Overview

overview

7

Static

static

3

2026-08-10...ar.exe

windows10-2004-x64

7

2026-08-10...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 08:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_a0da439541ce167bb836205615bda6d0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 11.3MB
  • Sample260810-j5zcbsvanf
  • SHA256 06ed51f5cde4f2e42d9657a3ce730f367860dc541736a63285cf2a52a06f297b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_a0da439541ce167bb836205615bda6d0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_a0da439541ce167bb836205615bda6d0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5376
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:3800
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:5732

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 12.3MB
        • SHA256 ddfefff89a7a8256c252bddba624e1acea642ff151a06d702d30e22dec0f4802
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 12.0MB
        • SHA256 10721d6a9209b7efa1ccb0f837cbc911f1da51347e7a7d30fbbd10dd65a735c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 17.4MB
        • SHA256 c2e4832af5b13690ba58ad7604bd7055e66024fd148fd39765ecda7a64e9bf7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 13.1MB
        • SHA256 cc21ed4ea9be5b0e2949fed8dad16027a5d838f2fc4a3fc08aab22bf31d78c1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 14.8MB
        • SHA256 ebb868f90ea2e15952187cec7a55c6a75d65c6253501cb6add92fef2292cd445
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 13.6MB
        • SHA256 3aab55c5d454cf286e20de596fbdecddc10a405f8f642b98331d2bd679be73ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 13.0MB
        • SHA256 81dd507d48eefb4408d9664f5b561dd35b7c1d62299134825598741551497d02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 14.4MB
        • SHA256 4bdf6fd6a3952e7f0529e44161ab97b17b92e59f9ba0fe80ebd283ea668239b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 12.8MB
        • SHA256 eb8283f60942c5427b687a196899d3c124136c3aeeae0fe23216cfdbcf9e04a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 11.4MB
        • SHA256 1dab41c9588f083b96e109a187a48c997cb2d2da5ef661859934b45cb8d555a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 11.4MB
        • SHA256 e9c60dbb11c1d0b95d3fb827684af1ecc0eb1aed79d9906d36b153bb9f571880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 11.4MB
        • SHA256 df6075e2058e33a9667548cd1a378425dd3850d4ca444fadcc7735d7532b4e8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 11.4MB
        • SHA256 18ec17077423b10bc497f934c4d09d91083b3d3d328d7ae3778f2bab7555de54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 11.4MB
        • SHA256 b797f02a7f41138c29e12d609e766a64803a207615ac557832a5a91ec4ba6313
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 11.4MB
        • SHA256 9f2a89382a9096ed1ea86d1ea3f8eea6a88dfaae7fdedb0cef2ae28c13834a11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 11.4MB
        • SHA256 fa2181b7708a8b6afb97868b3586cd3f8ea1c135b7a5864dafecde264aaf52b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 11.6MB
        • SHA256 04e2de000066befddbcc438896d4ccc9dd9393eeee86df89a1b4043c00ac626c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 11.4MB
        • SHA256 5e5033752394d271f76a4ab8222676ecc778aa4bed150162104d6ef471de7963
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 11.5MB
        • SHA256 3ee75acf5d571ee863adc63bb40b2ea93c14eb9d806f92bfeb5baf1ae1ade0c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 11.4MB
        • SHA256 28752174d0bd4cdd285fcadfd8f013a21b0d2a9d2d0ec3bc0b8f306af5d0516b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 11.4MB
        • SHA256 db6da35cef81f800850895133ab5859130f8873632b80fe4791cb3a3d4c8128d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 11.4MB
        • SHA256 bbaf7180d6bcc68c98a61a94c5c6337972dc47d9627edb37a47bcfea63f764e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 11.3MB
        • SHA256 06ed51f5cde4f2e42d9657a3ce730f367860dc541736a63285cf2a52a06f297b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.3MB
        • SHA256 b6272d52917cb84dffa08b11b09753b8dc4f34457f60721b1d53b0eeaae7b7cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.3MB
        • SHA256 ba7c372ff11e41343a6c375300fc9ccc1bd504af07d2eb10fbc514a2e47f5a2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.3MB
        • SHA256 3af2b8d03f2e9ed454b130c204b7c91675bce5980480f2ac1810094806ff21b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.3MB
        • SHA256 1b4e86d4c1a5c532ce69081fe61f2b57556c2aec2331072806b496d01e3e2b3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.3MB
        • SHA256 27b477504f36cc9490e72ca65319b652cf7ea5c49111eea7471e22267607376f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.3MB
        • SHA256 04506804a57109bcbf2b40f5707af202cecfe8753ac13c79b082621104b85638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.3MB
        • SHA256 39c7a1014703fa6def2cc45019fadb816f1b7de3c2ac808a3f5111a6bcb3455e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.3MB
        • SHA256 b636fbc5316dfa427136881587446edaebe534bb4b6f0d6dc590829a9e731f2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download