Overview

overview

7

Static

static

3

2026-07-30...ar.exe

windows10-2004-x64

7

2026-07-30...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 01:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_ec7e0bebbae8ced82b6f1b232bb5bf5b_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 20.3MB
  • Sample260730-bfeydsap8z
  • SHA256 c90cc4bc4620b8452b35e854fcd79379cc970e36dced334f489aa44102815e30
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_ec7e0bebbae8ced82b6f1b232bb5bf5b_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_ec7e0bebbae8ced82b6f1b232bb5bf5b_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:6048
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:5840
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2772
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:3856

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 21.3MB
        • SHA256 7a578bee3a472967114ba454d21a9eb11e3708464324833a01396d91d4f22c45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 21.0MB
        • SHA256 70100deb5b85dde514142fc98424bd908dead74c6ec4d81880089a65a441bfb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 20.3MB
        • SHA256 03926a6d3f21799a728bb6387b23c39248b703850f27a12cca18f0b8dfb53b84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 26.4MB
        • SHA256 12170193f50eddfc0fc5143dfe8d8cc1748e93e801e2fa74b97bdd6035313d45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 22.0MB
        • SHA256 bb1dec353d1279a80a2102e82857391172193890e5ec6e10502b022dcbc76b6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 23.8MB
        • SHA256 b7264a54c815e05cdb871b26aa5329a1966527a47ab92a8882da1f8ce31b318f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 22.6MB
        • SHA256 a3a8b479bf4700302b59cb3b680842a3365a6799f278cef106563c1efb802ebd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 22.2MB
        • SHA256 a69b93541811a56c80e226f7aaf775e9c5fcc7b405ac1bde8106c5ad5999bfef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 23.4MB
        • SHA256 9d90d1ae872e600fd4c866dcfbaebe9253477be749a5d1ded32685aa04ac0e54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 21.8MB
        • SHA256 8584cc29fb228ad30d4792c9dd4f4c0be8af4f26dfd38c15acd33aa89e112273
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 20.4MB
        • SHA256 b75129283f0fd15c0654b72c1e70b925b2651fb324dc2a9793b26430a3944ebc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 20.4MB
        • SHA256 3a19d40c094ebdbde9dfbcf64d2de0d81fe038eeece7190d0e7896332b5aabf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 20.4MB
        • SHA256 17391b1bad61800722948702614efcd56664fe9229d45e8ba678ac6be2a9860f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 20.4MB
        • SHA256 38d78737214c70797573025356d216518a15e1b344d3e64a6e94d1eed6531a29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 20.4MB
        • SHA256 f5459fc676632501349a25168828181bf1fc6f4a8b18409d25a2d25dc8843976
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 20.4MB
        • SHA256 53509211cf743798a6e6e6a0bcf6accf1c44372ed78add16ac29351414596878
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ProtectBackup.xls
        • Path C:\Program Files\ProtectBackup.xls
        • Size 21.4MB
        • SHA256 59fd83e0b95b8a84a2a081c639e4bd8e36051f41a48bb557083703747c3b47a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RequestExpand.doc
        • Path C:\Program Files\RequestExpand.doc
        • Size 20.8MB
        • SHA256 29306e53c3f7c32009c8e6df3a0592244c1d2dd04d267ae3d39dab1690563a21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 20.4MB
        • SHA256 fd92abe2301a96d28e2f3131db9fc804791102a56c1eb5ee9e632ec4583b6fb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 20.4MB
        • SHA256 c9f1e4d45868ae48d8d5d59e743ccd08e0373ab87886a39d0a88521b9a87a2d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 20.4MB
        • SHA256 d09d534122de6164f449cfcf0290c5ee985db78a942402fb25b293aec6c1ea2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 20.3MB
        • SHA256 c90cc4bc4620b8452b35e854fcd79379cc970e36dced334f489aa44102815e30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 55.8MB
        • SHA256 3a415c7d77d8b3aae26fae216a139bb968cae036cdb8996e1d5eee1a040cee47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 56.6MB
        • SHA256 187aafe070675d88f74aac46aa0eff92e51f822c8cb25777ae078b9a886e048d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 56.2MB
        • SHA256 f9b9a11889582bbb912ce1e2b667ad4e1d681822707e681eafa477dd92828c12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 54.1MB
        • SHA256 e0e66b944753868be725babc1a7f82502aa7eae9e236c1038951cef06e1e945e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 53.8MB
        • SHA256 a6d09ebf79683ab8cd7df3b9a0c967cbe8cafeec7ec473fbfe92914ed9757076
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 52.8MB
        • SHA256 729fd39f9cb07a8ee66d7343f8ef97cd52755c5e95670ce82f93a1990a351856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 51.1MB
        • SHA256 2be0034082a5e80f485d6be41c2c2fc1d584dd478328798bb332334e7b31df4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 52.1MB
        • SHA256 ae2374d395f1a2d1611d315e59346f16d5c9fb6777f5ecaaa445fe25df818b78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 53.7MB
        • SHA256 22effb161529bea9d2d7bd58f0557d881bb3c443ee7973286605f87226239854
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 49.6MB
        • SHA256 c21d93660b3e1bec2e62b720541f416fa26c27e83db98be81e69b9bc307fe87f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 52.4MB
        • SHA256 79f0854b31fe4c68eaf9904f51c5f2c474dabcb66bca5e3c57c9a7c4b12c638f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 52.1MB
        • SHA256 dcda3c212d1046d2ecdef83d615174bda1236d958d411dd621ad9cfc46f12432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 51.7MB
        • SHA256 ddbc0bb0d9a98c9a327cc6704a9598f5da66b8d372ab8356c75c3217292d27d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 52.4MB
        • SHA256 cbc0edf658ab71ac06a612ab69a46f9113526e44ae4ac4e6a888cac27fe14cfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 53.0MB
        • SHA256 72dd6394cbf0d594d8054a907a99121e75e5c9b5aebb84efccb2bde6768a49a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 49.7MB
        • SHA256 5474df6cc00ef587d025806ce0fde6911a4259211bd0ea041ccfbd9004c0f87d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 48.4MB
        • SHA256 5a0a682dc40c8527026caa61be2cf51364eab613ee785ebfc2ed8893d0b476e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 49.2MB
        • SHA256 ad582520b407ab1e52242ee0b0cd9bf0d38f3b6e2252d99f17f7e0a309e55e33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 49.6MB
        • SHA256 03b5d0c8b7034e8fea5087f90979dbd29e29b863267a739a14ab331dc38cf171
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 20.3MB
        • SHA256 ee6eaed5559d6a2929e94073f34d28a1e27cc02548343f6393082bc877c181e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 20.3MB
        • SHA256 f7296e32d4bbd22d24341c76598c3cd5ff550e5d86623513a013e1655291e7c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 20.3MB
        • SHA256 08cbd23dfb117fc130a9906c889e676079b38f4a519d63c0886162dddabad4c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 65.6MB
        • SHA256 9c224e281127e0b0b4b438ff91ec42a3a7108c1458ff9d7d554879dd79fd93f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 56.8MB
        • SHA256 52c98bb98aff3f9126107a2557d1f46fd688533808836dd62a084244090ce4f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 58.2MB
        • SHA256 d041b72e9dd3faaf5d4f7b908f75e5dc107baab669270554f1bc8b40c4793542
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 58.2MB
        • SHA256 cf7a2c00ab7c9b1d99d4afda9703f9c73393745d59e1778f4e75ca737939141a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 58.6MB
        • SHA256 d66e113a1b8c3487646e0840f7b898509022750a4aeff4c022c3dc977cb91b6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 56.9MB
        • SHA256 b3452a1d4e912dc6cd9949c9f802435b1ba59628c0ef5bebf076c68d2ad975c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 57.4MB
        • SHA256 241659b8ae370e8181d1ec6935dcc082286bb986ed4fc768c214a353bd763036
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 57.9MB
        • SHA256 d977152877c40bbfdff8ea53e159f0f93c2d54ba766a950a4b291f6156d42de6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 54.7MB
        • SHA256 f3c86db22b416f2ca86edbefa3249baf88279b4f503f5d432c2f1819774d860d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~8
        • Path \??\c:\ntldr~8
        • Size 20.3MB
        • SHA256 a5519ca16c6992c7175c761f813a77771d9987de2903aae76a671fdd99a6175c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~8
        • Path \??\c:\ntldr~8
        • Size 20.3MB
        • SHA256 31f64f517ef3cf33299ea791abc11d348a2c5d364394dd8eb6c0844cb2d073ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download