Overview

overview

7

Static

static

3

2026-09-22...te.exe

windows10-2004-x64

7

2026-09-22...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/09/2026, 18:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-22_997f33c2c363c9d5bbde748ea1d5ba2e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 11.8MB
  • Sample260922-w82m3syscx
  • SHA256 7cc95c1358f7003e4c447c50eb3c3b988d042ce6c004e2881355994ca663930b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-22_997f33c2c363c9d5bbde748ea1d5ba2e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-22_997f33c2c363c9d5bbde748ea1d5ba2e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:924
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:4832
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4872
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:2240

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 12.4MB
        • SHA256 fc9aad118f14fbecfe3764acc85fdfd1865f25832eddb7c9b96ae95644445d71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 12.8MB
        • SHA256 6869847068c09bb4be705e16919f786bf5d17e9830df8c002eb28405ae6db4fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 12.5MB
        • SHA256 b902e7911044dbd0f0b021bbfb1920504683e560bedcb944f0896851f72ba960
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 11.8MB
        • SHA256 f671714adff5f730d7eaaa23e460d041f2df746ddad74a49c95563dab112de66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 17.9MB
        • SHA256 5bb6cc6cfc2df1985b3165b9e9691df08b7ac657f05215579495aa910eb41387
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.3MB
        • SHA256 f40f49900c0ebea00f9ef10edadc2c7599851d6689df3cf5a392177f9c089b6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 13.5MB
        • SHA256 c784e8c8a606f246f5308a4bd493442a2475c9e17ab131ac91ca8fb1f75d0703
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 14.9MB
        • SHA256 b7c3dc12e65cf3c39a9fa6bd1f6c846a44a1260830c5bece092660e73cadb142
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 11.9MB
        • SHA256 0a7d88566423e5bcb57908c0c085ba94e8f582657af774267db8297c0f86da9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 11.9MB
        • SHA256 6b6ccc2b26d95f3c8480bcfc33718c2ab0e684dad8f522b380211aa0881bd092
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 11.9MB
        • SHA256 a9d313cecd0ec5e1b577769764ea03f6af8337313b2323cd69006bb005ca99bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 11.9MB
        • SHA256 a3a69ead5bcfd92365e91430b39788c4bbea43be1d30393e7db53bae10650b89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 11.9MB
        • SHA256 02f912eeff9434a41d83bf7a160296805bc69ad4ec14fd9e3709e9c1eb409d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 11.9MB
        • SHA256 14208a2a248073bb39bc33dde8c8ad93c0de224dcb239b8174ffd58ef5ca5fc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.1MB
        • SHA256 ae75a791d91605bad4db01fb4bd33875dc9e16f230b9d798a45dc53c9f9bf5fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 11.9MB
        • SHA256 ce81cca6d00583947f94ff8680144a0fabd3ab6092b3594559552e58b7eb148b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 12.0MB
        • SHA256 8973769de60317247897731142bc452fc3c175ebd2234074ae03eb418645317a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 11.9MB
        • SHA256 d4292dd1a38cd1e62728ae7e990ad95d5962477f6a5ab1b796907a168449d84f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 11.9MB
        • SHA256 94d2ca7d05840ebf32e64c2499660d9b299dc3dd20f0fb477ade160bab15fdc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 11.9MB
        • SHA256 5625196ced2384d6efe6c180727ad40d38a8c258c5625f29e166b8c1d5e2b068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 11.8MB
        • SHA256 7cc95c1358f7003e4c447c50eb3c3b988d042ce6c004e2881355994ca663930b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 3f6d40416215cbd86cded99e30b7da70083c97f48f304cab8ab18dd55c892007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 782576d18a61848d321260d890be8f1eb112328e6d4fa862c2ac5b34c3d052f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 aeb83e77f70f29cc4de8b7cdc073b45f982996ea51a8fa41bc02439972fa370c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 e5023e7302bb7929327db9bfa7fd66fe060709d247875e8abc2bb9f188db79f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 78d15e1ff477cedc9d2219def4334b451f6cca5fdb77dabad60d6b98e6ea6952
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 e2d429320bcf6abdbcb67ca0c999c1da22c9649d4712160de171c3ea2b9a66f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 87209725cb959fe3d88c1310877c74470e6489267a2c73d5c24efe04853218b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 7312edbce4815d1ae4e1e413eb66a862fa51ab3dd6dcaccbf429071b9978b5c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 2cea2ffead453a04038c58335bd019059269e75a6e57425e032ee00cde3923ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download