Overview

overview

7

Static

static

3

2026-08-02...te.exe

windows10-2004-x64

7

2026-08-02...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 18:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_49d5ed0f82693e831c902e011f2056ea_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 6.4MB
  • Sample260802-xc88qaec38
  • SHA256 199ced6018f2344f4b41b2a8c81ce1d4fc7d09344b27f3a9b3a51d4b5089fd84
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_49d5ed0f82693e831c902e011f2056ea_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_49d5ed0f82693e831c902e011f2056ea_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5164
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:4696
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1680
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:3596

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 6.9MB
        • SHA256 c11fb3a82330b1d69ad10553f3a39adc8a52ce4f5229700203124a5a9a893914
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.3MB
        • SHA256 6a5f9b2371b92e027202f52ceb6b1068fb60e549a526b2ca65981005ee50c1eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.0MB
        • SHA256 048c2656ca9e08dd3e44277590bfa0c1a766b2e51ec625cf96712e41461f4fd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.4MB
        • SHA256 9b534688f114f66fa2214de8d5115d20db25b296c5d7e2afd6e18c52e802c100
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 12.4MB
        • SHA256 774f275cab0958280a52349b860872dee2b6f563b88dd46823514860719c8b0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 8.1MB
        • SHA256 2479e7c88675529b3828c3413241edeb0399325d05d9e905c8cb02b318b885e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 9.8MB
        • SHA256 c86374e195fdcfa5006f8f5e8296a3dd3b9c16a6f1039408080d58b1255ae936
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 8.0MB
        • SHA256 275d2b1372a050a2fd2d7d514a45f2df1ff9e62827a71776c3bfdc0acccf2069
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 9.4MB
        • SHA256 5495e2adb2847abc09d1435423359235d59dc8edf8b8bafa9d29c90c49ef626a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 7.8MB
        • SHA256 c5c64b153b2c3ef6349105e2fec291703576a90f2dc664dd2b8e2b354f0e66ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.4MB
        • SHA256 f5e959249dcd85fb76d9fbbabe8f424a68e34df32a54f984507b9e038b742761
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 6.4MB
        • SHA256 79a565f1cc796dae5c369e2c0c894b1f3cb1a7d032f249816469d6b1b98f4a98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 6.4MB
        • SHA256 88cda2267709c9ae5ed48a313fcee5d8524f980d8ac1bf018b3f2f23e6e1bcf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.4MB
        • SHA256 e473d31a2b0371d7ccc750d20177722acf31912d0198851d97429059369362a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 6.4MB
        • SHA256 91ba62f62381cbcf715392ebad0517dbb6fdc52497bf823cc5e9c1269f02fc51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 6.4MB
        • SHA256 b382143d4fd7a47d40ecef2a90f9a2f06e6a3b46a759cc92804694b908013512
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 6.4MB
        • SHA256 6bbce81b3021ec902e1f996a998c50d0125b2f62bd656dc762eeb1a350cdb895
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 6.6MB
        • SHA256 96fb46ce4d6f37d25a992537c0d0f5047b7f0fda4f7dc57516d16a1c0d7b7413
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 6.4MB
        • SHA256 875814756072f61af0f8363514beccd7abcb99452ff2bdf76b49d4621106ebf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 6.5MB
        • SHA256 d56faf9a50e11ca83d7efe089c3efb23f5a451809c8f752b863d99042e9fb830
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.4MB
        • SHA256 9374e05dc69a3a7bd6bd1357ca236d64364dcfd9f2c42e53d7d56b0f1a1052fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 6.4MB
        • SHA256 0113e060f5a4f2e066af02c98072d29d8900b2ea34ce39ff4929359b84c4f082
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 6.4MB
        • SHA256 5d371e5f78a3c6de0a9c31af7ed1ee4fd4a1b3485b8bd7803d3ab9ec0945e4dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 6.4MB
        • SHA256 199ced6018f2344f4b41b2a8c81ce1d4fc7d09344b27f3a9b3a51d4b5089fd84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 b2a547f0c9eaaa877ed882a500f1a196f117933670f9fadc8a92b208355841c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 017c84ca64f16ae8ce48caec56b456c9073ff7df05b38ae36a16dedacf0a47bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 8e9521474515dd49d328fcfe6ead4b545187af6b8b7de7101113f3a24b5b6461
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 93ebe3dcc98898b8ea4f90b12f0e4d0386ea4d5780a352b05ae90f7baf6bb312
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 54ad328af21feedf4f3242364a995ec9c15fc1597f290959db1385d9e450f8d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 cace199e792ad30565a8750a63dd50bd39917b08c67d7304efc896801277fc96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 3b3c8be35cc3b1c7b8764c5f628fd53c2c6c3aafe38a4473ceb43fb52e06b75e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 38d086b78f81ea06df24d94a9c2894817829345846aa0534606a5f86370ea135
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.4MB
        • SHA256 22d9f83f435e906ce1bc7d868460b293c0ee3d4a792c815ab2cfefca3ca0c9e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download