Overview

overview

7

Static

static

3

2026-08-28...ar.exe

windows10-2004-x64

7

2026-08-28...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/08/2026, 01:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-28_f534664a64dd4d8109cab84f792ad2ed_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 11.2MB
  • Sample260829-bktbksvves
  • SHA256 a566abb31aa7dc1e7577ebb92d1017d4379a36ffd4138f357d1414bb2a1e1bbb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-28_f534664a64dd4d8109cab84f792ad2ed_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-28_f534664a64dd4d8109cab84f792ad2ed_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1868
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:5504
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4616
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:2512

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 12.1MB
        • SHA256 e39a45664d137c29d4ab1063d2efcdd1a7d543dffa3b78f776e5938516d16be2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 11.2MB
        • SHA256 61e6c46b20c158e21dec5f5951fd0f2af4421b481ae00b774f4349643189d2c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 17.2MB
        • SHA256 c913ae683ff9cc8ad0dc00d2ea4bfe8226e7bf770208a087a2471cbd3dff3783
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 14.6MB
        • SHA256 b1dcf12333ffe22da1e762081bedb2a087c04b09c86009f4d2f8286c4b9fc5f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 12.8MB
        • SHA256 8b335d926d5e2b5729cfd423cffa5e910083e99a5f43191db0e2743342b07f4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 14.3MB
        • SHA256 abb03109ea57cb7f87d3fee2b2f309e604256e320870c2b0d6823e3c11e89655
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 12.6MB
        • SHA256 7235c2813264f9752ba6cd84134e92f8e9fb0d4c111e4c9c52146f42f508c309
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 11.2MB
        • SHA256 b2ce6e7c7420cfcfa84006bb2796add802ba1e61ed2af11d8fa41637cb55ca3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 11.2MB
        • SHA256 d7095289ba678b47f1926db969ea3ce6d8c03b2f3f7a894850bc586d83a7fc1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 11.2MB
        • SHA256 768d6ce896f63293dd5188f3b1d8232961ba3aa56c73d3d66406ace3e1576968
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 11.2MB
        • SHA256 be981fd075ef6a8db4fa7c4cd9a650bb1a25dc39bf78d3d8c93ade63b0a17ec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 11.2MB
        • SHA256 a51b2f3ebf64df3503ae05876fe1fc0cc2672b68ca01968f4a9ec302a14a87ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 11.2MB
        • SHA256 f025d3016ee9b36888d557d70c1710c499aabd582ee182ad41cfd0170cf6c5d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 11.5MB
        • SHA256 789db8cfb0733c16faabeed172eb3b7595fdba8277c7bea8e6891790130b9241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 11.2MB
        • SHA256 6f3133935d75421d4868bd973f9a8618450cd0413eaf1245087f9b896875cf8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 11.2MB
        • SHA256 a22ef084d6f70087d5ea4aaac1e2c02b48e8faafc93a1f698e42ad82aa23b830
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 11.3MB
        • SHA256 1b70f24d937374ffb7470cd45ff0286c5bdb09e1a2055d3fa5ed859151b23910
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PublishRestore.doc
        • Path C:\Program Files\PublishRestore.doc
        • Size 11.6MB
        • SHA256 d32b33509faa651b002602eb9fc3f9f317d3fbb837c3f3b2ee90b1463df005cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 11.2MB
        • SHA256 f00aeb7dab15170c7315e251190391844790e25a0073e2c34f9c091e32ea5ce3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 11.2MB
        • SHA256 3257047342e610cc7b1e1c47f9525f3ed61aec2c05f347795cb13d7bd7806508
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 11.2MB
        • SHA256 1a1ed8c90c68c88ced18c392b2ddb62158263b59f3f3877137a0d0edf108f342
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 11.2MB
        • SHA256 a566abb31aa7dc1e7577ebb92d1017d4379a36ffd4138f357d1414bb2a1e1bbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.2MB
        • SHA256 828d13801657f1c0d83d920a2fa72584533955a344bb427b222dc6aa5432b921
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.2MB
        • SHA256 e8b5fe03adc41dc3e9dd77b5b9bffb184b47c7203a51d94525da3baec1dc0a4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.2MB
        • SHA256 a093e88bab2b5666591749f97a4b826c67f391799d917a7a27290ae7cfdab266
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.2MB
        • SHA256 6b251970f2f44433537fc81594f8d89e4533aace9de8fbfcc758b46ea6969f56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.2MB
        • SHA256 7f08c94d9756f60690555736beed3f4968726fc33823e8c0b6d6b17cb37d312c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.2MB
        • SHA256 d676607cea72d195c7fc3c96c4f83a6413b62a4a6486787e052c3cdfabd61239
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.2MB
        • SHA256 66173ec7edf7f26ffc6f6db10879029731e15c979e7eed7c9b5e991c8d8efe49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.2MB
        • SHA256 82f918da1ab58e2b4091ad78820db9d6fef40dc4f61f5ce60ce74d788a71dad9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.2MB
        • SHA256 21db85717e1a0bc265dd8df0e97b7bf6342907177e7a790a2f8462772f0e83b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.2MB
        • SHA256 306f1c7da77ca34f20117b46b9569fab5490288bae663da842451bf4e22d301e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~8
        • Path \??\c:\ntldr~8
        • Size 11.2MB
        • SHA256 8239636d1299190540c61d3abf88d387e46a35e4cf0e5f4d873200d24039f2cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download