Overview

overview

7

Static

static

3

2026-08-09...te.exe

windows10-2004-x64

7

2026-08-09...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    74s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 06:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_a298bced6b77d14c3b421c97fd7b458d_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 10.5MB
  • Sample260809-hchy7swsgv
  • SHA256 b017c5a3af41d8e66211a3343c376e9c5b6e31886790e917abd64363e86115d7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 61 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_a298bced6b77d14c3b421c97fd7b458d_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a298bced6b77d14c3b421c97fd7b458d_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2768
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:5320
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4400
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:5076

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 11.4MB
        • SHA256 09cb45c5d5ca521c018e18d4ccd43723fbec908b616156e459fb304384301df4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 11.1MB
        • SHA256 c1a03017b006ab365dd9b382dce9ceb1c833d0406f56282c66e9e9a4c86622ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 12.2MB
        • SHA256 6f8814f356b6601c01e9183e4559d94ab076b29faad7bb544be7175291c29201
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 13.9MB
        • SHA256 a623bb5e1800fb792c3e3085300ef3406c55cf4a432d2c14a2c67aa9ce03bb1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 12.7MB
        • SHA256 acf3e62c7b2898190042b460856465dbb9d59b17bbf14beeb7917337249bfb6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 12.1MB
        • SHA256 72cc789dcc6e25440e3891175a96cd87a9edbc2862d47315fff5982c31699ceb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 12.3MB
        • SHA256 3fd9aa33beeeb392e5c04d7d5eb7658b65a823780c786925b9e30134aa4f1022
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 13.5MB
        • SHA256 c77b72a36760abe6bc4793333470298f6434729d1d63b52e6204d61f9b91e9f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 11.9MB
        • SHA256 7a4b0caa520f5a32cb5aa47f4f05092ea7c13ff74617bd2ed0a6771a8ae77fed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 10.5MB
        • SHA256 a68ed3557c8cdf17bc9dda27d6f7dac9ee1e546eb8a47724e8631ef46ecc96d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 10.5MB
        • SHA256 01d0e319d7162e29244f17b84c9fcd2e011ba4d8b754af2247e175d394a75358
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 10.5MB
        • SHA256 e3c5e4a45edb492e969fb98a495dfc30a84ef441a0b92600f70263233f426c1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 10.5MB
        • SHA256 2fab5d686c94af2cff802afda2e0f267ec1bd33aad2e553a55deafbb14d91b65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 10.5MB
        • SHA256 5ba14400fb11b4cf6b6af21cd26fe47583af9952b5d2d423cc146dee8770dc7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 10.5MB
        • SHA256 e3df1412f59c68eae54a723b98b6e44fefa65fe7ec8d3732e1bf6e0c06287b9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 10.5MB
        • SHA256 0cdf059c039ff7ca87c9c594a4076e71636b15263a8e5ccdd654ac243b4a8ed7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 10.7MB
        • SHA256 35967b4c06e5c2d77bd285f08a2fa3e85ae8ec96b0cf898a4d564097d36c898a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 10.5MB
        • SHA256 07680fea64b33dc53237cb27d281419084810099784e92ae78ef1892ebcf4fba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 10.6MB
        • SHA256 d9a1c9f3a8983b278a776c42bef7fb86c4f83cebb382ac9fd94ffef10b0a0e20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 10.5MB
        • SHA256 bc28a7642ba877c0af9a7fe0d23e983f95718b45b6de44ad203075891db40ccb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 10.5MB
        • SHA256 9290ef131cf675fe27b2cf20562f978a6981d3a98d84735c4139d5ea4ffefae1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 10.5MB
        • SHA256 b017c5a3af41d8e66211a3343c376e9c5b6e31886790e917abd64363e86115d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 113.8MB
        • SHA256 5755499161e65d1c36f78cb27791bff79d082fd15fb346a53d84884790996e87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 112.1MB
        • SHA256 c1d316974b59db44f1fdeb0ded3e00befa371425a8b5ef6879d606e04348e0f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 108.2MB
        • SHA256 de6d27de5ce7c4c19f3f4533199304e1bc84abbe5f3f07ca2f8ddac7462c1575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 110.6MB
        • SHA256 eb4668d91e1f7b098eb31993fc3969f612b0b18450ca810750bcd3fb14bd6c80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 111.1MB
        • SHA256 cbb907ea11c1a9f3b10710949dc0438699bdea6847ab08599ba7642accf5d8ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 110.4MB
        • SHA256 51c9c7f2be42bcdd73a2eb59beaffb9442a92a865d399c99238325782e4f47e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 112.8MB
        • SHA256 75a563bc9d318a206379b4aad19ef561c7d385dec610dfb37df10e0da38d8571
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 112.7MB
        • SHA256 0d25f22b5214f5f2d9f4cc836c580b095e037602c254f855979239d358e6875f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 109.2MB
        • SHA256 128d2efa96fc89b10c9c834e3599188b15132e100b164ac531372bb2ca851ddc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 107.8MB
        • SHA256 fb49be075b6519a264ae02edcff00d1f39360d5f3598b9a078b7d1d5443a48c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 109.2MB
        • SHA256 cb48dfdf7fba61213538b466e76f937adab102e22d509ce529685b537a7486a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 108.9MB
        • SHA256 405f80184ee66a55cd6b48f7ae7bbcd6216bd337f57ddd04dfab541cdf630441
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 107.6MB
        • SHA256 fcfb64570840fd9e1750c0e52f074bed4d54f2f991d3a82e71018682116a870e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 109.9MB
        • SHA256 04f4dcac44d36ee0efd7b43d43aff818a2ab54e93274ab8630640d42134cb58f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.5MB
        • SHA256 9f4135b77e9f740adf0ba6744fab98c6f71bac2084afd5c7da1eacb8f8ef6d45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.5MB
        • SHA256 58c569b30668b69cc47fe8576b1697d3d18f3945d6f331214f1e1716e9a9d5b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.5MB
        • SHA256 92e0ab6942675c80ef8d92be5f9eaa4df657946ed5e05c756b01f54ca8fcabe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.5MB
        • SHA256 5022f73882fbfe3fcd237f7a9e61c58f925e7617b4c2bbcc3f23952981a2b994
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.5MB
        • SHA256 f9241d51beb27b5908b7b50b5beff697fc457b1e6c15374b88773eacf1515ee9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.5MB
        • SHA256 c11c9289e352057f53f1b8d4fe97a36028b7a0ec36dce708ee624b346ef9719f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 10.5MB
        • SHA256 0cc56f63a35670382ec6a4fbdefd96a87c860da6dd8085e1c56f107bfef7ee23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download