3b357e4c178a71a5dd556c50b1580316a5177a19bbf57be60efd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.5MB
        • SHA256 a98e114c2676f04e0e0ced73a70eb222b3649c647ac5034010d3b05b03d1c184
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.5MB
        • SHA256 135a314dab254d359af70c509af3dd59afd786136628cc021cd7426350f3d51e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.5MB
        • SHA256 1ab4cbe62ad724c77ac4965c1cdc31f070f6d5fd6555672c3115da334ce312f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download