Overview

overview

7

Static

static

3

2026-08-19...ar.exe

windows10-2004-x64

7

2026-08-19...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    27s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 08:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_7b44826b5743a957942595797f9cc88e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
  • Size 5.7MB
  • Sample260819-j56fmsgj9z
  • SHA256 a78900598bb3743748b01d935e6c5e3871cc4a5bafc98ea90f3a64d79242af37
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 40 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_7b44826b5743a957942595797f9cc88e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_7b44826b5743a957942595797f9cc88e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4568
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:4088
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4728
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:3704

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 6.3MB
        • SHA256 9e8caf8c81f4e8521b0d9a7a6f858f9b55c1743ed0d07e35de32d2dfd7caf896
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 6.7MB
        • SHA256 f4d5fb11224635bd145fdcc0059654342b8af78955495f98717b8a66edc28fa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.4MB
        • SHA256 68aa9d7e9a743034ccb2f8c6a49297d9dcd03134016e69bad53596ab2ce3ae16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 5.7MB
        • SHA256 6b91622b79a750606f7b194d43a146c55f72dcaa9af61613dabd6eb7378c8570
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 11.8MB
        • SHA256 981047a2d1d3d402b63cfb112598bcd85c6f97c6805f53fc9aaeda493832873b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 7.4MB
        • SHA256 bd769d3b32330b7f7472dec15305d4107e177bc980137f00eb43126af81438f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 9.2MB
        • SHA256 dbb8b20011adf68df8d5fe72b8d96773f5046e4723e13de3eff06135da0c41ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 7.3MB
        • SHA256 184697d8c434a877ef3b8bf4a05c20926961967d9293a5fb79de5f098dda2d3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 7.6MB
        • SHA256 6e5e98e35a854865028fcd4a0b7943547f66f1b5b067bb0e18464743881f238a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 8.8MB
        • SHA256 29ac5606dcdcb73ba2c9d85704362eb8588894fadc994403f00870bb0d2f0bb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 7.1MB
        • SHA256 39600791fe932badbd9b90b4d8d78c83d99d8bd266e2200ba200906ffe2d9e25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 5.7MB
        • SHA256 ab5fb077db842b973991befd1449d5ea5c6ae4f29c1df5812603f81e18ba46eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 5.7MB
        • SHA256 2f6ef48bf5c82313b6b8b56d2b984b1b467836b60809f27bc7e674a20f3285b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 5.7MB
        • SHA256 cbd36a7be8dfa8c9bb7d6f3d81a47613d9287fe873d1e1f7d45205b7de846136
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 5.8MB
        • SHA256 9d678afe707118b1c1dac5baded3118f3701d6ba812d6c183fac3e3230637dc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 5.7MB
        • SHA256 3e4179f81cf776e98b20e3c28c4ac166471fe145b4163210e61c614ad903fe33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 5.7MB
        • SHA256 a34a1d096140e67494d11a88c1f602f4b65958e2d8d893e3d3037ff1c0d10d84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 5.7MB
        • SHA256 e44017b3e59cbe2360a871b3c4400e9de6f18f2be3036d3a83bcd4b60441202c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 5.9MB
        • SHA256 d2cce1063990e94a5237f23033a09aaf80b2c42af6b691ab586e8cc299973290
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 5.8MB
        • SHA256 b90a77c71381a80d8599495e7a2c4a32f52ef03c27149a7ff4ac95b5a32ad683
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 5.8MB
        • SHA256 735b63a238d12ed130b7690720921780b7ca58ccbe7c890bdf0432874cdc74af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 5.8MB
        • SHA256 86840962d2d452132cdce7661010f2725938530e7bc60829373fed156eaa5b57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 5.7MB
        • SHA256 a78900598bb3743748b01d935e6c5e3871cc4a5bafc98ea90f3a64d79242af37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 63.5MB
        • SHA256 297d77ce085d8952fdbed12d134dd0f4e7ab0a2c63dbe6b593e3ec7f1f9452d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 64.9MB
        • SHA256 8654aa13e83fb827cff7034404ec7768cffff1389e368549bb54dad14f9520ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 62.2MB
        • SHA256 cd0613410de5d0af971eaeed7aba1df21e6169ac49708e40cf94afaa4e64f89f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 61.9MB
        • SHA256 01be9b1a3af9e16fd882303a9a2676ac401088384c7d329f968e1cc5c30b21f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 61.0MB
        • SHA256 f88ddb2061bbac526765a851d5547a5a0e0a5a2d81e1c3e36f3c46987b2c6e5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 62.1MB
        • SHA256 304c98d6743eb0d3d197759245e8238d5b0c2b0ce02b0d44ac2c6beff5591a1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 61.1MB
        • SHA256 457176ca197eda2f91f1606c5d82802ce7fe80827e4ac1d39cf8814126da1a0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 62.7MB
        • SHA256 e449e5fb24ada71be4d42a9767978ee5d97dba3460622a045a18cadc13220a49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 61.6MB
        • SHA256 45dab388e5d9cb19dd5fdd36ab695b6171261ddb69d3be5691f778082b25f2ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 61.1MB
        • SHA256 31f1bd4b255c3c5a7c943bdcb8e5936a84ed63f49629f8b1f3603e967821d5b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 63.5MB
        • SHA256 112377ff662c7003ed8653f68cc2830adb8164cd33b90fe1cd89f6e180bf6c0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 60.4MB
        • SHA256 eaa31647abe9fc7ac9f0a934743288ab81166e866c68f7c0eb8c850aa70cf724
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 59.1MB
        • SHA256 ccf45e305b38bbb80f3a975800232903f0d33bb9fbc08f4a2d1ea99ce8db9e82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 62.2MB
        • SHA256 2133193f6579c24f2e24cb7fde64c2f99fccd268debc4b917b17b0053053841d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 60.7MB
        • SHA256 20d582c5e939549b5b472bfab34b9733a0e7367c40abe134b534bce813d83d42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 61.3MB
        • SHA256 6ca0403f9a92d0886487da6dee332484eae12d1ecb73f9c0c709ff7bcdd965f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 62.2MB
        • SHA256 68c51187bd536483740da9307a4dd3c03f0aeee2887331b82954a267694c769d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 60.7MB
        • SHA256 8f565517617c74567e6b26c21d65de684482865cbd9f7275a6ee4d682d2e5396
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 26568abd968feed1900475a5b207fcd481406095671b9967591adf328c7a3334
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 42eebafc070f83979fef7b46ba07e89526aab0880ff640e7439a61f92252fb54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 67ce1aaea042fe8410f3b0fd7bfb074dc8c2b427ea0f4e2ec3b732dddf138b36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.7MB
        • SHA256 eaecc8bc9b2f8d242d8dacf57eb2e414112378c3c0169faf3edf6c097764a51d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 64.9MB
        • SHA256 9fbf9890c7b51e8c8650dcecfb2b9dcd67ae847a778877a80b3aa2bcfa45c5fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 65.4MB
        • SHA256 04b274466d73f6b916283be6c3191e8021598c73ac8d96293cd0d8f51ef5783b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 63.8MB
        • SHA256 6187bf71da0b2c072f59f48e361acf1bd40463e0457a3b0563e252979893ce40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 65.1MB
        • SHA256 a3b1aae52a20eb162384e686c72a8babb82dd0d1763234009f2127426d702e94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 64.6MB
        • SHA256 0b8afbcef43151429fbfcea1d4685bb0a9a49160d869d364fa6c733125f8beb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 64.6MB
        • SHA256 0e8a7a917b09b77626ff97d7cfcb627d879f6c864f34cd69cfb92bd9f0272d90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 65.0MB
        • SHA256 10d154fb1aa8031d01c66bbf7cf4e48b05a81b5ad31326c9f386e0d2b50936f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 63.1MB
        • SHA256 b37f832e7b3eaefbbbd78b8318fc0301f164a2152ad7dca877d58bdda22dec00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download