Overview

overview

7

Static

static

3

2026-07-30...ar.exe

windows10-2004-x64

7

2026-07-30...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 19:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_01db5d9cfb3fbd564f535a6e138a9bcd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 10.3MB
  • Sample260730-yc45fafl81
  • SHA256 b7290b616d65526830b21becb9961cd7a5a9c1a62b262c39a0337ce84c02c68e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 62 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_01db5d9cfb3fbd564f535a6e138a9bcd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_01db5d9cfb3fbd564f535a6e138a9bcd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4960
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:3508
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3268
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:4752

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 10.9MB
        • SHA256 8a2c726dd3215eaf9d24c47965188681dd3bde98d7340c15f07a8df159c18496
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 11.3MB
        • SHA256 8e2e9742010951f943029b018cfca5bcbdbd828663eac37fe0fbcc54aebbd682
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 11.0MB
        • SHA256 3c8a11c85092d5fed1ce0029c47a61aad89c94bc23bd0aae10eb7fefddeac039
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 10.4MB
        • SHA256 e79425ffb1dd62ef4567e8662677949763ae4eb8e147035dccc59a5e7f3d37c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 16.4MB
        • SHA256 8c7237b0755a0d0e4717d825f332fc07a8e1f031823e9a491c775b163a033bef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 12.1MB
        • SHA256 e519cf3c4ce89f213ec406460b22e11a4081995eddc33b7f6da373b004196dd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 12.6MB
        • SHA256 7155538cbbc52cad96fd2ba240f51a5e6c0031e8afb0cd0921d3d41fbc98cdf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 12.0MB
        • SHA256 df4c8ac034879ff5016fa6ceb78ffa23228889f7d6d6224357d04590651923cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 13.4MB
        • SHA256 f1c90870da73bd43a47b0d673af02e4b43e3b83bb0e760182c34d26e0d2f5a84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 11.8MB
        • SHA256 9cb1a787f14aa9f51008e70ebc24980f59c6232d7009b19dffbb3d1cbcd935fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 10.4MB
        • SHA256 e46bb78593eaf30b72db0332a5ef20d8902bd27b6f0f0006dd4874d86ca97e9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 10.4MB
        • SHA256 dde7d270364341733ab8cf64ac97f0212f981085927ff2be544f9b246c7330ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 10.4MB
        • SHA256 7cf7573faab72d0c5433adb2abba8667c5a9b23ac1608ef14e2f76c686e5fdbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 10.4MB
        • SHA256 2a9c5c2320948b9977b8a5fa7960297df6137cf85381dd1f27abf71a33575147
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 10.4MB
        • SHA256 a72b6b47a92eccd447c66fe3a85585fb30cb3284b11a8901f64775adb965aeab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 10.4MB
        • SHA256 c875bd9a85b406b4c3d46280713f66570634794d56fd9aff7343c6c30247606e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 10.4MB
        • SHA256 794a380aaf5f0b110e6cef5559b7e9604958d1967e416dd3ac6a706fdb7b3065
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 10.5MB
        • SHA256 19d4ad857d19de3cffbaa8a20dd60a1395f1135e996d30064ffd29e8656da8ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 10.4MB
        • SHA256 5b326f328bb3e94c74d32b4d0ad6b0e0003fba91e4d12a7506250818318d717f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 10.4MB
        • SHA256 2a3f76f96b8847551b40a4e1103fe587ac8971296ded8a3ebde7fb81045ffc35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 10.4MB
        • SHA256 91a6fe8a5d8b2a294091caa682896cd8ee2875c1c9367ff7757e62aa1701f7ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 10.3MB
        • SHA256 b7290b616d65526830b21becb9961cd7a5a9c1a62b262c39a0337ce84c02c68e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.3MB
        • SHA256 6383cf44815c52b9105377ff731499f0f3cf21031c037975fc6e7524e4eb07c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 102.4MB
        • SHA256 32ba56bed715f5db2643aae1b6fb5053c4b9e663cf7324a4a0954a553da0ae88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 97.2MB
        • SHA256 f419ced28e18e9b3f2f896516e9bc72593f9192e8a8b1f49624660c5252c3def
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 96.6MB
        • SHA256 8e8bd588046cd972417fcb9d7327599884bcb112e23a712d4ebac8d42b33097c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 95.3MB
        • SHA256 a1f26aafcc4ae58b898a662c6ee0434272cb4e39d7555eea36281c3b8be48be6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 94.4MB
        • SHA256 913d7eb8c7b8689d1f8503e78b8e4e2e81f6f6e7c63e78abb8fc46439a8aef43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 94.8MB
        • SHA256 28cde9c18bbe8376ea84c26c1a98793aaca7f3ba6604f328235639e615680127
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 95.4MB
        • SHA256 f08f91e40e369ae1da00ab0695139e3a886a21a8b403bac267d0ba78c0f6fa0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 94.3MB
        • SHA256 92e213e3ad4efb11dc435834aeb5a37224338e0469e6ad38913241f54891dfd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 91.7MB
        • SHA256 4b38668e117790ae796bfb22bc6c1ce3b64757721b6dc73714f6cc3efb2cb740
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 94.8MB
        • SHA256 1dc3fb8bc28578c78632cb8987af0c6399d0e089dc6d06d026e0d7ce0ab6c1c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 93.8MB
        • SHA256 cd0dd5ccec9a29b15aa6e48fcb35aff9bc8e1b5348f14b5285de732de7a3334d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 94.1MB
        • SHA256 25451907d4b13b29fabff363a933465bb4f1cd24152de1372e9739c7b5124b47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 93.8MB
        • SHA256 115e3c67af4cedc9daba77258f04d8f0afc72745fcea9ba68aa79019892ccd47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 94.6MB
        • SHA256 c0764ceb11975659c93ea7ff00a27b03a0ee97b6e71a354ff20266780c608ba8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 94.1MB
        • SHA256 40d7c0cd38b0235ff4973cb6dc23796d2f40b1bee0d22e7588871133699a8c2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 93.7MB
        • SHA256 69bb47758536d3b9a75632d2371aae6c89796b986ceb76fc8171e4e132c80ef7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.3MB
        • SHA256 42075b64d94218613f8f10908b194bd9bf6debdca65936cdb4212c78c3a35618
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.3MB
        • SHA256 19c4b74f02aee0ae33338a1d1d0fad025db8a8ef049202a36c9a53e44d9cf94e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.3MB
        • SHA256 425b0ec4f75e371d0dd53c3348fa9317f0ab5efcd609145008453fd8a01ca14b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.3MB
        • SHA256 ed01f16f755f8a6ed4f01c2d5b2e3a14932333954b9f00d13bc0963ecbf3f60a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.3MB
        • SHA256 705f74644d41f96d1889d3ee95d5285bd434c615d67c4a8ec01ce6f204a688f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.3MB
        • SHA256 df887ed8efd0e984ee9a3a0a51361100926424fa909019e47c0a9310876ed00a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download