Overview

overview

7

Static

static

3

2026-07-18...ar.exe

windows10-2004-x64

7

2026-07-18...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/07/2026, 07:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_8f69d3fec5a3bbc94d7eb149c8ebe79f_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 2.0MB
  • Sample260718-hypc4sfs2v
  • SHA256 ba865f28a5a4981afae63beec2109cc2b2ddef3c59a00377d1801512f8f3a39d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_8f69d3fec5a3bbc94d7eb149c8ebe79f_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_8f69d3fec5a3bbc94d7eb149c8ebe79f_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3928
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:3984
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4448
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:1984

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 2.5MB
        • SHA256 1427a0e60cb338a6a4478807d8bf4ab3af2a4a16844247b520b666a78711d61d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 2.9MB
        • SHA256 e9ae62542c7023b026508abff9190434ff230515a2874bdb11e7d4de77cbdc24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 2.7MB
        • SHA256 9cc1296274f0e3383cfc2fe67c2898deda1b9fd42c8fba621c60a71a9b040af7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 2.0MB
        • SHA256 682fc8988701faeb9ecc2847be0cd4e6330c262548d2f24720e3a31356816751
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 8.0MB
        • SHA256 cf22158f3df813d26d12533f48a708f241870f61fb605bf1fd1ab5c6894df391
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 3.7MB
        • SHA256 8fdb86dc8adf387c3370ce36b48f93358a65bef8356f0305dd1b5dea08b1c5f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 5.4MB
        • SHA256 dc50f1dc5ee49cb26f28cf22a29dc4b890c2baaa4a6fac51dc797bc602735d22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 4.3MB
        • SHA256 1ca093a455f02c397bafc9e453c6bcb4021a2f354aab26cee44bb2119e76a936
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 3.6MB
        • SHA256 a121bdf27bdd9ec67f30d3194e7ba163c675975b25d43f4496c90ad2821f4127
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 3.8MB
        • SHA256 8012ea94fb36c6bc8781a5e316406c61653432ee819f84ebb2dfb4ab010ac5b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 5.1MB
        • SHA256 2d175e6c92ec6113f034db2c8581647e59257574bae42096f7dc5741dea1a211
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 3.4MB
        • SHA256 9a22f32e1bf7863f1fd3b0106e46e128f04fa57bf3cd50a5c0d804b2eaa55c30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 2.0MB
        • SHA256 401e2c2618f612850257aea8d2f2fda91d8a30ed4801e8190372da6bbd5ce70f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 2.0MB
        • SHA256 76e767f530c0a07bfe9cc4949918e88226ebb40732a42406e4f8ca722c3ee16e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 2.0MB
        • SHA256 8cfc0e03a687b49c94b412087b7ab659b1fdceb9822487cdc401be6033ee02ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 2.0MB
        • SHA256 6f6485d8acd2fbbef376c178c724fbea3608701c292335937d152f0fdac9e89a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 2.0MB
        • SHA256 cbc825fb546df959a58bc278707077ced130aedfdc7971426747d97a8744b97d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 2.0MB
        • SHA256 c70cb7a153ddfb1ae29f53f3238f637a5077e74b6e6d0b1d71b7de37434bfd2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 2.1MB
        • SHA256 cd2b774e6ca85dd41e3e5e804dba94d100e9a1f8ac470631d613088ab5ad12e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 2.0MB
        • SHA256 d8eee08961fbaf211f1fa707d926e873c14d7af1632522f98031cf6898a22c84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 2.0MB
        • SHA256 fb584fd2acf9bc3ce34e093cafc09cd14c93650cebfa050e88405981d81da163
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 2.0MB
        • SHA256 40e3d7bc5bd1ddd4c001a2fa18a992a31b4defcdc186b1cfa76f6d0cffd697eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 2.0MB
        • SHA256 ba865f28a5a4981afae63beec2109cc2b2ddef3c59a00377d1801512f8f3a39d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.0MB
        • SHA256 5ba26894275df20673426058c82271199aa201a9efae8ca05804585cccde0826
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.0MB
        • SHA256 999f80406b13190f0b6a8a7424209747bcf7bcae57052057fa495d5b7410f27d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.0MB
        • SHA256 5041f812c1cc60690349e7b1f6de2021c3d835ceb0d8fb3e00ce7f6e8393973c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.0MB
        • SHA256 b17e214b0c405224d394c390984be2de6fccc5494871828e9a9df838824c2973
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.0MB
        • SHA256 57a4577bbb7c41b8213d8c069e627568514f3347cae90355f0e9f5891cf84d5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.0MB
        • SHA256 f3317623065a05e6564eddb2a3d2480d27210a8d48deb7cee3fa436c21af330c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 2.0MB
        • SHA256 99c5305e3cffe194a728337eea692937cb241ea565225209b385dedf9d0b4ca9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download