Overview

overview

7

Static

static

3

2026-07-24...ar.exe

windows10-2004-x64

7

2026-07-24...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/07/2026, 09:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-24_95e870c0c699ee15f8728ea96818bce3_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
  • Size 384KB
  • Sample260724-k2d3nav1ex
  • SHA256 fea2836d1334812ff800d3ac0f192ef2e2fb12bb5ee8522d3acdc2c7c5a1d558
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-24_95e870c0c699ee15f8728ea96818bce3_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-24_95e870c0c699ee15f8728ea96818bce3_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3452
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:4256
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6044
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:4784

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 933KB
        • SHA256 b92dcbf27013a10359f090995789f3a6afcba59cbc9c68db054952ef7c2da0b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.3MB
        • SHA256 406c2bae2522ecae6d50d4981d492030a3f66581099eb7ef6d9f49dd7470b92c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.1MB
        • SHA256 c21352837ce6a95995bde448e58885a6926c2e2669b487c6f4efabad79d79ed6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 398KB
        • SHA256 da1e536b1ea6282b40bcfe73cdd939ef94d3f1ec2c7cd21275db873ff2bd3371
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 6.4MB
        • SHA256 730d7141c8f0c6a4ebdf29d29cea278ed4900401c20cd4e164e1620aae331c8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 2.1MB
        • SHA256 9bb4e0df8c4d6d27cea1c2becc634add2999e3d056f3a543ca247d06054f1880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 3.8MB
        • SHA256 fd25b04120cecf9058a8f2df13d12a02b94d78e7603ce8a52a6f2222219c348c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 2.6MB
        • SHA256 55afcd0a98b3e8071d998bb2c5232ec6551ce8634372122354394034e194cf5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 2.0MB
        • SHA256 551ca065dfa8b389316b9a891fd5ab64e7fdf73a5c5c6b4e896baf6313675260
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 2.2MB
        • SHA256 28c57d7befaac16d10851011d0e58d7eca452a1480322e73f4246a4612094228
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 3.4MB
        • SHA256 ee2e6d332bec1a19cae9b2745465141a7b774f61127ae6842abec95528f72085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 1.8MB
        • SHA256 247dbddf34cee1d6125c3e7849b6e91c69ad77548c030af5095e6440cc6406e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 407KB
        • SHA256 896d70661200fe9f1ff4467d07a8bf71152300ef5c4e843ef23dedef7a1dc9cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 407KB
        • SHA256 79a838efeb3677fa7e19e0d0a40d3ba01104c0cac64e0149e24766273015fa74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 407KB
        • SHA256 2c32e77c29e017c6c6886c22d76b55725769c28acc2723bbd798e90d2a7c50e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 428KB
        • SHA256 0faa9e402697722f1ecba8b044bd7f9b24d7b55b59c0d2dd9d21cbe4bb67e49f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 407KB
        • SHA256 29a971a9793af56f5cb18e216a7f4fb5afedf074889608301e069b7a942cc727
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 407KB
        • SHA256 900af91749687570953c4d13a37cd4ae189576897c7754a41a1f323aa7229ca8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 527KB
        • SHA256 8b07c59f88c279b5b51eb67acddea4120aa8d52e696c5a889d091ff90845b09d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 440KB
        • SHA256 7f1327e0d56299960d0ab9f7cc56945517aa525ea2b6afc3b00f492966094794
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 448KB
        • SHA256 ae2bfc2ac48149607a7038833d2cb6fcf1e9e31a03a82df06c68032310643673
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 444KB
        • SHA256 dfd04c85254b2f3b1bcfa173e27a4b1e6f7380cc9790103dd451f1fafa36c9d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 384KB
        • SHA256 fea2836d1334812ff800d3ac0f192ef2e2fb12bb5ee8522d3acdc2c7c5a1d558
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 384KB
        • SHA256 02a5f9aec5a6740cf7fb7444129246be8f118c323b1860c9f7ccd5cbccdb3326
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 384KB
        • SHA256 27742bdec657db59fdaad8763d3283f70ce40de79e2df0c0c7e11533aa2614a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 384KB
        • SHA256 93dd7d3b10370b797b1e6e006906fb9d41606bb131aa381422b0d985a6dce7c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 384KB
        • SHA256 3c1420faf96055ea470720dfa1b3b42f55b8a32245c5fc85a7baa3cd49aa5398
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 384KB
        • SHA256 b9aee9d18c86dc88fcb1328defbaf9a6759c2878c2303506da694746014f07b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 384KB
        • SHA256 1a9f042778d07ade2d7d91f2db47eee2e07c5ad67db4fcac58abb5bb43deaaae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 384KB
        • SHA256 4feff82e9c71436bb445f3b1da5342d597d9bc5bc2e813695c8b0a999c986dee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 384KB
        • SHA256 1f248e81218e7ba0feb7cbb9a1ced8b3e0b78bd6c7e692e4ce127c0aa147e48c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download