Overview

overview

7

Static

static

3

2026-08-16...ar.exe

windows10-2004-x64

7

2026-08-16...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/08/2026, 03:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_cca4fb9f1fc0e64b3ff3e998bee20db8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 1.1MB
  • Sample260816-d8qlpscm6v
  • SHA256 74f14632d34a8ea1290bb2d2b4e6d3eedbb46be172656a70b91618ee7319e781
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_cca4fb9f1fc0e64b3ff3e998bee20db8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_cca4fb9f1fc0e64b3ff3e998bee20db8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4012
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:5052
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3452
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:1892

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 1.6MB
        • SHA256 624112e709417d104752037c1a98e26dd4bfc645dbf8c137337001a5481e59a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 2.0MB
        • SHA256 e055c8be8ac3a41f2306c7fca5c9d0be02b4d8dca86de7e375cb652cbc55a45a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.8MB
        • SHA256 e4c22336802a26c9fc52e79bd8e945fc525370b8fef97805d31f0521968e94ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 1.1MB
        • SHA256 1a31ddd15064e4aa857c21e354bde0b89d93b22ba36694411cb9440f9f75352e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 7.2MB
        • SHA256 58694a114d76eb2dcc1ea791043ae7797dddc78f0f98ef95829087f500ae52a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 2.8MB
        • SHA256 13e102a06e68158dd85055edf484165a04c45d687cb241644440478fb869cf08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.4MB
        • SHA256 0ccffa3943f15321a90b48bcc7d80e7adaa7480498bfdb179105bd7a067288bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 2.7MB
        • SHA256 30c72650edccfbf7a2b25c360bf5173b5d198cf664ff115e213ac7e8de13709b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 3.0MB
        • SHA256 b5cbfcd40f8ad64d99768f7ae8096678f2cb2ae841f2f2eaafe3363941558aa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 4.2MB
        • SHA256 29b3f0cc15b7abe3ab584661a204ae8a072f1f72a1868d2bfd8028a3fa2d3465
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 2.5MB
        • SHA256 25b8dc72a4120d34d5f4536ef9882a7a696382fc9536736ac5b49ab670e450fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        HideWrite.exe
        • Path C:\Program Files\HideWrite.exe
        • Size 1.3MB
        • SHA256 1c80a984dc529e0835559eb383dc4339498b1b6ddcc39ce9210f4e85edee99ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 1.1MB
        • SHA256 4a2d3ff713896611c5c6b7943ab66fc8c0c680037b66f03169472b264a505e6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 1.1MB
        • SHA256 bbee7d5cb57dcaa0fa7b5f7f5565b481b7221a727921ef5bb586cac0436f91fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 1.1MB
        • SHA256 b322313ac06be97a12b8a7ef59dc10ed20f919d951fe319539357fe56c7ccbb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 1.2MB
        • SHA256 496f7a9d46930bf7a60a6505aeba12f148a064dff51f913f6d952ad9f0e091fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 1.1MB
        • SHA256 593902187c4812225ee09c21ad8573eeba6977442f686fee8c01c390a287157f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 1.2MB
        • SHA256 294a63cb2cb2a111004b116b3672538c9bf6be4c8782bc709bcfe8775e0761e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 1.2MB
        • SHA256 e07579468ca0859362f96c7d52f0551734eafeaa21d1e955637b00b5bc5d184e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 1.2MB
        • SHA256 efab5a9da4d94aaf7cf258e49ac29b5d52e298f267e3b5b21c5c276614627314
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 1.2MB
        • SHA256 c82b79db46edb42f50e684da74865269f2d095c7875f5496acd70ae83450f445
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 1.1MB
        • SHA256 74f14632d34a8ea1290bb2d2b4e6d3eedbb46be172656a70b91618ee7319e781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.1MB
        • SHA256 7e3a2b369b9112799c4052fa756b3bb33298f2d5dd196dd87c021ff5e268864d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.1MB
        • SHA256 b2d94b53d9352624748356025fd4003010f35ab65630b44b130ec8d2afe69ce1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.1MB
        • SHA256 384b3207e82945394fa7d0d17edd495eb5985d6a20891cbabea73aab66e8ce02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.1MB
        • SHA256 71169b37c9d63cf0dfdfcffaf902bd4bc35c3d2823338bffdfc147d379ebd51b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.1MB
        • SHA256 280d2db4c2f3502cc4de001f306b0f9a1804c2ced8cfb7e319ec8e2880e49c96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.1MB
        • SHA256 9085e172877c2de197f84445facef63ea59752fc42e220fc640659db1bf09e5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.1MB
        • SHA256 d10598893f39e91751443d89f9e48fd962e7bcd4e577e33491fd1e1644ded3c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.1MB
        • SHA256 c5841995c855ad53036375e07afde667005524a4f00f3b8f9c588cab731735b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.1MB
        • SHA256 da401ac6b50cf629e75df7099aac60a1e0e159c6eb9053eec62cc0a0b7ac97a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download