Overview

overview

7

Static

static

3

2026-07-19...ar.exe

windows10-2004-x64

7

2026-07-19...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/07/2026, 00:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-19_b3497b68b9fd4f808d97c0f176a58fb4_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 1.5MB
  • Sample260720-a38csacz7x
  • SHA256 d39cac5fbb3c751f422b2bbc46445e2bf9617404260cac1e92a151813b66daff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_b3497b68b9fd4f808d97c0f176a58fb4_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-19_b3497b68b9fd4f808d97c0f176a58fb4_cloudeye_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1376
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:3864
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4720
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:4756

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 2.1MB
        • SHA256 d601eed33f53a27aeef342dd6baae1f301d1c11c7bbfd608932e65728b8812a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 2.5MB
        • SHA256 7f40c109a4fc8edcd61eddd2690fef85afc1e19244a5831a559ee2e927d95969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 2.2MB
        • SHA256 d7cc8d6075c90ace5726d6b59e02ed8656f0cfdf4efb8b63f480a49dcc2288b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 1.5MB
        • SHA256 036a68eacb03a395a4cdb9665de7d18e7142211c1ee442ec564ff636ca0f0252
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 7.6MB
        • SHA256 994f556c32c3ba4e8e072bc448ccf003b4a52bf7a43dc023ad2180150c7de966
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 3.2MB
        • SHA256 eadee351cb92f94672278bf81da597b49543f4d432007a1178f0bb0974869142
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 5.0MB
        • SHA256 aff7d612dea2a29fb8b0a8bfebd72e9802435ab0d3a4a9545f29df3ec8d873a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.8MB
        • SHA256 a06e1719162258da5ffb0d66edd55d3c122693741555a4987d2fcaf3a581e0ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 3.2MB
        • SHA256 ea532e6b1fb6333f0980e9f04b1a972ff1c2531061f76a9bc8c747686930e351
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 3.4MB
        • SHA256 3218ce7722d0e9e5323f00224a6077843332079b0fc2240c326d2a2c9ea9cffc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 4.6MB
        • SHA256 465df15a459e86e7784afd0bfc21625f127a5b99d7a48db9f4f1f367158c9856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 2.9MB
        • SHA256 b9783cdd177bc65e22073e027ef4ed8a5cad4ebdf9153a9e7f11e09810e2d246
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 1.5MB
        • SHA256 c35b52cb2b9e6761675419224827fc128981483784f007e85aeeb035d5cfd28a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 1.5MB
        • SHA256 4692c23772f722b08df8a14b2ae5cb6aa3c283e7b16eb1b9e4012104abfcb50c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 1.5MB
        • SHA256 19c426bcf066cad6ad28952c7c542556dc76fc90b19fe40cfd8f8075cf267688
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 1.6MB
        • SHA256 49891abec1443d8afd0d15e6e24720f690058072c9c301a575313705942f9213
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 1.5MB
        • SHA256 ff9a6298ad75cb1bef8de1765851c1a952f6fe2fa1794b5622f154486179dd4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 1.5MB
        • SHA256 250b29d0a63c630a122039245f89f07b147a3ef85cb52e4d49aeb569d5a9b1db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 1.7MB
        • SHA256 94120fbc605e2a375f068caaeb881460123be690c553a7897f5581e67c846271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 1.6MB
        • SHA256 23fd7ed0147c4eb20ced9873179a51f651bc1ae9329804761f4e7b84178c930f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 1.6MB
        • SHA256 dc05efcb761c0ee453e51eed5fd8a6fef91ba81d6183e4e4e841051039aaa218
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 1.6MB
        • SHA256 8a8e9629d0d82869ee9cb38132a8dfaa7dd39904d8c99d2d1c0e08ef5faf22d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 1.5MB
        • SHA256 d39cac5fbb3c751f422b2bbc46445e2bf9617404260cac1e92a151813b66daff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.5MB
        • SHA256 59d039018091d8c17293d90544386259917d7cd553c672faf096aeeeab9ad0bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.5MB
        • SHA256 129955cb8797d1635f31a153e13163c1f98d2c70bc4e796a2e7d46eeef1f3cca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.5MB
        • SHA256 1ed2ebcb72a5b9da0339ff6939bd4a985ea5f791f75f4b6736d90839336dba3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.5MB
        • SHA256 af800641b6ad18d285ced3b6d0cf4034fc5fa5280d2dcd51c50c13d0c5659bad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.5MB
        • SHA256 23e96461e4df555e54dbf628adf7e2a899d920fef473abc87f32372c65dc493c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.5MB
        • SHA256 aa8d524700a0a943a3377aa127f67ca3481f8753396ce4f5e0f5187c548d62a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.5MB
        • SHA256 fc95d35055f313a405d984acca2b37d9bc5248f98048a8e1da8ec61d3b3242e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.5MB
        • SHA256 ff535cfa0e300e63d0d4ab41f00ec6717087589e1b370ae9acc39151f13a7fb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.5MB
        • SHA256 444bbb5a0eb4c2cccc465fad0bcecea98ed59a22b2daf0b50aca7a6468e93398
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1376-219-0x0000000076B20000-0x0000000076BDF000-memory.dmp
        Download