Overview

overview

7

Static

static

3

2026-07-12...ar.exe

windows10-2004-x64

7

2026-07-12...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    112s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 08:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-12_8ebecd3e39a2847285a1107592876b62_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 9.3MB
  • Sample260712-kwvs8ae18j
  • SHA256 0d001a507731b9f950979446322740fccce915a6fd03c6c9015bf67315b13e59
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_8ebecd3e39a2847285a1107592876b62_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_8ebecd3e39a2847285a1107592876b62_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3136
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5104
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4724

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 10.2MB
        • SHA256 23e74b95395fbe7fcabf6d40d6206a8c1a98b9871c7e3d018c6f812b88bf0187
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 10.0MB
        • SHA256 45ba408958b712400647a94bc3ee3a4240d28da5a89e71d057c2b65692581268
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 9.3MB
        • SHA256 9184a54d1d81047df9a99f1c0974e882b03002fb9ec46273fb47a158547b0d12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 15.3MB
        • SHA256 ca74082a1312f57b3b30167a544650f8c5c432c561d354b4c4e23b564c7620d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 11.0MB
        • SHA256 b98cd85aac0fcbda21549f5a7ba3dca5ffc48a06709d3ce6cda7e728766e7743
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 12.7MB
        • SHA256 65f306204832f43e0d8e4eaf9916e2d1813f8078b7644b8b6331813c380a820a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 11.5MB
        • SHA256 28e37604b9e472393c9f3e260d369fbc11598938f409149e893c526a1f5158b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 10.9MB
        • SHA256 290102854fe620889308e454a78624a6706055d2f5fc2727051f41a91af8c639
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 11.1MB
        • SHA256 f74397406f47dfc15d5985a7cb1557ec85f03cb0d6e53e32fbce93c7617d38f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 12.3MB
        • SHA256 fb186a41fc768c6525291ce4c6642abd395842e455c49692d43aec4c4313e35d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 9.3MB
        • SHA256 74d5b6bf1d43fd408501f5a035f902914a252a27bb2bbd0a484057659af3e35f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 9.3MB
        • SHA256 84e01ae1c8449e26b9cf3996caabbd4cddbd5693cff8ca0c35c2a58009266354
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 9.3MB
        • SHA256 34394ab06619f6148f7b8670161057bd2fe17566e61f5f770dde63d677fafb48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 9.3MB
        • SHA256 85a933ac07f575c91e9a7c7f6e3b99e7ec8951fa336a4d2abc9e7324e20df4bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 9.3MB
        • SHA256 a810a4285730ac11c852cb60e7a65fbd968a714f41ce2085d5f935f2ed369600
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 9.3MB
        • SHA256 309c74fd4c17bd9591b9d08a8d48c25a1ce9fb5effb56a6d24e3bc9522e1afce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 9.3MB
        • SHA256 62c3e9d37b6f1f02a0188e0b343bdcc4aa1cd073dc6d42ed35f566b2c249eed7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 9.6MB
        • SHA256 467ec9f9bd0c9233b3bec4753e43b8ed6e7957d5e5e3b7c06420126efbbac1f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 9.4MB
        • SHA256 c415c979bf7195812347df69988785f4e417cec75dfbfd7b5071f5c019492205
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 9.3MB
        • SHA256 5b7b615692862ff73fc07522df830aa81933a2fb7d1c5c7fadd91ff090f2bf80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 9.3MB
        • SHA256 f0a2f515650bb094199b4a9e21070beaa38059f0656a8f0aae38075357612e09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 9.3MB
        • SHA256 d356876b90484ea14ee9d03df6c39d9e04fcbda4653823b1d117f2a3a7c88d40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 9.3MB
        • SHA256 0d001a507731b9f950979446322740fccce915a6fd03c6c9015bf67315b13e59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.3MB
        • SHA256 ee0ecbaa672be182f56fdfbe3e5c2fdaa5523ada17278853344bef6eef4dd2b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.3MB
        • SHA256 4ee1f873dac9e72b367e232cdcae2965b79690853d2500c31763e80c0f9852ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.3MB
        • SHA256 6bb5a035251a7e46dd6e4243fb26bc87850df49894f84fa613e5c72593d9dbdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.3MB
        • SHA256 ac320efe9d1ade103da5f1d4964833d201bd59d2400d67f0ee41bddd51412746
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.3MB
        • SHA256 7ff34e7251a6f4d5fe19a8dc1ffa09fbd380eddacee9626e221f6948169f3658
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.3MB
        • SHA256 cca32c91615369583c3ef79c8e74b766e59e6b9cc357381f1d0e7949f3b841e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.3MB
        • SHA256 7a7ff5bfaf1328e12e50046eb836a6d7cdc84014975b40d072128d43d5391b10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.3MB
        • SHA256 1e96307d55595511b10a781541ca6146539496df86c17a4310e9fc251b3c07d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download