Overview

overview

7

Static

static

3

2026-07-20...ar.exe

windows10-2004-x64

7

2026-07-20...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 17:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_4c22226373c1b394225d840143380081_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
  • Size 4.0MB
  • Sample260720-wc2m7sas2m
  • SHA256 8a4122ec6f60b30f02fc61026bbb002ebd473456e40a5e7d42d74bfdfb5d39d6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_4c22226373c1b394225d840143380081_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_4c22226373c1b394225d840143380081_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:5024
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4228
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:5916

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 4.5MB
        • SHA256 11b0420970e8b522caa17ae574b90b626031c84d72b5fe03433454ea03b4febc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 4.9MB
        • SHA256 2fce2c6efdcfc6e664ca5795b9ce11d21ece697ce4d91b4fbc7052879d305c99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 4.7MB
        • SHA256 7f3272fb9c35e7ba3ec1646730489fd0a9b3004a691c4736791f898a039183a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 4.0MB
        • SHA256 ba51fe4962417dc80f2bc76cd20852dde3fb5d2122b7b480892e9a78333d3c49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 10.1MB
        • SHA256 4aead49dc88589c3270a9723c6173891099deb7a6fe48bbb0e47bdc8c0600e93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 5.7MB
        • SHA256 72ac1d69038a6d88b3e09fa39d5bfd0296f6e11f4a2236363e84e18cad0aeca5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 7.5MB
        • SHA256 080af33f712f362763f33b5b2f66c2d7f0d10eae95a2ad156045a79f06105792
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 6.3MB
        • SHA256 c1101993d09b34c9a9d23a1a9d3035a2eb5e2527c16e8b1607c90cadbfd34ba7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 5.6MB
        • SHA256 e90526603919e8e3f331df5df4463d1ab2e6cc4fc8f6c74c04eb47f99041f8c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 7.1MB
        • SHA256 3ef7f1d9d79577ef1da72299d5d8340a6fd5975b969ad43a8ab58cf88c04abe0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 5.4MB
        • SHA256 49000f408fe4063cc92b05b0a7e8e44b50375729107f72a76deb043e7409c22c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 4.0MB
        • SHA256 1c3611a549795f20f47de38857619fc312bee76e95617167f5c9be76f92d90b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 4.0MB
        • SHA256 436dc5b65f631be1e0e045fdb9776769e91030b9f2213d4823c39ddcadca315b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 4.0MB
        • SHA256 c1035588273d00a99f4d0575615c9d0023b3c2b1527ea31952e4c3dc32e42ddd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 4.0MB
        • SHA256 d282548eac11bc133b8a28bcec9010e7a90e1e0afff5fe6b26dc8e1fd3a6b0f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 4.0MB
        • SHA256 756a89dc8e4f006555580ab1dc315d8a731971dc1395af4994e4ab3b15bc24b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 4.0MB
        • SHA256 1e117dee645c2fb0fbff4075037449b93c0eec2d3029c0d3577e8f029a9136fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 4.0MB
        • SHA256 1f0881a0e148c4ac9f861b4f3a285d04cbc11128475164269549d5a83b543690
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 4.3MB
        • SHA256 565b0ead764db9abccf11b77f44361c9a68285f83a7b03a85bdbe809f4af8c5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 4.1MB
        • SHA256 b03f00921b29c551519f7a4266dcb529e06470e11121a2f5345405f7819fd6a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 4.1MB
        • SHA256 242641f852b577b630f95122d0ab4e96b371d65154095ed097d8a4e9e5cb4580
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 4.1MB
        • SHA256 b4f936f61a74158d9719daf187192c437203c091015b6c415c8aa909af7dee25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 4.0MB
        • SHA256 8a4122ec6f60b30f02fc61026bbb002ebd473456e40a5e7d42d74bfdfb5d39d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.0MB
        • SHA256 dc5d13e1bb7ab8366df8143ae8988769557d208cb0ed3828b0fc39d7e6803ce3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.0MB
        • SHA256 564ec29d683fe28a664c23692ca7f7b561fa7b03bb4561cb6a6160040167e342
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.0MB
        • SHA256 2e975ef8cc656b983419fa14d2ae88fd5f28cf0b8daf05e04c7d8c0606df3bcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.0MB
        • SHA256 bde5ea5ac7cc62678cf2eb1a2d52d006422c9e1061d9a4711ffb8d7f4cc9bf90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.0MB
        • SHA256 6f686785c43cb76126d049c12867bb127cb720af8754dfb20a230146322f926a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.0MB
        • SHA256 8b403d4a09c5d041627a4ec715cf8179525c804f23aece4d3c3031ab08ada1ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.0MB
        • SHA256 780c629069a24657e43cb7eb9f72ba1941db04c373fdc3c1cefdb97509c765d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.0MB
        • SHA256 3675e81ec98616b5ba9a2939c1dcd40634884ed6ce22f15155b85a1072ce9b6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download