Overview

overview

7

Static

static

3

2026-08-02...te.exe

windows10-2004-x64

7

2026-08-02...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 18:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_49d5ed0f82693e831c902e011f2056ea_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 6.4MB
  • Sample260802-xc88qaec38
  • SHA256 199ced6018f2344f4b41b2a8c81ce1d4fc7d09344b27f3a9b3a51d4b5089fd84
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_49d5ed0f82693e831c902e011f2056ea_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_49d5ed0f82693e831c902e011f2056ea_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:5048
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5080
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:636

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 6.9MB
        • SHA256 c11fb3a82330b1d69ad10553f3a39adc8a52ce4f5229700203124a5a9a893914
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.3MB
        • SHA256 6a5f9b2371b92e027202f52ceb6b1068fb60e549a526b2ca65981005ee50c1eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.0MB
        • SHA256 048c2656ca9e08dd3e44277590bfa0c1a766b2e51ec625cf96712e41461f4fd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.4MB
        • SHA256 9b534688f114f66fa2214de8d5115d20db25b296c5d7e2afd6e18c52e802c100
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 12.4MB
        • SHA256 69ffc33ac09bb778463e459ba70d3be49d6b0804311a0a6b61f3602fc69f42bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 8.1MB
        • SHA256 af13de60e61fd087fde58c4642d97e2dfe303b784625a7a1cf791fbd5361a35a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 9.8MB
        • SHA256 75877ea79f35c109468b9ed9135c3f55efc03c2a1abe21e8634b038828f4bde4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 8.0MB
        • SHA256 ab7d6d8ae54e47f629d2322b5846beca387bfba12423c711fcade118281feecf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 8.2MB
        • SHA256 7caf2ed07c8a08ad7732771388c9f91b49aeda2939be9f80e734acf81770f4ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 9.4MB
        • SHA256 e77fa709d0505715d141190951d207ef85e62544c5952da517f3c19a62f75016
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 7.8MB
        • SHA256 86364049f3523c754f90974129ce692b84c38a7afdba61f396a90482f39a9763
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.4MB
        • SHA256 f5e959249dcd85fb76d9fbbabe8f424a68e34df32a54f984507b9e038b742761
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 6.4MB
        • SHA256 79a565f1cc796dae5c369e2c0c894b1f3cb1a7d032f249816469d6b1b98f4a98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 6.4MB
        • SHA256 88cda2267709c9ae5ed48a313fcee5d8524f980d8ac1bf018b3f2f23e6e1bcf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.4MB
        • SHA256 e473d31a2b0371d7ccc750d20177722acf31912d0198851d97429059369362a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 6.4MB
        • SHA256 91ba62f62381cbcf715392ebad0517dbb6fdc52497bf823cc5e9c1269f02fc51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 6.4MB
        • SHA256 b382143d4fd7a47d40ecef2a90f9a2f06e6a3b46a759cc92804694b908013512
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WaitUndo.exe
        • Path C:\Program Files\WaitUndo.exe
        • Size 6.7MB
        • SHA256 6cd2eed4235cc167c1051263f5218941016366a927ab52a5a7492153cdbf74bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 6.5MB
        • SHA256 d56faf9a50e11ca83d7efe089c3efb23f5a451809c8f752b863d99042e9fb830
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.4MB
        • SHA256 9374e05dc69a3a7bd6bd1357ca236d64364dcfd9f2c42e53d7d56b0f1a1052fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 6.4MB
        • SHA256 fb6e98e372de1368beea2e9c030c5d3b476c11c72fa5dc1c11c95fd3be8da8fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 6.4MB
        • SHA256 9f2dffe3187e7e5dc55690e34158be17528ead568ec7726a573904ebf0990a0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 6.4MB
        • SHA256 199ced6018f2344f4b41b2a8c81ce1d4fc7d09344b27f3a9b3a51d4b5089fd84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 b2a547f0c9eaaa877ed882a500f1a196f117933670f9fadc8a92b208355841c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 8e9521474515dd49d328fcfe6ead4b545187af6b8b7de7101113f3a24b5b6461
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 93ebe3dcc98898b8ea4f90b12f0e4d0386ea4d5780a352b05ae90f7baf6bb312
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 cace199e792ad30565a8750a63dd50bd39917b08c67d7304efc896801277fc96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 54ad328af21feedf4f3242364a995ec9c15fc1597f290959db1385d9e450f8d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 3b3c8be35cc3b1c7b8764c5f628fd53c2c6c3aafe38a4473ceb43fb52e06b75e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 ec155cc9cf95a1b726cec457e20381b6ad1fe537c93c6486c76fd2f0ff1a9ceb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 29737cccb453fa69e9e440fbf80b1e2d605dc5b63947f38d3ec540632c9398b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 923b39117c06a5fdc5f5ddccbbe737b380c4dedd50b076fbdffd3ad8452571fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download