Overview

overview

7

Static

static

3

2026-08-23...ar.exe

windows10-2004-x64

7

2026-08-23...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/08/2026, 06:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-23_87da1b85b5faa6341780e9ae206de7ed_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 1.8MB
  • Sample260824-hhzh5stepf
  • SHA256 9b49493f31bb212d2e98abcaf9fef6eb3189095d88f14a6c77c8e334f6cf2d07
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_87da1b85b5faa6341780e9ae206de7ed_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_87da1b85b5faa6341780e9ae206de7ed_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3544
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:2148
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1564
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:5216

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 2.3MB
        • SHA256 e0f12e4cca8e80f911343798455beebda619798f2e9cde2269b8830b092b5efa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 2.7MB
        • SHA256 1602c96029d5a25034e532010d174c1ee731274dba8ab9bcbd753ed048c00d05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 2.4MB
        • SHA256 e4c53dc392e8a0da14efb2ea83f972a33220c5b54993e1fc17f974ce69b78bc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 1.8MB
        • SHA256 8fdfcbceb2f19d99ac558f7341aab987942d0bfb7c3a3911f7a2e7436393b5f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 7.8MB
        • SHA256 02362ae9d1f3d80d503eaa4341cb24400be0f6a3d0fffc0939c9f4e1a85e595c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 3.5MB
        • SHA256 0c58d526bb7afaa9695086ce26bd999b979103f440ae54382fde91f1450e0fa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 5.2MB
        • SHA256 37a9e85a50b1c76b51cd176901a47a88084ead588e40e8951ec07461735d3f17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 4.0MB
        • SHA256 3f9f09363018724eb0b0ea5431d8f6158e042b2af8205e5ccd2de1e922a4a5fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 3.4MB
        • SHA256 e04d876fd4a5e0cd5fbf9a455f07eba0b086bcfac4182d0b5a6af6504dccaa13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 3.6MB
        • SHA256 462eed06688cfdd4bc2dd03bc22ae3083998e0469504e860d2c2cb610b1a1e9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 4.8MB
        • SHA256 987b027a1c931c2a467d318f5074e9657595d32ad1600c8fa498d62e78abaeda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 3.2MB
        • SHA256 b4c4b61f7b23926c607e73f1a529ca22d6e118a8a853b4831a53cd219f4656c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 1.8MB
        • SHA256 b07989e65c15b6adad27f0677a5fb9de09356b5395e82bb241f994efdc1c8fde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 1.8MB
        • SHA256 af818baf7ec95af49701d1cb7f103ba561fc2c026c9fdd0f46d2bfeb9088eebf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 1.8MB
        • SHA256 01385355216c3be6e9039a8c3d1bbad6701ed4c5f1619de0c2060a60c8c6e4de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 1.8MB
        • SHA256 2dbe5f131a4fb091f40c0e5519f00553671c85af0f05684ae6ae89bff48addf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 1.8MB
        • SHA256 9430ebd19dc809afe01fb5216fe155f90e56ab651cbf96c42af318eaa6dbea2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 1.8MB
        • SHA256 6bb6f0b9cd17129f22092b70f6c6020db5432119a4c18672032807ef9334b113
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 1.9MB
        • SHA256 bf118b0322427640665f75324d492ca14d19f03b2ef4ac76f9c850354e2bfe8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 1.8MB
        • SHA256 427bc4f52ad75a7aeaccd29a32ebda1003e34cd86b216e394b24855547531ce1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 1.8MB
        • SHA256 7306395102ae403c61669993cf509028304d3d2a1768a24304aa6adbdef05934
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 1.8MB
        • SHA256 39a2e5b761a18bc3fd0f247255df74967ad318128d4b982ebfb76ea1ba6e7fb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 1.8MB
        • SHA256 9b49493f31bb212d2e98abcaf9fef6eb3189095d88f14a6c77c8e334f6cf2d07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.8MB
        • SHA256 bb9fa08e735555b223143756710641c352ed83b32d06f14f86ff8772c5b1db38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.8MB
        • SHA256 de8724b2bfd230e8f433a04189ddecbfc01ae07697f77999b4327a93d3fe2874
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.8MB
        • SHA256 bc83ca0650755d581bc2e1a41256d58a08b5860fc2c7ce87ca77b6469de79d23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.8MB
        • SHA256 a4d43d7853d1accfc5bd1785ec779d85fdf84cead9e23bb72936bcf56ac32586
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.8MB
        • SHA256 8b6a54e2039a4dafc730a5f4b61a3a289d3eae557ff6f9705595984d42713f11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.8MB
        • SHA256 6351fa2830fccbaf983ce81f258b0f0f49e617b10a243626a3d70213940c65a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.8MB
        • SHA256 23a07a11e55109ea77ea917536e47e1752e597892576dbd2650a91afcfe199fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.8MB
        • SHA256 5b3242d5dfe18c45aa308b3bf9f2b4cda5e1717650f02638258bc489b4d24529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1.8MB
        • SHA256 4ac0dd726a5188c9369f7d94995c4ff6955af64e9b5c79f30b3e279d9226d1c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download