Overview

overview

7

Static

static

3

2026-08-08...ar.exe

windows10-2004-x64

7

2026-08-08...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 04:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_0018d34718bcd25b9c7a4c7dcae30e64_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 1.2MB
  • Sample260808-ev9m4atsew
  • SHA256 ba130b66ddad7406fb1709ab27dd41a83134d2280d3a53e7074eaccc3d0a7289
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_0018d34718bcd25b9c7a4c7dcae30e64_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_0018d34718bcd25b9c7a4c7dcae30e64_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3860
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:4092
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1740
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:4928

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 1.7MB
        • SHA256 5c583ae05f0b726566e76b39fb5e7f1d498d95372590cab51dbe01736dc155c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 2.1MB
        • SHA256 f24d3ca19d04a769af662980bf89f4e382caa87003f26e289f2f09b1a9b2edfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.9MB
        • SHA256 abda7eb9a6d5a1072d96a28e904919e8ea92d51278b1550c5d222e34b49aa831
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 1.2MB
        • SHA256 43fafae5658e485ca8153d3ae2b30334fb9c009274fefb42a0f1b566b8cca23f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 7.3MB
        • SHA256 4a0fb9509a4dd36643256093a33487e8e7da91a00f64ba36a44c5711b5424c1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 2.9MB
        • SHA256 4bf180b2143cc308d069a0b24ee666548ecc527e0b00f9c3cf5f38e1f82f8636
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 4.7MB
        • SHA256 5ed8f11fb372540f90a5c2b35d53e1659067cbc85f13995f7e0c4a0cfe821601
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.5MB
        • SHA256 845a6d090c39e3012a2bda3a31a4412f696b160d2f5ce83d1247ca21279c0770
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 2.8MB
        • SHA256 e111c2bb712b92bdd3d575b86b6b9ebdccf99014d485660d23f05f57d44a2666
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 4.3MB
        • SHA256 30a3a072b8f7c598088147682e3e11e94997552262219e652946ccae65cfdb33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 2.6MB
        • SHA256 ee1febed69b2777e85ec3d50c3cf7e1cb799b412d55ce799e35496ce99b6891a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 1.2MB
        • SHA256 259a3be49423cb09700b697cd6fbdcccb822b93bd01d043d2775b4efb6945467
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 1.2MB
        • SHA256 77d0e3c9278dc43bc580bd740b487da96dfec2c64e6d2f9737ed571066c6136b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 1.2MB
        • SHA256 8a3b768ea0e412248383578ee69d3ca870c81ff12e051bc01a61737abeb8ac77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 1.2MB
        • SHA256 bb7835997d62a82492390b5cf3d5ccd10b4a75e23354b0c39dcc3810ddaf1ed1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 1.2MB
        • SHA256 72fdc58c1ce429c2d1bcf357b4fe0f1bef8c3a63b33cab3084f5d15a33c73b58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 1.2MB
        • SHA256 06dde0b83ea155cac043e7714ffb759f6da5595e7b4225a5d267c87aae4b33d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 1.3MB
        • SHA256 b0e26abfdec32f0764347629cd9a3ff9c8db3093a96e6885bb3cb43205f70365
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 1.3MB
        • SHA256 f78e7f7edef236f8fae87d6c0711d9ae428e97c90552c0dbf37e950c9a27d9ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 1.3MB
        • SHA256 b0c7976f91e64b8a0eb63d21bec2e484ccd79e8cb694116b9e1b85c9a832e56c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 1.3MB
        • SHA256 a5b630980ab2148bd3ff7440b973482ae55f5e27159cf22c6bb8900e1f2c01d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 1.2MB
        • SHA256 ba130b66ddad7406fb1709ab27dd41a83134d2280d3a53e7074eaccc3d0a7289
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.2MB
        • SHA256 5d1b79d78fdb051ed917efb90f171d9a04d26f63e6382f49a118325a17538566
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.2MB
        • SHA256 5e716095debae44d7eb1f993b5a92c3ca215ccdd828e51e595e91b9b795b8544
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.2MB
        • SHA256 d2c53683d02f9f1f0396111a353ce91021d82903ab1ce013ec0bdc716b078ed3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.2MB
        • SHA256 e25a8b7ff0ce9bbd0b7fdbb4e05f70aac6d616e6c5c0fef3670c9c90142aa5a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.2MB
        • SHA256 3027a010c5fb487ee41592f9ef7399fb2bb7f13203d960459f69f68744e6a3ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.2MB
        • SHA256 fab26037217c451b70be724b3d7b79c8253cd3af73153b8935f29e7029785f8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.2MB
        • SHA256 5aa0f4ac006c11ff7519da112514e55c28732b6f9675d6fedd0f5bbaf359180a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.2MB
        • SHA256 0a144590dce0adf23843ec1a20b2ba37edf0269d72996d86c9323df292a31dbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.2MB
        • SHA256 543f11176c7620dd32294fbfc304575f845ad2466fc2c6e70ac12244746558b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download