Overview

overview

7

Static

static

3

2026-08-03...te.exe

windows10-2004-x64

7

2026-08-03...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 04:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_9c8fa5c484dc595ba121b0d40a79d8a8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 7.8MB
  • Sample260803-fg975syeqd
  • SHA256 7dd7cff1e9e2b4dbeb51fb0b7700ba6301c1ea56f2ddfd34be6e2104ae08a4df
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_9c8fa5c484dc595ba121b0d40a79d8a8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_9c8fa5c484dc595ba121b0d40a79d8a8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3956
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:4292
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4496
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:3428

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.8MB
        • SHA256 dbc5951cd36ab376acca4ae6bb4331aec85a63dec0ca47c1d4eb76f2457d25b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.5MB
        • SHA256 6561267054e38bffac832ff4b3ff0025ebfb565eb718a30537a95630e2671c73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.9MB
        • SHA256 8adea75b7ec87b31cabf33e8d7660e28ff4b888b0a7dccc6b45b58214912ffa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 13.9MB
        • SHA256 71f5eb6eccdb976d9bccd996e4905cf2419f2aba9ac586c8f767b4d3c7f2f2fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 9.6MB
        • SHA256 82e493c631c773fb4066fd919f0a715757562808b2b530e07732217ab9774695
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 10.1MB
        • SHA256 0c58881bb3101e143c9ab08b2d696a0d5a6b30688d87f37cda07f2da343c2762
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 9.7MB
        • SHA256 efa5c8389aca9094b83629e238fd42be13b01b1f2f94a1ffa3f51a7bf1c5e599
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 10.9MB
        • SHA256 1dfec63128e8850e5ebabfb9ab3d7654e6475ba6b1f920ea51e8c7fdb12e17e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 9.3MB
        • SHA256 b90f68feddc0e02f76dc1bd7e14659f3333ece49c4ee4aec0e57acee2c285f08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 7.9MB
        • SHA256 f5180c93367bd972c27c0599c0704b190e5f9ba92ae65266b825c328f644a0dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 7.9MB
        • SHA256 2b70d9b74548fa00b066db788f0e6ab245c2113e67b2fdddad2257ad76567b3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 7.9MB
        • SHA256 c34242e516296998dbc90283f6464ee7b1c63aa678c523d32f4012bc5dd8b951
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 7.9MB
        • SHA256 74cf4d7792f4358c9ae3572907b5ae856e476f44347fd315d4e07c5e294d99a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 7.9MB
        • SHA256 0dd382bd64f54f0d45089f4df6ab69c78df869311b0fbbcd85da625efc4a6544
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 7.9MB
        • SHA256 d05ae7e6715924bc106202b817d3fd9b5271038d910f16fd5ced220773d50eb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 8.1MB
        • SHA256 8da5de05b3bf6d846380ec71bbf4691e7bfc949f3b5b0e96e4d3a9289b0ca045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 7.9MB
        • SHA256 904ee182c5dd08735cdb8ac4c6380aee3a3beafa40804f2bc2d32f476a9d203b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 7.9MB
        • SHA256 47dc765a80d3ff9f9339e8ce8faf6467afcc680db3c18b6b6e09a37541671b26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.0MB
        • SHA256 07cdd577dae836c7b833a9b402c0f0621e29c2680ab3dc789f57631fbd35ebcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 7.9MB
        • SHA256 5a7afe9f4e66261354296e297f0349636cadebf9679d90a0982bef51183cbd22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 7.8MB
        • SHA256 7dd7cff1e9e2b4dbeb51fb0b7700ba6301c1ea56f2ddfd34be6e2104ae08a4df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.8MB
        • SHA256 0a281268faf874347422c4b8d9f26e12924b1495fb7f924f99fecf9ae6a7afb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.8MB
        • SHA256 27a0962c3265fe00b0753d5fc46da30bb16b988ff463678d523ca8a94070fed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.8MB
        • SHA256 1509c79ec096cf97ac4b45d4364f05a6d4868a647bf7b63a111279ae3a97bc56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.8MB
        • SHA256 e44a5c15df1b79fe7f17eab6f9d2da8a4c773e20455ef565dc7c31c99e1083fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.8MB
        • SHA256 bfecec4c9cac35ea57d004a6087f5d48bcee9b4312b4c346d4c1b701a0617156
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.8MB
        • SHA256 4b5df9385dd7f54310e29d8b981b2da376718265576d3a4ddb3ef197b7643116
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.8MB
        • SHA256 d2eb14c4d08115e36268d8945fde22107372436dc7a4f915cd11ecd134a15c4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.8MB
        • SHA256 d31ff33ec2b1a70adff9513f93473fbd0e45dd4c531aa95c98270eb943eaf9aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.8MB
        • SHA256 36db7994ec10b20a8e3493645d648606c1b7e2b9f9a6a8d002ff556bd5c32e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download