Overview

overview

7

Static

static

3

2026-07-29...ar.exe

windows10-2004-x64

7

2026-07-29...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/07/2026, 14:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-29_13b18087fdce4521f8f99b7561a8a69f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 9.0MB
  • Sample260729-rt67sswejf
  • SHA256 cfcd6c865fa529a883794d536c14595b6d2f2548aa35aca62dce83c07fa87482
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-29_13b18087fdce4521f8f99b7561a8a69f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-29_13b18087fdce4521f8f99b7561a8a69f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4420
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:5108
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4560
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:4496

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 10.0MB
        • SHA256 2db76bfc0df18ebe8913f065bd8edac5ff208895549a3975718979d7a56a68a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 9.7MB
        • SHA256 a7918ea337d691c4524b59715e2b6a2c89577a9515455a40d9f3688ebe2f9687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 9.0MB
        • SHA256 be2404844b0b5885e4477c619f608552511b746bd5b81117a004a0c8361afb2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 15.1MB
        • SHA256 88606e5aad00233c9c169ccbd6d89044cd620edda6aff98c08d4387ce1870d86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 10.7MB
        • SHA256 7d427d9a057818383120c7de31a80948375bbe67ab7136c2df58f70c302a0982
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 11.3MB
        • SHA256 60bb38253faab75740938fffe96e198f1f574915977130f7008a2c672b585cc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 10.9MB
        • SHA256 a8c4c6b3ac5de19a19150704ee1d11d5fbcbd1fe29d22f62aa75547f55bec9b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 9.0MB
        • SHA256 962f8513acfc249bc2c358450db58dfa0cbc2c4c5e401e925018d134be1f4569
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 9.0MB
        • SHA256 76057f76732aeef3a94a57ee88634874ce9edf739c639342a69eb88a1326007e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 9.0MB
        • SHA256 304bcf8693f623b3caf074bd00982b39d05f1fa3e3b6c585635fb29af04bde7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 9.1MB
        • SHA256 0405dde06a41f6c01fe42ae57e1c452777ec129e4b152d3c4debe0a3c73170c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 9.0MB
        • SHA256 a80c98e6335269524d7a03de47a2663e9fc26b5ad108695c56412eb10a1ec863
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 9.0MB
        • SHA256 594d824226aa721bef53f87b4f69e55744058bc74757ff14ce33ef7d1ffe8538
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 9.0MB
        • SHA256 22e15474ccea33619a7a1c9c72479d1cd248205095e80c7c612271bed4948dbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 9.3MB
        • SHA256 d1ce6a1a78c2ae7101beab6ef7ec7b7c1d6f31b7bec17d26e8410cc4e848fcdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 9.0MB
        • SHA256 e89f92e93333e2b2fccb838891a82212bc2e51559130ca417373ee16f50d23eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 9.0MB
        • SHA256 9b829e5e8dbc3ed8adb31312c6a555a149354e781a95bb9d891bea18a37b05b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 9.2MB
        • SHA256 fc983568bcb388a185861884335b6a7998aab9bae00fb879061bc1ce262e184f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 9.2MB
        • SHA256 a3876034851de25aced0bf2d16c9e49c637d9f8d76f0ad262e06a305f31698d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 9.1MB
        • SHA256 7635ac193e6299255724807a1d114e7787ac3be05f20dc89dd0ee2c3fd02192e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 9.1MB
        • SHA256 308bdacde1965774a33f6c070130b4edbf52ef4f8292d14e41c1d7c5c7bd2f40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 9.0MB
        • SHA256 cfcd6c865fa529a883794d536c14595b6d2f2548aa35aca62dce83c07fa87482
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.0MB
        • SHA256 2df7f579c7d5f027ddc5ed5e5b26945d98371cefd383071d73cd198f85566d5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.0MB
        • SHA256 d88bc759d5d1460e26d89a6458fd3ab9175280b997426af1bbb652e7d22a28d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.0MB
        • SHA256 2e0c48c091cba1bb992db8b3eea782432b97380027b03f4be71ae9cf94f5db87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.0MB
        • SHA256 cda863da49b173fc41fee345d8cad42eff70de55ca683aeb024a4bca77c481b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.0MB
        • SHA256 5c559cb8c0b348b7d81bf4706c259e9923bba27df456838049d87cfcb986cfbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.0MB
        • SHA256 7b3295ef1f2ef9b83ce0cc11325e6e7779cb0e5d362edde0ba846c6c86236cb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.0MB
        • SHA256 4f2211631960ebaaceb3bec771dbd95ccbdb2aad3043fe9b30aaabe53e33d88b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download