Overview

overview

7

Static

static

3

2026-08-19...ar.exe

windows10-2004-x64

7

2026-08-19...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/08/2026, 08:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_7b44826b5743a957942595797f9cc88e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
  • Size 5.7MB
  • Sample260819-j56fmsgj9z
  • SHA256 a78900598bb3743748b01d935e6c5e3871cc4a5bafc98ea90f3a64d79242af37
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_7b44826b5743a957942595797f9cc88e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_7b44826b5743a957942595797f9cc88e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:2468
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4152
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:2172

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 6.3MB
        • SHA256 9e8caf8c81f4e8521b0d9a7a6f858f9b55c1743ed0d07e35de32d2dfd7caf896
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 6.7MB
        • SHA256 f4d5fb11224635bd145fdcc0059654342b8af78955495f98717b8a66edc28fa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.4MB
        • SHA256 68aa9d7e9a743034ccb2f8c6a49297d9dcd03134016e69bad53596ab2ce3ae16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 5.7MB
        • SHA256 6b91622b79a750606f7b194d43a146c55f72dcaa9af61613dabd6eb7378c8570
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 11.8MB
        • SHA256 6475335c57158fad0200f1728b084715925b0a535386d8ed9e486e1808a31e38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 9.2MB
        • SHA256 2fbc36417f3a0708e25f5b82dbf0dffc47b7783633cd346e4f5f6e8d54ef7271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 8.0MB
        • SHA256 e7fd3dca2145209cea4209362a0d67a18b0bdfcab00992dccc264748c31687d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 7.3MB
        • SHA256 da273e56d65848ade682dc4add3a6f826e78fb6d3055c591896589f5d7632ff9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 8.8MB
        • SHA256 99e8b904fc11d858f2f8b4c597f8a67b1905907a4c618d9965f9b9bb1d089685
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 7.1MB
        • SHA256 bf35f8b7e011413b69a5760c71cece79a117a00212921e42c95ac701b04ef3be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 5.7MB
        • SHA256 ab5fb077db842b973991befd1449d5ea5c6ae4f29c1df5812603f81e18ba46eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 5.7MB
        • SHA256 2f6ef48bf5c82313b6b8b56d2b984b1b467836b60809f27bc7e674a20f3285b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 5.7MB
        • SHA256 cbd36a7be8dfa8c9bb7d6f3d81a47613d9287fe873d1e1f7d45205b7de846136
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 5.8MB
        • SHA256 9d678afe707118b1c1dac5baded3118f3701d6ba812d6c183fac3e3230637dc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 5.7MB
        • SHA256 3e4179f81cf776e98b20e3c28c4ac166471fe145b4163210e61c614ad903fe33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 5.7MB
        • SHA256 a34a1d096140e67494d11a88c1f602f4b65958e2d8d893e3d3037ff1c0d10d84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 5.7MB
        • SHA256 e44017b3e59cbe2360a871b3c4400e9de6f18f2be3036d3a83bcd4b60441202c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 5.9MB
        • SHA256 d2cce1063990e94a5237f23033a09aaf80b2c42af6b691ab586e8cc299973290
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 5.8MB
        • SHA256 b90a77c71381a80d8599495e7a2c4a32f52ef03c27149a7ff4ac95b5a32ad683
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 5.8MB
        • SHA256 735b63a238d12ed130b7690720921780b7ca58ccbe7c890bdf0432874cdc74af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 5.8MB
        • SHA256 86840962d2d452132cdce7661010f2725938530e7bc60829373fed156eaa5b57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 5.7MB
        • SHA256 a78900598bb3743748b01d935e6c5e3871cc4a5bafc98ea90f3a64d79242af37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 7f69f099600f26ecb70725cc9430eefb97febc2da5a5da2ee7ad22ae12412462
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 26568abd968feed1900475a5b207fcd481406095671b9967591adf328c7a3334
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 42eebafc070f83979fef7b46ba07e89526aab0880ff640e7439a61f92252fb54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 67ce1aaea042fe8410f3b0fd7bfb074dc8c2b427ea0f4e2ec3b732dddf138b36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 eaecc8bc9b2f8d242d8dacf57eb2e414112378c3c0169faf3edf6c097764a51d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 248c7b9b90e7ddc5b60d890683633f893f139e45ef82059b7d5b026143451ec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 482de14c5b7daf4b98bbba4d83d0e2a074ee51ca83e62a9707dd0425298e00d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 08cbe33ec26e9416561f5eaab3487cc51d0d1185173e45a1bd9f75045eef87c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 6d3cd5f9037c055458f863f0660957f2fca1fa4125fb577dd4479d28d8e4f9b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download