Overview

overview

7

Static

static

3

2026-07-23...ra.exe

windows10-2004-x64

7

2026-07-23...ra.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/07/2026, 03:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-23_14aade8697a88da5bc100c9faed5128d_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
  • Size 10.6MB
  • Sample260723-ecbcksfh89
  • SHA256 b1e7f4a9c32bd233de7604e9149e49965254c715e3a5749b91e6253b4748b6a1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-23_14aade8697a88da5bc100c9faed5128d_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-23_14aade8697a88da5bc100c9faed5128d_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:904
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:1196
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4292
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:3860

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 11.6MB
        • SHA256 55d7614eb3cbe6e3e4d713a54cc4f62979f886d3bf2bce5f3a17f2ae837aae51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 11.3MB
        • SHA256 c87f53d4428434deaa302be57270f0204363be7c8d671bad9c20df3d017bf51b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 10.7MB
        • SHA256 011a1f2bba6db870fd02a44852311ba194e86d3bd6ebd4c572613f8c3c39fa2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 16.7MB
        • SHA256 bb7c26044d8681144b3db5b649999e839ede70a9c0942db5ca2486cae0dacc54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 12.4MB
        • SHA256 461b4d10eeb7ff6a40e3e4f028f50ea4305befdbfef7ede80099fb08d96c1312
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 12.9MB
        • SHA256 c32429d942b4e88ab6baa0921112f9ad29ccd7f8f92f925b9f09f0a86567f291
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 12.3MB
        • SHA256 e754b7743457a70d198695ea75ab652d5988438b6fdc0b94ec858efac5f6c2a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 12.5MB
        • SHA256 e61e62069a9c5ca0e08121cf9a1effee784827f22b3f0a08ed19567e642314c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 13.7MB
        • SHA256 0007d41c9662e913305a38fbd94b6e56bf469c885545e705b65562b65eef3f3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 12.1MB
        • SHA256 f48a52a15885749b7dc00af657f5152afc13682aae15821049682e1dfaa4846e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 10.7MB
        • SHA256 f19780c382d8ec257496f2b81290e6e9ecfd8c5b606404f9e6efab570291094f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 10.7MB
        • SHA256 a9f7dd06e1b792064ea17b9642f8d4fdd6b8d64212042da62aec18901d059293
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 10.7MB
        • SHA256 d7d621b2ec28a57a98ab4a7f29a01a503698db1389a0ba75f70535548bc94151
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 10.7MB
        • SHA256 2e08e2e2e9733cdd02f923a787d7dc353b27cac9703c2be39d0b923b514409a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 10.7MB
        • SHA256 3fa56bbdb02071fd99881e132fa710f2103e2f81b572632daa02c4035acd3690
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 10.7MB
        • SHA256 ffa142c8caa0329c95c6af17f60479bb477ef4e8ebfc5f17e9792e6a52fde0e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 10.9MB
        • SHA256 dcdd78677a4e19d5711db3c735087adc3f76a1d7c03035135a95a65228bece99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 10.8MB
        • SHA256 f551675a3d0be648e2b0409cef6572fd9f05a445e6429137785e6810539bdafc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 10.7MB
        • SHA256 a26048db42f9226e6b8c6f437fe8f552d0c99abf61ff66c4b178887ca97e9742
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 10.7MB
        • SHA256 83440e8e09a5733ebed493b715e44a6d0fdbfceccd5f8be3520f216b40bf8524
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 10.7MB
        • SHA256 c356ee1efd136305b3d44ba9ed85593323e439869944a3e1e69aa6bf9a48b628
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 10.6MB
        • SHA256 b1e7f4a9c32bd233de7604e9149e49965254c715e3a5749b91e6253b4748b6a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.6MB
        • SHA256 207c8807295251bd592e2d7b7799a82284784ee84c80a0661019eddbef271a4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.6MB
        • SHA256 4b69f9c422779063d8ec0c56a1c4536303d965d7fe4aecbc31fc4ea26c8fc6cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.6MB
        • SHA256 6b6470044e754c3232bae409e0fdaf72acb228a85be7c4e62112a38b628d6f7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.6MB
        • SHA256 378588c24cb3eb3af16b8ee5a5e0b652844231f9ce91e062977d91f27224c348
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.6MB
        • SHA256 a4b56d2b728f150b819c492f8a3231c066dedf2ac1cbb3da0fcc4e700be68eed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.6MB
        • SHA256 b953137667851118525b5f8469f76cf7c80b0ffa40cb0ee2e96588c344b0e3fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.6MB
        • SHA256 bbec9b16400ba0516bf9aea8d442c1c64a05f3a8065ef34a15f3ca93b845de33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.6MB
        • SHA256 df0f2b3f5397a810d889fb1eb473c4a81bccbe33bc128dbac6b44c66ef05cb4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.6MB
        • SHA256 a7f2a80fe7fe5e4856a62706720513275a7f81c4b16992d80a7b96f213a03a7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download