Overview

overview

7

Static

static

3

2026-08-08...ar.exe

windows10-2004-x64

7

2026-08-08...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 03:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_650b32583ec5fcf632cf6051decc239b_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
  • Size 8.0MB
  • Sample260808-d1xp2sgr31
  • SHA256 26b78a02308b36383a4aa3f4ba8a7babba449254448b03c86d7544e7cb5fe379
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_650b32583ec5fcf632cf6051decc239b_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_650b32583ec5fcf632cf6051decc239b_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:2672
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5364
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:3040

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 8.5MB
        • SHA256 a13ac09511101285d69c52ef525bfd9b1ba94acad78b32e66612948b54f91466
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.9MB
        • SHA256 83107ee1eb065ea2702b9f5e1f900e6cbfe4ea7f417611e7d93e002d9759e53e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlockRemove.exe
        • Path C:\Program Files\BlockRemove.exe
        • Size 8.6MB
        • SHA256 ae1b8a87899ff4f30e9b2dc6dd25d9973805bcad32e62c42a127c05cb942301c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 14.1MB
        • SHA256 de4676cb155d3172f43ef96799c119e02dc2db72007994f733f40c4d9bc72a30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 9.7MB
        • SHA256 e73a2087eb9d503ce0d56d26cfba4c6e18f5efa4584094cb85af3066e044d11f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 11.5MB
        • SHA256 0877563f8b90dc4d04e7ff4f95e307be0650c180b8a0084607268b5e8f3b02ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 9.6MB
        • SHA256 af8b37cf8ad6f9cda8fde5897593f48be2b59c9ae2152a4804b1052f4144490c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 11.1MB
        • SHA256 c258774d0c36a74bca37dd8ec822c4af886b9d850f1e991f56dbe439dcbc4a82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 9.4MB
        • SHA256 655f3e2345f28c183e4faa3a64d5f70a4d0a0cc6380baae0a68739d8abe44447
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 8.0MB
        • SHA256 99a436766f3caf67ca44444c6656c53857231d007d91c5d92f63dae9783b24c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 8.0MB
        • SHA256 8d5b7644be3160610b2d245df73114b202c96404464a0086a36cb1bb213fe678
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 8.0MB
        • SHA256 ff6fcc2376fb1a4f98015c5b28a38a801fe5c322267aea531f931f5c5c6597fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 8.0MB
        • SHA256 e07deb7e60d0f2c3f1da19840cac969cb6643fb7983705bcc63be9ed409a3073
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 8.0MB
        • SHA256 3e3f5615fc61665d137dd4bb6521175e712ce511e49511bb3918bc0ea892ce89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 8.0MB
        • SHA256 54631923834f17b2fde463e1bbfccb7e65fd400c127f92b45d1bf8eaab93c48f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 8.0MB
        • SHA256 e162e66134a7133227a575b3152bb89b68c98b10cc441e560708768e53909eba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 8.3MB
        • SHA256 20cd95d3f9f8c31f89175bdbc9852a74a536f2873a0d956dbec081b649f984d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.1MB
        • SHA256 e324c3f102a75e36b9d8554d5e3da0781243a8516246cd7231b48686d9ff77e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 8.1MB
        • SHA256 8672b255a19dd431d966326fcf9504d878dd75dbfaf52322362519fd90ee2aaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 8.1MB
        • SHA256 6dd9b2c0f57d872cd2ac3c2764ab2b8d333d563847455a0c24231f2cff1244f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 8.0MB
        • SHA256 26b78a02308b36383a4aa3f4ba8a7babba449254448b03c86d7544e7cb5fe379
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 d23458626b4f8f6ca55ec85ab92a85b01fb4e7d82937c71ea0b74292a31f1502
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 60847c0153eda914a771780365993f84e519b1c9b85aeb99a90d3de3014fcc96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 d702c27b7f48d6f642d33194544e726a18ff753b47b18c6755613a79148b9cd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 d9373da44255723905213e15412c5825262157401bc53df0e79b7cf21cd01586
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 e83e835d918b75178342deedac6183f3e7971f002289a3941b6794f3b4b20a5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 8c0b685a0e485283b22ee1c3809b44161843a27995ccd2fcaaf3da2a69c122cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 663d832f0d03613930bf7f232273520019c8943a204a1e8698472e13ea7859ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 52bea0ebdfc6d8264f2b30e4d90336175cde304e9ff204abe20717e2a2c6b74d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 bda399acc896782e6e68da94e185f654a78d18c1d254fc100bc932997d73eea0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.0MB
        • SHA256 20d00fcff4662dde063d8c64a62e3348b50e83cfab4b7820485719ed54eef975
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download