Overview

overview

7

Static

static

3

2026-08-03...dl.exe

windows10-2004-x64

7

2026-08-03...dl.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 04:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_8aba90d07ac534cf9143f6591b82e985_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
  • Size 4.9MB
  • Sample260803-fmaz8syfpc
  • SHA256 839dee9fba579123d4b3f4ecfbb9430be6dc381148c9a405cc8cd63a147dbb2e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_8aba90d07ac534cf9143f6591b82e985_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_8aba90d07ac534cf9143f6591b82e985_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:252
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1980
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:424

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 5.4MB
        • SHA256 9b45b2ec9995ff970564db9dc87516e761095e01df0e00ca35c3aebe055eaa89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 5.8MB
        • SHA256 07902987da70fe89267015cff396c64252aff2f9bd6c8fe5c77d07bb46b3adc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 5.6MB
        • SHA256 4f455bec494ace2182dbb87aa3f168ad4b236881eb1d4485c4348d64850f8a12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 4.9MB
        • SHA256 245a6a1848bfa406198c81ab3237d9496c8fe654c99d6f2a70bad25995831172
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 10.9MB
        • SHA256 85bb7df8ee514652eb4ac5278d936233c0080494d25e955482f83c5c5ec7799b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 6.6MB
        • SHA256 ad49d010a0405f254d17b179e9184aa0ea6286bb215be2a28d7f3dfbc4da7134
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 8.3MB
        • SHA256 ded95142154d00b6a797ef34fec644739aec127dc331f19139fbe109606cf7bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 6.5MB
        • SHA256 a8d240b2fb22d616db34a825a1bc024d42d30e8009db02cfa5e66051313b5b10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 6.7MB
        • SHA256 6aef3a3dd0e33cf2ca091db3c9131642127a20aede1ab25045dd7283fb186cf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 7.9MB
        • SHA256 4171c5dc16d7debfdccf1e887ceca8fdeae57458a8912eff325f3c59e8662dd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 6.3MB
        • SHA256 9a45c84c408ac2fd96dd67a59d8d5686c05f81474ab07a9e17825ca9772bfa11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 4.9MB
        • SHA256 1f42de6eaf1d5965046066154567cd5b7705fb28c2a24d4305250d16f4fa32be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 4.9MB
        • SHA256 6381e55feddb4a2223f596d394cb75485b6f1942ff8e8b541aa3886785ca9048
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 4.9MB
        • SHA256 53dac0afbe2cdcb96c99d934a7cb5d0172484a04ab49d8a59fbcfc62b56a5950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 4.9MB
        • SHA256 b09ac00d82d5410de312c78c7cf1ed5fb554c8457a52c88d35bad2c108f42d30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 4.9MB
        • SHA256 02e49fbf328c0398ec9f8509f2f80e0df543d29496445ad53dba50b7772ea5cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WriteCopy.exe
        • Path C:\Program Files\WriteCopy.exe
        • Size 5.3MB
        • SHA256 645a33b62454020bb63fbda1a466995d02723b57e6334cff88c277edb7eea2f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 5.0MB
        • SHA256 ad483f33cdeff45f22c33b3f864fc7ae37a9ffe3ad1b6ef6cc2cbe1539d8b4fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 4.9MB
        • SHA256 c1fe8c4a93da8d834d68f9ec6656a00e866905f6e46634a6892c665a599eb020
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 4.9MB
        • SHA256 3642277f054277d9c6c14703931160b9c19b8e6998d3e54eee5ead8c41f6e1a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 4.9MB
        • SHA256 ce736b15a6b5553116ba1be5953cda7b7dc82350d9188c70d30f131d941be447
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 4.9MB
        • SHA256 839dee9fba579123d4b3f4ecfbb9430be6dc381148c9a405cc8cd63a147dbb2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.9MB
        • SHA256 54615ae93bfa47b422e52d741fcf3e4ac8159c020fa008d085f18fd3ac063bfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.9MB
        • SHA256 6888706840d0f4e03818225435cdcef8e3b3f9845a3cfb98bae99f58e369f9ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.9MB
        • SHA256 e700b44fc180fe4d1af429702e3f2876cc63d5637e9455311182778eecf4568e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.9MB
        • SHA256 81e994a97b0c4d1bc4639bd16662f0cf60ca899b6d15d8a6e568b118d1fa6737
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.9MB
        • SHA256 e9245ae78a00e5385e5f2c93c077a4ead12f75e1ce779c0a69ce7bbe13fb8f32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.9MB
        • SHA256 e7a4aecf8658a44e63621b5036512a8b6554ab32ef586854c26e9dbc43157b39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.9MB
        • SHA256 89dcc116701ae1228b16862f2d747d5f1276ae3ecec8081b4abfb3217ab2161b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 4.9MB
        • SHA256 8c7d51d345c4862d702abc8f71eae1215c41b1a6811a07369fb5bc010965200e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download