Overview

overview

7

Static

static

3

2026-08-07...te.exe

windows10-2004-x64

7

2026-08-07...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 01:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_5b08b7250192d7f42aee850f586e1dae_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 15.8MB
  • Sample260808-bpgtcafk7v
  • SHA256 4c6760bce2ff85f4a0dafb4d18fa4b675191e49589d40bdea07299af8d6dc2c9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_5b08b7250192d7f42aee850f586e1dae_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_5b08b7250192d7f42aee850f586e1dae_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:3804
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:2452

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 16.7MB
        • SHA256 a4231c8729f47633af5a534932cbbf27e0004b6fffa5ab414d2ac434b25c5f66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 16.5MB
        • SHA256 e9c423f66e672cc9da8c396ad1d4ec885a543e6b4faf503ff8be43758eaf3400
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.8MB
        • SHA256 867965734377eb80a3d7932191437076e8a3ff11ad8291997f1cb33dd7bcdb1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 21.8MB
        • SHA256 614053a55668db92531cc71a16c3e889acc4133998a82622947ee6a3f69eff10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 19.2MB
        • SHA256 75799353c77add6fcbeca9399f4e4d7484f3912e8831bc9a659a1bfc44cb265c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 17.4MB
        • SHA256 bb3e24bcd4b4d5d1276f6212000f8950606bb84274f72d777afb2f951278ccc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 17.6MB
        • SHA256 7ecd0a0e26693c0bbd893f37b9980d99a216551bcdfcaa017f32ffcbad8ac7b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 18.9MB
        • SHA256 30477921204d957033a28347f082760dee9401ef704205b652c670d28696f81e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 15.8MB
        • SHA256 480761e116257b4d842e17538d2c8825fb8c7c8c7e22ccb2046f12efc0038da6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 15.8MB
        • SHA256 cc4bf76e8066fd9f1535b3ab0ccecf0977b092225ec97de88cf4ec528ba4c701
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 15.8MB
        • SHA256 0b7d897fbf59b66afbc9aa6e2c83fa7b6806c8594ed7f14d858c0ed1057131a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 15.8MB
        • SHA256 e0c21f8aac4c52a98233787a06259429d3fbf7432a9886ba0ff90a877f644248
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 15.8MB
        • SHA256 f17735330df35ad8665cc591631a3cff25cef0b7595bf9ad6de52c1bde68a519
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 15.8MB
        • SHA256 f4aea69b0dc049e0afdaf7ca2a7517bf3777a50d8738de577412d23b08c95e25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 16.1MB
        • SHA256 c28bb104e608abd26a7007ea81fb16879283ec9d2fdba949aff675868cd5c337
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 15.8MB
        • SHA256 8fc2755090e020081dc2f665d6ad6a5ed1e3ba1e1f1cd7791eb1b8961949e017
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 15.9MB
        • SHA256 46e4d69e0045ffafaa40fcbec8c252dda42013bd3fdd4dad6ec54a52af0c6b5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.8MB
        • SHA256 9501e2d49436f2ee3e90bc7c9e750d008987c73defdfb7abc2661148f6c43ad6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 15.8MB
        • SHA256 31ac84043e8ee463181e3eaffc3a382e5007424cb4c026b13c9fb20f53ca7d83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 15.8MB
        • SHA256 4c6760bce2ff85f4a0dafb4d18fa4b675191e49589d40bdea07299af8d6dc2c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 96.1MB
        • SHA256 1e81969cede18f7838d4c290bfe7bd53a7b57d3523885a8a86730ba62cba11d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 95.2MB
        • SHA256 111496fa947fb9962c0805e437fda239f4345f92e57a17ad6a168f1bd1c2c3e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 95.4MB
        • SHA256 8bbc740278ffaa5e079636b65987b9d34df44ca37c98e2c3a55d2193c7e9324a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 94.7MB
        • SHA256 85324b673a9f19405ee366ae86654d44f40fb25e7dbaa015548642f31e9a1c43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 91.0MB
        • SHA256 39552714f48b710291e23f763388d08e091d64527d16350e8aa01f82ab8138db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 90.7MB
        • SHA256 204d4f92bd150e36641ff9dfed83792f28b0c97103e74a1a2ebe248415c624a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 93.6MB
        • SHA256 584d90c8b2197947963c659f2180e368b70c27ae9674a5ec30b209a0c1057da8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 95.4MB
        • SHA256 f6d46e3d192c91b1c728a27278cfe064a19ead5e3e08dd7197e349a0e6136d26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 90.4MB
        • SHA256 7a5e84a35fa4fc653bd709d5eda01f0ddc5f0d966bb68b1cd3791cd32e9aaf27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 93.7MB
        • SHA256 f475a8aa48cea7750a8e204b4c5ecb0fc47c916638998ec94e089e47ea699be5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 89.7MB
        • SHA256 c3820eb247c2e2e99540bb8d78090013e730ee2138e1143aa164faf721a403ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 88.8MB
        • SHA256 3ff3e4738e6eea89fc26c3e9080d32df1edb39be821eadd8a5dac25cd4bce7d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 89.7MB
        • SHA256 acf5e12c3f290da275d77113e9ba1bec170828d5995eb84bbc746aadf0c69fb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 91.5MB
        • SHA256 e3dd4ef7752a3467f2d272c962bc2d7c57a94e322c2c9a3baa4ccad403cca4a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 89.7MB
        • SHA256 5a8091bf9cc78d55e0a9a87d0f8d4db45157d3255115c747508acab70cce7c50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.8MB
        • SHA256 545f199694eb42f1a97f95ae09a27a51d7461a98e637ad92ba1ed9fce1e6a487
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.8MB
        • SHA256 8f80f960d802afb065c05227e282c988db6d3959f327eb7b19d4a04dd8e90605
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.8MB
        • SHA256 dd04595c1bfc0b3b235872192222813f03aebbae22e74ef75d5e7a867c1e98d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.8MB
        • SHA256 386585e700ff4209df05c546b5ce0e665255d37b9eeed65b82b978903e1125df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.8MB
        • SHA256 2772cb85dd1783a58071cc7f471b31a18ee0ac3245fde10cbc497cfc71cd596a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.8MB
        • SHA256 078cdcb24cc32dab93ad0f9ccfa6a3934bdf3d8fd7870e65e0a1972a342d9967
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.8MB
        • SHA256 0fae9c14f0405d8d8eeba6ca7c48368d0847038f124784b1d693b85a754b37ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~8
        • Path \??\c:\ntldr~8
        • Size 508KB
        • SHA256 68dd3f54f3414f000200972229c44ec6055c7834852953702fd6f0516d823beb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download