Overview

overview

7

Static

static

3

2026-09-22...te.exe

windows10-2004-x64

7

2026-09-22...te.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/09/2026, 18:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-22_997f33c2c363c9d5bbde748ea1d5ba2e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
  • Size 11.8MB
  • Sample260922-w82m3syscx
  • SHA256 7cc95c1358f7003e4c447c50eb3c3b988d042ce6c004e2881355994ca663930b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-22_997f33c2c363c9d5bbde748ea1d5ba2e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-22_997f33c2c363c9d5bbde748ea1d5ba2e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4152
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:3524
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5408
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:4596

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 12.8MB
        • SHA256 6869847068c09bb4be705e16919f786bf5d17e9830df8c002eb28405ae6db4fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 12.5MB
        • SHA256 b902e7911044dbd0f0b021bbfb1920504683e560bedcb944f0896851f72ba960
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 11.8MB
        • SHA256 f671714adff5f730d7eaaa23e460d041f2df746ddad74a49c95563dab112de66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 17.9MB
        • SHA256 8adc50667a60d369621774cd8f583fac19c9929ad338ddcbbb0abbb4c2500171
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 13.5MB
        • SHA256 51b942dd49b21fc6aac8d02edb9a2565bb87b040b5ffa64cb18cd982f4802e6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.3MB
        • SHA256 79c94e4ddb1e4b654cd7111ba91622faf968ddd64963b978ca35a501f621f6cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.1MB
        • SHA256 3d33314f0f27e8cc223f47795cf3acdd24e73aa809edfcbc89b6b3aa8ccd3a5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 13.5MB
        • SHA256 2532d3da7fa882a9e2079ff2e53b6e4b4699283f21a07123f8199cc1d63ccc4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 14.9MB
        • SHA256 1053fda4d320728a9358b5634e5abdc15dc6abb3333fb3adb5276db9088db872
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 11.9MB
        • SHA256 8f0b772aae33f9840c80070e45caa13630b80cac29b7344372c654a5ce240fd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 11.9MB
        • SHA256 5bfbb807d928e09c1a7005c820a1bcb15e7293efe8a2ca7d624992617dcdac88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 11.9MB
        • SHA256 1bb6668ac112e3fe95407e27ea9799f22976290821625f953bb4cc67748de980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 11.9MB
        • SHA256 4dd38a4e1adcabfeff75e9cb53ebbd35424eb7e109af921df7293ead8c904da0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 11.9MB
        • SHA256 bca56a7bd79ed9985dd4f2eaaf20df58f894e26ef8fb0331688d79e25ae07465
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 11.9MB
        • SHA256 82300175d93842046654d645b1b13179f2735480b09c1b96eb33ff656ab6191c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.1MB
        • SHA256 8fa679911a4c000e8cfaba73ee981fe11acba28416bdc8c1e3fe3f012a9bbd55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 11.9MB
        • SHA256 0a0d0c508ee8be74e66f64196277a702a594fba3b65b562fd39f89cb6068dece
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 12.0MB
        • SHA256 3ddc32d97da4206fdf8ed60b75bd14ff77e987bd4812343eb2f72cf6f5a975f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 11.9MB
        • SHA256 d4292dd1a38cd1e62728ae7e990ad95d5962477f6a5ab1b796907a168449d84f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 11.9MB
        • SHA256 ae51b7a1bdfb2e6f685ec399690e1a14a8b83ea65303f6ac4c32e95217744897
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 11.9MB
        • SHA256 5625196ced2384d6efe6c180727ad40d38a8c258c5625f29e166b8c1d5e2b068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 11.8MB
        • SHA256 7cc95c1358f7003e4c447c50eb3c3b988d042ce6c004e2881355994ca663930b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 6a8bb29cc3ac8f741db2a4937e408f430888cbe8143f489db98c3ad0872cd2d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 73eaeaee2a800df5fa7c2a34bcb1c516cd4c81a42632321b2845661472b9095c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 59cf88cadbcbd2e4729703766970a7d8476e5bf5f2bcda73bc491af0210bbac2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 7f143cd997b2b8767ca90016d15fef94a04e80a58db56f7a6eddc96e63d43dd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 e5023e7302bb7929327db9bfa7fd66fe060709d247875e8abc2bb9f188db79f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 aeb83e77f70f29cc4de8b7cdc073b45f982996ea51a8fa41bc02439972fa370c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 12af47a98926ba09cca457de47e7af219a3f78b6ee6085437052a55aac788c27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 e2d429320bcf6abdbcb67ca0c999c1da22c9649d4712160de171c3ea2b9a66f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 7312edbce4815d1ae4e1e413eb66a862fa51ab3dd6dcaccbf429071b9978b5c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.8MB
        • SHA256 c1f8fc5b28456ba840cd582bbf0e21239c227f8ed0588c74ebf45a4a61ba22cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download