Overview

overview

7

Static

static

3

2026-08-07...te.exe

windows10-2004-x64

7

2026-08-07...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 01:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_5b08b7250192d7f42aee850f586e1dae_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 15.8MB
  • Sample260808-bpgtcafk7v
  • SHA256 4c6760bce2ff85f4a0dafb4d18fa4b675191e49589d40bdea07299af8d6dc2c9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_5b08b7250192d7f42aee850f586e1dae_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_5b08b7250192d7f42aee850f586e1dae_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3076
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:2948
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:936
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:1464

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 16.3MB
        • SHA256 e58a5e3eb5e4e317a1fcb8f4d7339d4a9c99c23bde63befaab48c516e6dae78b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 16.7MB
        • SHA256 a4231c8729f47633af5a534932cbbf27e0004b6fffa5ab414d2ac434b25c5f66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 16.5MB
        • SHA256 e9c423f66e672cc9da8c396ad1d4ec885a543e6b4faf503ff8be43758eaf3400
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.8MB
        • SHA256 99cb73bcc465eb0497e753508f33521a8736b89cfcaa5b0651d03eea8bef8608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 21.8MB
        • SHA256 25c8dfb8b927c019213336895722dde1627f9c9c52e0e4d4bcae329e1bf75f63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 19.2MB
        • SHA256 84c0172afff4e00a19d4875edc7cdbc16b8459f97d559ba46c8e362b73be4264
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 18.0MB
        • SHA256 f3165f669913e0ab77270616b56b7e265b8ff5792e81abf688716aa4d8e4db0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 17.4MB
        • SHA256 b35db4fe052d920d1026bb5d4bd29a30010ea69941d961274e0103fb0a278a50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 17.6MB
        • SHA256 4f45ab2aa0a8bfeab372bf20ef6830ac6ceb27d68246e0d4aaad0320d3ee628b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 18.9MB
        • SHA256 2371e7f062e8bbfb311f282373675b36beb60f68daf3b343ebc7b0c65c269ebc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 15.8MB
        • SHA256 b7131417217316193c2b3366b3e96a94e9ac211d5e4b2814681901497420274e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 15.8MB
        • SHA256 9b842d414e3fe082c0e776269c30a366a8f73faabe25eb5d4c319d8be45f0ee6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 15.8MB
        • SHA256 ee2340997605d764fc0c5c385304a0f53314be608e3343158a001569441a3dca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 15.8MB
        • SHA256 9b517109e3d880071ecf26b149915b9790c51d2529867e06ee5724772dae3366
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 15.8MB
        • SHA256 65fabe3378d5b2fac4123e5e04dc85a9d4589a62bbe352422384f03bc25c83a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 15.8MB
        • SHA256 8d5ee6fdb50116001747e1c88404e56b29f22254470550dfe083f2190bc5ea4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 15.8MB
        • SHA256 497e71cc79571f0f530deeaa40cabb504793474c1c92c29728719d46aa475653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 16.1MB
        • SHA256 b10841bca5463d4df3023aef779ae5ab30ac507d757e91759e7d097dee86e288
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 15.8MB
        • SHA256 37b96dcdf297699825427788f28c0446a73227a920d1024f69b1cbdd800e4b3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 15.9MB
        • SHA256 9eccf38d15b28f44601fd5a94fa97a843418b88d233ea1f23cb2a8f74ad76a3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.8MB
        • SHA256 24552d92a4ddff442df39b9d9bdc43792966c5383da0514d2acd6fe6a802671f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 15.8MB
        • SHA256 73af85cb2ea25edc496f9af694d91c2c2ad61bf7ba3df0f414787f80563297a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 15.8MB
        • SHA256 cc35b7dcb4f120dabd196d32169f4debb85ac680e814ecf6de1ba4e861732226
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 15.8MB
        • SHA256 4c6760bce2ff85f4a0dafb4d18fa4b675191e49589d40bdea07299af8d6dc2c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 91.7MB
        • SHA256 1eae87d942d00088cbdf0e1bc6c47bf094f38ceda971a102f803e80ce8d5dcfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 91.1MB
        • SHA256 85d1e46db760f60c56c3e218ec1dbb4fcb81ca39e551aa66f0b12ca8fc1d948d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 91.6MB
        • SHA256 06b51bc90ffe777159cdadc350ac9e0dfe91461a3dd3d3848217c1d45ac29133
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 91.6MB
        • SHA256 27c546c01de363f905cbe5c41509638a9088b01701d91803b087ca0648bdeabb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 88.9MB
        • SHA256 2f4f486787a6e04a94aa81b0ab8a000b5e7e22e3cf8a7bbdb672eca26f9be03e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 87.9MB
        • SHA256 2bb8ed47ac3dc06b670306bdec7aa38b4294b488736c442149e686a0db5e8422
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 85.1MB
        • SHA256 a1f8f104d115c30924cc641b1484027a6a3dd08d0c2455d356f0a59017b141e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 84.0MB
        • SHA256 b5f12bbc09955188bde3efd254118defec362b9b4bac382af7dd76d29b2e36a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 86.2MB
        • SHA256 edd4667b6b46192bc400ec06a46bc86555b34af65b3aaf5882113e2b28f21820
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 87.0MB
        • SHA256 1d11ac239b5ca57214939bca47997f0e57138c7aa39958da6a644aa639fc7680
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 88.3MB
        • SHA256 d47f5ba6a527c9027820816b17549e3dda4e362498efe98732e8fd9ea83b4147
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 83.8MB
        • SHA256 f429dc3a121e88903f6833a0faef6a138ca1bed4f4a3105b8c0a755d63ab657e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 87.2MB
        • SHA256 20e43e2587a7664d6fc1f0bad65e96b66b8bac4421d42b55b93e00822a758c48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 84.0MB
        • SHA256 a1da410970342796c7213bd0bb2bff5b4ceb97251ccda005ad7abeb606bca575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 81.1MB
        • SHA256 67094acad08769bb87f662da6635f14ea0ec5d2b62b923a82578971acb65b3c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 79.6MB
        • SHA256 0895d4cd0a24036fb7ce0f17d2f90758cf19c303395afdfc1c76ad6d18c13405
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.8MB
        • SHA256 545f199694eb42f1a97f95ae09a27a51d7461a98e637ad92ba1ed9fce1e6a487
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.8MB
        • SHA256 8f80f960d802afb065c05227e282c988db6d3959f327eb7b19d4a04dd8e90605
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.8MB
        • SHA256 e684519649e28f1c951d7a3981b1a00e9d0627e6e59c04b59556a55318452ed5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.8MB
        • SHA256 58c480d2744619c1f5f8de556ccc021e3381a732e77f2f67c02157dbf5ef24d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.8MB
        • SHA256 8205ef5d84188691ebae5fc08e53d827f4bdb7e6affd51a6bf11b959f1f979db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.8MB
        • SHA256 0f4f48b53785e381039588cb770de727a982c11c55d9b4899f4683bc60dfeee8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download