Overview

overview

7

Static

static

3

2026-09-08...te.exe

windows10-2004-x64

7

2026-09-08...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/09/2026, 16:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-08_63909590c54c731a7840cc454cb19b67_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 9.0MB
  • Sample260908-ty4ctavard
  • SHA256 039a7d9881aba9215cd4235d0bc9413e769f9df34238c53bee1ff018bea07d41
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_63909590c54c731a7840cc454cb19b67_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_63909590c54c731a7840cc454cb19b67_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4568
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:4192
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5908
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:5056

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 9.5MB
        • SHA256 758ac193f00a6738c815d45aadf8e640c800803a4031e368cab722fd87adf126
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 9.9MB
        • SHA256 5dc04b2952c9627886e04971f038e41b6df3e0021ed27d2eb953b0aef5678521
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 9.7MB
        • SHA256 5932a4b3c6d2019083ab1f9eee2b701a74e6a213a2295660c67c34d029d54cb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 9.0MB
        • SHA256 74c5d88891f2172a03b408c80c1eba88ec643e125588fde534750ec36c28776a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 15.1MB
        • SHA256 bb4c193b8039f8d9db0ee2cac9be93d88e95caf3b3b233ba7115da3a427c0742
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 10.7MB
        • SHA256 4c62227693d69077c7719d40e18acecfbd40600d8378ea626ebb74246a70d3a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 12.5MB
        • SHA256 6b61ba5d8b2dbb563a88ee0cb0bf692ab6c948bcee5693cc550fcccc44293f1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 11.3MB
        • SHA256 5ba844bbf07b4807f99f562a504b7eeeb1024a10ba35c7c584631fe5b34d8cc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 10.6MB
        • SHA256 a51f8f45ad96500c96fe51ee833cc3b44f94409aae7d61755148ba884793545f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 10.9MB
        • SHA256 5003cc63a70264768bed8c4147a05dca63f988accbceafded9f69db8ccc63e02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 12.1MB
        • SHA256 ef227682faba4b2a716712d90a0a3aa7352c013e4fd64fee5293f09ac8e169e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 10.4MB
        • SHA256 8b2c37f9d81bb797fd87117870b1628faef119188397f9f10e36cfaf4eef2e98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 9.0MB
        • SHA256 1775c9f2e704bb0505d08cd52a75ab42ac66d7b43a8c3c3a65a88ab9c231e912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 9.0MB
        • SHA256 d24f3c13e780f0c5be7745189cef7dceb1cf6c55efb956fcddfbf773c9c8c4f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 9.0MB
        • SHA256 3aeef8094473ce0c72e24b402fd70d8272d7c5d7499be4ec1bbfb8afdf7280dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 9.0MB
        • SHA256 88f62e2158e228ffe51a03fa90773522a327d68738ab7b1251cabd9c1f371120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 9.0MB
        • SHA256 7c2e4465f8f2bcbc934089c3a261c1f262717faad084a6a348ee9b45020eb4ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 9.0MB
        • SHA256 60e9252ea401bd2ae5597922fdc0c83302ecc62ebca4324a5cce4b80b510148a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 9.1MB
        • SHA256 b64bf722dca7aeab1a9140d5eb01bae2d4a8789f484dbbc4262d88976645ffab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 9.1MB
        • SHA256 4ba516868d43103eb5c5e8fe853b038d244b613d9694d33048b4b5dd507c5c1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 9.1MB
        • SHA256 dc20d6cb54015261225e7d95a883f41c9cc2bac75c72dea253f8463c3e4a31ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 9.1MB
        • SHA256 4b38706f55ec9426672cdd1319f6e4df9699e4adecc9282f0ba6d0201f676c3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 9.0MB
        • SHA256 039a7d9881aba9215cd4235d0bc9413e769f9df34238c53bee1ff018bea07d41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.0MB
        • SHA256 138b9b97a05f1134fc554fcab1801ab4fddd025d980d58bcbf9d51049f6c5e00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.0MB
        • SHA256 c5ce0d2a31cfac0cead3ec04bbd652f1443f63adc13cc9493a9e34ba5158da6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.0MB
        • SHA256 323b6c3cc1db1741cb3f9e9f64ba0bc09467b176bde0da3003985218d8811e93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.0MB
        • SHA256 9f1d8ada7764c22c05fa47328ee40b7ff4d65817320f2bf0a5b57bf7876fd371
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.0MB
        • SHA256 7ea1cf4129375af6d475d212b46b11aa18be3d314115fd36150ceeddcfd8c68e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.0MB
        • SHA256 ab25dc0b2e57fbd2e7ea8ef68f3588ff0147536d1696fe8f345c017606e0e2f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 9.0MB
        • SHA256 8bc0ab9a2a485bf190122ee0b38894280e17aee920b544f9aa0b8e79512d4687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download