Overview

overview

7

Static

static

3

2026-07-21...ar.exe

windows10-2004-x64

7

2026-07-21...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/07/2026, 03:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-21_9b3d1cc84803bd34551be4e5080797fc_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 8.0MB
  • Sample260721-ejwxvset3k
  • SHA256 7e871176181a7991140d1993f98a4e983585b7ffbd9aa364b25720a77b4ce307
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-21_9b3d1cc84803bd34551be4e5080797fc_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-21_9b3d1cc84803bd34551be4e5080797fc_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4296
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:3428
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3276
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:3288

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 9.0MB
        • SHA256 479df965200028e7a71943835234cfdfa52d99309134dbb59f4e1e97e9a55353
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.7MB
        • SHA256 51af5204ccc2387918a2b7a049a5bb660d52fbcba6166e6d176d7d41d12f4088
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.0MB
        • SHA256 b8f96f4dab3ce86a8a66076c06fe3b023b059b54b45d373032a6a1db0b15dbde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 14.1MB
        • SHA256 c80cc2e130f7bbd7077f5411126995953b40d185bba7f9ab3138454671140eba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 9.7MB
        • SHA256 0a490175519460240af5ecc354f3e1f72e3219cb7bd3260804ff2e26c2d48d75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 11.5MB
        • SHA256 e3c6f1116e47dbba7d123725b65026c218fe5eafd7f0231a0140bbc1ca457205
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 10.3MB
        • SHA256 1ac27e7602682829799cf5098ba9caf09287cf72257663c69cf848a2b3b1400e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 9.7MB
        • SHA256 1956f313d57bcd47faeea944a08d5309f3d8d0403d3c4bbaf673b95e1f1a3b25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 9.9MB
        • SHA256 7c92b813ce13e3167d16ff9a4a915ecccce538cdcdef3c701f2d2c3fe609f13a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 11.1MB
        • SHA256 c8abf180c4241bfeda66140cc3f5d7359bfaecbab40c6031dfefb2fdc4d986e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 8.0MB
        • SHA256 350c4e7bc9c7f99902c60379976a8093c066c5acfac5f08d9d7c80faf5b792d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 8.0MB
        • SHA256 b6ea282ab0184c29b45c3cff4dabf13ccefbb3282b19295afb1372dccd484046
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 8.0MB
        • SHA256 c88ca441de04a55756fb7d4d515386e92d613e03bf4d014a0749d2d23e8e7e22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 8.1MB
        • SHA256 756b17aaaf07b3301957d3de2f6319a62ab089529d2a0b93de4109dfbdbdbbfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 8.0MB
        • SHA256 c559c924a6e42313388b7a27f2b44ca511b09f9f62780e3d8c1f8c1ce0a91733
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 8.0MB
        • SHA256 12be006cf37e403c3495d128c6114b65f81c01a373ddae9b5b362c92aa01013a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 8.0MB
        • SHA256 09061556c9558ec41018ef84920d60f1cc6db2cd6b1ab2c721c6ab27621cc01c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 8.3MB
        • SHA256 59e6c8bbeb4762a6a754121bfc9f29bdf3fa3aadab2d4ae726797075bcbc726c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 8.0MB
        • SHA256 e5d9b4e57b21769da268d57f39d4c47c1f5d874b10bba665f5f1c9de2640ad79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 8.0MB
        • SHA256 84e73877d32371e2869a0e03dc9c7298a07b191f334e2004ce7ec544e30b0ac5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.2MB
        • SHA256 022227d22bdb339334ede983b662a3bc9c677abafd10a1035401da91da3501ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 8.1MB
        • SHA256 538e2b600e8bf212220946a5470bdb2814a2c0cb3687e41700dae2d9e1bd4aa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 8.0MB
        • SHA256 7e871176181a7991140d1993f98a4e983585b7ffbd9aa364b25720a77b4ce307
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 feab75cb348caf45aa1fa6fe5277343d78190e22917fc1eec0cb7032a14a37fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 8dd4d31b32ec5e4b5c227fd5eddb8bb23e92cda8636c3a305fbe05aea427a674
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 c6d2c81ddc6c7208b72fe26f1ad017c712236f4b57e30e007663ead509a660d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 4cb2942852f9812633bb972d486d4ebec65aec93970c1ca226bffc5b9a1a4f05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 e0c017b243d22d37c3e86fcf4c9679556db298f46a0ef6b0d29450e14af6c684
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 7a4f816bcd2dfd4214e2476ec2be84d53a4d24802aa263e6a42e734c6920c329
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 cf9baac660d0f95b57f90f3b9cf9c070e0d67796e6044909a3296cae1f536a77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download