Overview

overview

7

Static

static

3

2026-08-08...ar.exe

windows10-2004-x64

7

2026-08-08...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 03:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_650b32583ec5fcf632cf6051decc239b_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
  • Size 8.0MB
  • Sample260808-d1xp2sgr31
  • SHA256 26b78a02308b36383a4aa3f4ba8a7babba449254448b03c86d7544e7cb5fe379
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_650b32583ec5fcf632cf6051decc239b_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_650b32583ec5fcf632cf6051decc239b_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:852
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:1664
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2000
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:1716

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.9MB
        • SHA256 83107ee1eb065ea2702b9f5e1f900e6cbfe4ea7f417611e7d93e002d9759e53e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.7MB
        • SHA256 1e657efda878c0900f56ab018bf89f83244ca5a6b4a9dd18d91f4cfcb93cb81d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.0MB
        • SHA256 2ced6353e9b94fe4fd49de0e72bc1109d8f055b3895fa4eb8db2c8586ca83ba3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 14.1MB
        • SHA256 de4676cb155d3172f43ef96799c119e02dc2db72007994f733f40c4d9bc72a30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 9.7MB
        • SHA256 e73a2087eb9d503ce0d56d26cfba4c6e18f5efa4584094cb85af3066e044d11f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 10.3MB
        • SHA256 c27f40f5b87c006ca57fb5b718ece639195c84848a26c45c9e5783a047bff8e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 9.6MB
        • SHA256 af8b37cf8ad6f9cda8fde5897593f48be2b59c9ae2152a4804b1052f4144490c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 11.1MB
        • SHA256 c258774d0c36a74bca37dd8ec822c4af886b9d850f1e991f56dbe439dcbc4a82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 8.0MB
        • SHA256 99a436766f3caf67ca44444c6656c53857231d007d91c5d92f63dae9783b24c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 8.0MB
        • SHA256 8d5b7644be3160610b2d245df73114b202c96404464a0086a36cb1bb213fe678
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 8.0MB
        • SHA256 ff6fcc2376fb1a4f98015c5b28a38a801fe5c322267aea531f931f5c5c6597fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 8.0MB
        • SHA256 e07deb7e60d0f2c3f1da19840cac969cb6643fb7983705bcc63be9ed409a3073
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 8.0MB
        • SHA256 3e3f5615fc61665d137dd4bb6521175e712ce511e49511bb3918bc0ea892ce89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 8.0MB
        • SHA256 54631923834f17b2fde463e1bbfccb7e65fd400c127f92b45d1bf8eaab93c48f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 8.0MB
        • SHA256 e162e66134a7133227a575b3152bb89b68c98b10cc441e560708768e53909eba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MeasureUninstall.exe
        • Path C:\Program Files\MeasureUninstall.exe
        • Size 8.6MB
        • SHA256 0ab731240cb1623f64d580393a4a901f6dacf712e6ed733205a598061e79e2ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OptimizeDisable.exe
        • Path C:\Program Files\OptimizeDisable.exe
        • Size 9.0MB
        • SHA256 9174d23d4ebc0010bb7f4fcbb21da4e5e47f808278e54247742575b05bd8b536
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.1MB
        • SHA256 e324c3f102a75e36b9d8554d5e3da0781243a8516246cd7231b48686d9ff77e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 8.1MB
        • SHA256 39058659d7a73885b0ba8b45ed462299bdab8b399da6577b954395cbb15bc90b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 8.1MB
        • SHA256 8672b255a19dd431d966326fcf9504d878dd75dbfaf52322362519fd90ee2aaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 8.1MB
        • SHA256 6dd9b2c0f57d872cd2ac3c2764ab2b8d333d563847455a0c24231f2cff1244f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 8.0MB
        • SHA256 26b78a02308b36383a4aa3f4ba8a7babba449254448b03c86d7544e7cb5fe379
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 20d00fcff4662dde063d8c64a62e3348b50e83cfab4b7820485719ed54eef975
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 d23458626b4f8f6ca55ec85ab92a85b01fb4e7d82937c71ea0b74292a31f1502
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 cbbbdedb75d7e7b53c8ba2a161e05d506e08b179b89c73d7ac8b5b8977d93a07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 d9373da44255723905213e15412c5825262157401bc53df0e79b7cf21cd01586
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 8c0b685a0e485283b22ee1c3809b44161843a27995ccd2fcaaf3da2a69c122cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 e83e835d918b75178342deedac6183f3e7971f002289a3941b6794f3b4b20a5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 663d832f0d03613930bf7f232273520019c8943a204a1e8698472e13ea7859ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 52bea0ebdfc6d8264f2b30e4d90336175cde304e9ff204abe20717e2a2c6b74d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 bda399acc896782e6e68da94e185f654a78d18c1d254fc100bc932997d73eea0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download