Overview

overview

7

Static

static

3

2026-07-31...te.exe

windows10-2004-x64

7

2026-07-31...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 17:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_a3c9bd23f4124036e9b49cfeb587651e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 4.8MB
  • Sample260731-vs8wsaxbjc
  • SHA256 0d51100c1f9eb0f18d0576a926e88722453d88e6f278948f1a0d5e1c2c397739
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_a3c9bd23f4124036e9b49cfeb587651e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_a3c9bd23f4124036e9b49cfeb587651e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5072
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:4960
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3968
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:1084

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 5.4MB
        • SHA256 d11967d8cac902703d727f0244c2350dbcea28c90c91f69dd2b6d74e8b97cb93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 5.8MB
        • SHA256 a048f089ca4207f6e70179961cedfb7ea10895c93afec079e5ab21442bad9125
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 5.5MB
        • SHA256 6d62c7f204226dfb75be5de3b11efa8525bd942200855f5e4f3cd94e32d45653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 4.8MB
        • SHA256 fa34b8198f25a22b043e393069047c87a17480e299444382c947e9c12caf0d9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 10.9MB
        • SHA256 2e0faa743abbf183a67030fdd05890b26805a94e2dcc292fbff6c3dce5024adc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 6.5MB
        • SHA256 9325d87c3464844c09ab934a68a69736bddfa35eaaba9123a92beb4a95fa3c52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 8.3MB
        • SHA256 0c9cbd944c1a1c76aa259510e5e485f966641fcf9193c53fd688fb256d92b860
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 7.1MB
        • SHA256 9c243903283712fd912d28ab0c845d4d506d664a4ae705773bc9a936071a3c4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 6.7MB
        • SHA256 2faf88fa2e30913d2dcc4880ef338fc0f618bef078e1e94576aa037a6be510fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 7.9MB
        • SHA256 679e682fc1f3742a2d7cb15012fb84820f8f78b202173e3404f93456e1428036
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 6.2MB
        • SHA256 72e9b1647f0dc3f2315cbf914cb0601a20b0f1af4dd4febd286034b456578a58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 4.8MB
        • SHA256 e0802c8fe7b59fcc946a8fec2ffed909cfa5bc11be9450259e0303050a7ea390
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 4.8MB
        • SHA256 43ff1bb2f447efff308584dfe3492916663fd6d7c54e83595e83911fd5e75041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 4.8MB
        • SHA256 0784a4283bc221daa577550624d7c1245da66a92cd0128df0ab558fc2dd05721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 4.9MB
        • SHA256 bdef68cd061b93106f23444a82adf500c7d80e822609418adfff03f77249f392
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 4.8MB
        • SHA256 89f05809714a57251bb6f05319fa9ecb228c1a6eae4c8888d4ba9abdba6b1892
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 4.8MB
        • SHA256 46ce0020832cf59d193f5212cfb3b62af26db740e6737c965ec7e9a87fd09641
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 5.0MB
        • SHA256 9cc6c7cde4a7046a8057c567371a439b3dc5617e815a18ed104b67ce74433973
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 4.9MB
        • SHA256 ee80e4349b6b2e9d0df5d2cc2522c4321570fd17eb3560d2fba409e4f481517f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 4.9MB
        • SHA256 b88cd1ae1c38f59d02ebc54df1fc0bc4d0b865da4f0d554513063cedf1436a43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 4.9MB
        • SHA256 244b4badfa983da7e30e76969d0bd990ac3cc0636f059a6f2f07c0e014e4704f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 4.8MB
        • SHA256 0d51100c1f9eb0f18d0576a926e88722453d88e6f278948f1a0d5e1c2c397739
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.8MB
        • SHA256 52b9bfa0caeffb8f4758501f327a4ace0ac513d1d7176506a29eecc91207d320
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.8MB
        • SHA256 98fe84bcc4069f2e60f4bdab91e845189330415f5d3ea57732d92005d0ba11f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.8MB
        • SHA256 975eb1b19be16d88ff404d5c656d2c0e55a84d978fa69ad00c933b10087c8a82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.8MB
        • SHA256 72e692c4711c7c754473ab94afc108b835fe07f2b9a3b6bc867786212a39b4d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.8MB
        • SHA256 50ba815b580c244cea0193464e4251fffb8b9655d3d95d826b3f4ac2246aaaa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.8MB
        • SHA256 975d919c5c74f834f5da8c33caf9e850bd303e22c6796b14ae89e28862e5ae14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.8MB
        • SHA256 63c8b7e896041d67692478813094e927a0026ae28f27b0ae05b38477f9ffd970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.8MB
        • SHA256 439cb05ddff7a50b36e7c367cd5a7d5fdfe4447e237f012cdbbc8cea629d6be5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.8MB
        • SHA256 44da27461d45522f0c636a51d0dcd1cc814b9383fdbe9946bc646454e7029c79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download