Overview

overview

7

Static

static

3

2026-07-24...ar.exe

windows10-2004-x64

7

2026-07-24...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/07/2026, 09:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-24_95e870c0c699ee15f8728ea96818bce3_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
  • Size 384KB
  • Sample260724-k2d3nav1ex
  • SHA256 fea2836d1334812ff800d3ac0f192ef2e2fb12bb5ee8522d3acdc2c7c5a1d558
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-24_95e870c0c699ee15f8728ea96818bce3_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-24_95e870c0c699ee15f8728ea96818bce3_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:1192
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4996
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:3152

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 933KB
        • SHA256 b92dcbf27013a10359f090995789f3a6afcba59cbc9c68db054952ef7c2da0b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.3MB
        • SHA256 406c2bae2522ecae6d50d4981d492030a3f66581099eb7ef6d9f49dd7470b92c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.1MB
        • SHA256 c21352837ce6a95995bde448e58885a6926c2e2669b487c6f4efabad79d79ed6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 398KB
        • SHA256 da1e536b1ea6282b40bcfe73cdd939ef94d3f1ec2c7cd21275db873ff2bd3371
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 6.4MB
        • SHA256 f54ac283c27952dadd81e81ace3bd1520529b64f942251eb6c7bfe462266320d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 2.1MB
        • SHA256 9bb4e0df8c4d6d27cea1c2becc634add2999e3d056f3a543ca247d06054f1880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 3.8MB
        • SHA256 17ada9ab2ce386fb5e916a7f02ed42d81d0646bc6964f4e15571fe8748f27e9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 2.6MB
        • SHA256 55afcd0a98b3e8071d998bb2c5232ec6551ce8634372122354394034e194cf5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 2.0MB
        • SHA256 97a7fed0432de82cb37c3cbf1b3848fa9617d03ea4d2b99f7ccf028911ac1d34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 2.2MB
        • SHA256 65e9bfbe944b286ad31d35163e3853a6ba78ad978045ddfb48e48a6171050983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 3.4MB
        • SHA256 ee2e6d332bec1a19cae9b2745465141a7b774f61127ae6842abec95528f72085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 1.8MB
        • SHA256 247dbddf34cee1d6125c3e7849b6e91c69ad77548c030af5095e6440cc6406e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 407KB
        • SHA256 1511ea372660e3aa8b27408f75c1e2de9694ae23ed5fd03c1e104c0408dfafa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 407KB
        • SHA256 9704241f5423dd05294311212dbb85da7f9cdaeba87a005b16ff5a4f1c2eeabf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 407KB
        • SHA256 8aa47b8969908fda69461bf588496c1a07bafb39ac3ffff369b8525b5a2d41a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 428KB
        • SHA256 f922abc2ccc27b4446f43a9e953058b44b0b4c1084aa18fe2a2a622bb064eeca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 407KB
        • SHA256 e21db90a9e9cdfa871f3a2bf0986a1a348d76d949d5dc59e8d4e0186ba3179a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 407KB
        • SHA256 05a99c456bf2b619910cc59b99fa475d0d430353eed6600e62951b7f9bb7b193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 527KB
        • SHA256 8b07c59f88c279b5b51eb67acddea4120aa8d52e696c5a889d091ff90845b09d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 440KB
        • SHA256 7f1327e0d56299960d0ab9f7cc56945517aa525ea2b6afc3b00f492966094794
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 448KB
        • SHA256 ae2bfc2ac48149607a7038833d2cb6fcf1e9e31a03a82df06c68032310643673
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 444KB
        • SHA256 dfd04c85254b2f3b1bcfa173e27a4b1e6f7380cc9790103dd451f1fafa36c9d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 384KB
        • SHA256 fea2836d1334812ff800d3ac0f192ef2e2fb12bb5ee8522d3acdc2c7c5a1d558
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 384KB
        • SHA256 a16f20d299e9576cf9e6c4d068341b2d50dd4f9ee28ae94fd7f43d7f00dd8a14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 384KB
        • SHA256 27742bdec657db59fdaad8763d3283f70ce40de79e2df0c0c7e11533aa2614a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 384KB
        • SHA256 93dd7d3b10370b797b1e6e006906fb9d41606bb131aa381422b0d985a6dce7c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 384KB
        • SHA256 3c1420faf96055ea470720dfa1b3b42f55b8a32245c5fc85a7baa3cd49aa5398
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 384KB
        • SHA256 4feff82e9c71436bb445f3b1da5342d597d9bc5bc2e813695c8b0a999c986dee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 384KB
        • SHA256 b9aee9d18c86dc88fcb1328defbaf9a6759c2878c2303506da694746014f07b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 384KB
        • SHA256 1a9f042778d07ade2d7d91f2db47eee2e07c5ad67db4fcac58abb5bb43deaaae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 384KB
        • SHA256 1f248e81218e7ba0feb7cbb9a1ced8b3e0b78bd6c7e692e4ce127c0aa147e48c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download