Overview

overview

7

Static

static

3

2026-08-04...ar.exe

windows10-2004-x64

7

2026-08-04...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 06:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_84e426c319f3a1629fa5305d73d653be_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 6.1MB
  • Sample260804-g974xstamd
  • SHA256 331551ebe731272c2131049049b647e5dfb704f2e61ba5aa224b5a56e646c3d7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_84e426c319f3a1629fa5305d73d653be_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_84e426c319f3a1629fa5305d73d653be_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:6180
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:1436
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4720
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:2492

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.0MB
        • SHA256 39c1c29bd203f9c5868dbe36601cb97e1f0e5d93ba57a4513cc217197c298104
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.8MB
        • SHA256 f74884d3739d852af26a2667cbcb859d24e2b1cab9e46cd6a6d56a98ceac0f20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.1MB
        • SHA256 e3b87a22ecd93112e46c0c032763208a01164e26afa31ad0b0ca1cb6a27ef3c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 12.1MB
        • SHA256 a260e35c0264183cc9f5fa88140c0d592cb1a9589444c5e82ebce79628138dca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 7.8MB
        • SHA256 f419cb10db509e96fbae580f986a75a0fffa686c62d424df9434789708ed4601
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 9.5MB
        • SHA256 a91b7f9b0afd7648be79f62961188c2e30e231fe6f27ae01032226128167b5d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 8.4MB
        • SHA256 34944d020401938970bd8121312e4d0d71760dda4a782540c06b6ae1f6f76d36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 7.7MB
        • SHA256 f46421a6f48662d27bb48d913b89b34a10376ee0df7f2dbc83257a260362f8bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 7.9MB
        • SHA256 55e783b1b180ffb648628f8df58cd3d98f528870f0b855e7ef101ca540001815
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 9.2MB
        • SHA256 2fbf8eec61f7e9b90dbae58c7078824baba2c3ba8f4abf8f6cf8926f243a4f3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 7.5MB
        • SHA256 8d067ed969c104808dcf5d9bd704942b5af7581cee7db72fc9308b6f33f89db9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.1MB
        • SHA256 3b906d6e61610929432bc0fe0cef8499f8bf5fc0a13617f9201822e5b6b3654e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 6.1MB
        • SHA256 2ffc446c2e6fa8000dbcb58456f5e0d71ff6dba09e8f9c9f6047dc740b4c46cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 6.1MB
        • SHA256 48448369cf573487b9a1d6793d0c07d01fb53db934dccebb42ac975829476c4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.1MB
        • SHA256 c065f1d1ca05920a60ee4e8e10844ca6de97beb77b3ac3e3c0ba2bb08135dafc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 6.1MB
        • SHA256 b240281efbc81cc066323d8319d77c39bd768605b6d48046367f5be8f61b988e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 6.1MB
        • SHA256 751ce59deabda9a40af0f2ef1a9217f2e31a9245d7bb14043b4123bfd0e2eaf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 6.2MB
        • SHA256 62466845be2c9eb1af859e0be3157269aebaa244316d5f52448a071b34d247c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.1MB
        • SHA256 1a2f6951a2be422ca75aa452c03d1535e35c767161596a08d7fe520dd096ecb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 6.2MB
        • SHA256 3ed884b770250f2c5893d8f732ec81413c310efa523ce652220b257e34df2807
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 6.1MB
        • SHA256 ea7fd1681b78e87a2bb46491023df4f996b7e9c75976be71803c1f705a1bb78f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 6.1MB
        • SHA256 331551ebe731272c2131049049b647e5dfb704f2e61ba5aa224b5a56e646c3d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 8ada35d4a355939a3d38df578cfbb8360b60ea8df48e5f3a88b157e5a251aec6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 0197fa750b485ce9c0bc7be036af221f3a290c27598c3dcc49ceb183d1f2ad40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 f628d66c7837ea78e08258ecb728a030b534e8f6f95ca1a685154220e575c758
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 16bde8d55cb4cd7680953d7a7a75ddcb5cb7afbe8ae394746c6b34df90440047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 fde85e01138eb42865e3f11f2c04daf1f2caad84f4d19becc46cb171d3299eac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 d1d01987a626e163c012ed3c0f06b2d7b40344535a04b5c67e2fc21de17ba6bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 e3f803be02b1f41773a5e78e91020e6d84b3909e547f09dbcc431ea4e2305e50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 6.1MB
        • SHA256 654adcda9615821d043c670c4236f119bcd6855068cd9e154604fe26dba0ad12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download