Overview

overview

7

Static

static

3

2026-07-18...te.exe

windows10-2004-x64

7

2026-07-18...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 08:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_286b6cdb1e3800e4839e58a0d676b1fa_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 13.0MB
  • Sample260718-kflwdahs4y
  • SHA256 28e0a7948cb0500ec201b811f8efe620179695f24f04f42724b83e31e7939d46
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_286b6cdb1e3800e4839e58a0d676b1fa_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_286b6cdb1e3800e4839e58a0d676b1fa_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:964
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:4796
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3380
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:2176

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 13.9MB
        • SHA256 c088ba4b6acb0e13027be236a19752fa67a2aa456029d59e35ed20a039af509b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 13.6MB
        • SHA256 1891d9a387d6719a156796efd53a653a23c623b3f23b095561a69c852a0b6715
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 13.0MB
        • SHA256 034bff471f2d697aedd57e93b349d58b3e34d4bed2b96e68ac1b08165a0e5031
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 19.0MB
        • SHA256 7bfaf076ac40cc6f56580f97834c90777cba10ca8fee3827172edb22ae226190
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 14.7MB
        • SHA256 14b6553aa21c51716f984ac55e452a583615a397f845844936b848a9a9ee47f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 16.4MB
        • SHA256 fd925bf1d618fc8dea38418a9523f27432128ec9d7da370d3b9642d802bcc047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 15.2MB
        • SHA256 b3778c4a83ce4d3c5a65aadcbd3d39717267a48d4b1620d3a26c2e90dc175feb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 14.6MB
        • SHA256 cfdee3be2297f78081b15b8376fe1038d3ca0b6bdb30a3e1e3d623cd56971995
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 14.8MB
        • SHA256 fc7f8db15353191c061c683805725231ba43e218b9b145b6514d142c298352a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 16.0MB
        • SHA256 669871c9337262890911b86e2b02856a36ef6eafd000bb181587151dcd21ff8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 14.4MB
        • SHA256 11c1155fc390e2cfc7f629162bb631ccde53b7e810ad909445f8f13dd1cd5e1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 13.0MB
        • SHA256 853386d236b9debe53a837208d8ca4dc67536f2e00b6136b943170505adb4458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 13.0MB
        • SHA256 9f3dfbfd58edbce0848e05fa5f20cef08fbe1db1e7083f7b160802add50ce88a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 13.0MB
        • SHA256 7c81062f4ea01859d253c0f321def24408d47bab623a36ef520cfd4e588d5033
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 13.0MB
        • SHA256 87cda61f87e975c7daa66561451ff93e86f377da7a4f691ec5ce73973bd0778a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 13.0MB
        • SHA256 9621fdeb89bb97b52c7507456178737125865e319906696df2e3d3967af2a42a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 13.0MB
        • SHA256 17d4c9b1aea20c81e1925f13896d1da7fbb42fee6bb3b899830f324afe96cacc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 13.0MB
        • SHA256 0a894624c55f23b7c9ea37b975271ade859bfc2c8f428103754aa3423f99f973
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 13.2MB
        • SHA256 571cd2e2c4ce5b2f4ad2c472fe50630edabc8c7d550552417c5f12acc331d7d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 13.0MB
        • SHA256 07dd02d75c1f6522183c78e8443017dbf8ca5ff64b2f4b5d98d198202dc22d71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 13.1MB
        • SHA256 2686d93fe8360c212dd874f680e90be6cc09683e620df68a7d3a213088c4f1f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 13.0MB
        • SHA256 d7b307708da3c4d130f993688624d2bde7b5d0815e3cc91b0904634f589ca045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 13.0MB
        • SHA256 28e0a7948cb0500ec201b811f8efe620179695f24f04f42724b83e31e7939d46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 13.0MB
        • SHA256 fb602b553d784418e10d500fee7b5ef4338f736a9a432025d152ac1caa298b35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 13.0MB
        • SHA256 78629e85618413067b600949df641435819e8f5c572dfd5aa7749c775a68b752
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 13.0MB
        • SHA256 7b3f57ece9838039dc0315444c5ee1db4f969e72a5c69e3a514acfa1f2d68371
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 13.0MB
        • SHA256 05839c5d1f6461b16707e246645a05c2934a4bbeb969897f0f08ff051cb8f6ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 13.0MB
        • SHA256 1be67e0d106a3ae895d97701e4dd6c61d2252223579aa45862d33b5699107ff3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 13.0MB
        • SHA256 c54575051c9f594f4ac8d74bd325feda9df00d7065a71c91c6b4ebfd0a69d22c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 13.0MB
        • SHA256 5c0fa580986094fe345bdc7800f130a8acdc8950b6c710560ab524c4a8702713
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 13.0MB
        • SHA256 288fc3416cc51d62553a8355704d6e8753a6aed58342a5bf7a171917eb694b95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download