Overview

overview

8

Static

static

3

2026-06-02...ar.exe

windows10-2004-x64

8

2026-06-02...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    24s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 16:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-02_b307266f778c1d20a46b823c2ac008d9_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe
  • Size 22.4MB
  • Sample260602-vfd6msa13z
  • SHA256 8659a0f8bc682b2b6d9f0f1d02e5fcf7ec7d533a75319d683eef796b438e8ebe
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_b307266f778c1d20a46b823c2ac008d9_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_b307266f778c1d20a46b823c2ac008d9_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1820
  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_b307266f778c1d20a46b823c2ac008d9_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-02_b307266f778c1d20a46b823c2ac008d9_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4964

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 23.1MB
        • SHA256 995f0c709797e72561208b0f41400bba61f483d4cd477fa170831ea347a1ccb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 45.9MB
        • SHA256 9ddeb248b3e508e2ffbbc9a589ea7f6e994870c37ac3683d4dc4737df80fb185
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 28.5MB
        • SHA256 e0b66dcf1ba0db66e62d0eed13f00b2191a8e30f0c33d6f26c18bf6c5d7cd680
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 25.9MB
        • SHA256 a562b8b2219f0dd4a3bf6048fa40567bacb2de4d5bca58d60279fd333a79138e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.5MB
        • SHA256 72cf2a08ac4846bc91251ed78e994140fba1b5472b187d768c9d57441eb95877
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 23.9MB
        • SHA256 4aeeae8dc6869c6dff0a062c295090dd3a066da2f827317beb2345b78d2eb3bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 44.9MB
        • SHA256 d287ddacf03f088c05de7428bd8596c69ba22876437bd0bc48c9305570982e1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 44.9MB
        • SHA256 0a2034ddd571ccc08aa5f7158b9c7ea6bfdae9ed6c20aae550354b7e398bdd66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 44.9MB
        • SHA256 9cf5efab99c5622b0c38bd5fde49c75c5e6e865536a51f8647d7b5cfaf1273f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 44.9MB
        • SHA256 38507c9d684d66dd67287a51cb995230a77b5fccf56756dd344a501aaea822cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 44.1MB
        • SHA256 c66892749a228c845530f8e3a2f22754451c3a387db7145bc9bd4b1b5a948906
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 42.9MB
        • SHA256 bdaea3c53c25b7ec14ba90c2ee8a67e426859f6f548adfffd75e75058f4999d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 42.1MB
        • SHA256 d435c5b735248487d0f6c4df46fa20623b9593a77bc7b12d1735f97f5fc60e0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 37.4MB
        • SHA256 9a54b73bc0fbf9fd938bca9b9c5e6da59e4f2231d888257340f7676ed7d57f12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 42.6MB
        • SHA256 899ad00254ebdc0aeebadc1cc6748b551713eca75d13858de5f3396bff275055
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 37.8MB
        • SHA256 9cabea17c0edce2e53e2e5641fba9d88455ab98522454a0bd9b71c6a94660b75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 41.0MB
        • SHA256 d7edb2030a2555ac210cebfafe0fdd034561e19120e6e4d990984375441b14db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 37.6MB
        • SHA256 5634d1322693c39e46562695a8067450711c5bc54b985a52c780791db82fdcec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 36.3MB
        • SHA256 bdabb7c83dca1e548a3ffe42415e573fe1270bcd46e5eb33d4931264d36b278f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 40.8MB
        • SHA256 cbd5d69e67ff130f79f83ca4bfb17aed0b558d2c482330d8aab42d461845aef1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 40.6MB
        • SHA256 df70ac9e5b4edc6abd64a708c15ac767838132b5229779141c49d464ebe057ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 41.6MB
        • SHA256 aac79a1e66be5a73d9323cc8d310f3c248b6e4de680ed85f9d224d32c9ee1f36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 39.9MB
        • SHA256 fee04969ef54c92456c92a25202b592280fe4ef2ea9494fcc8b487ad0dae6920
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 39.6MB
        • SHA256 3fe21a8b8f815d0f1829329a59ba9093023a4bdd425680c16f5d391c15ac8f6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 39.4MB
        • SHA256 00ff48528eeaaa6786f205c777a814e4f57befe22bff7674b331fa4a2af9b0d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 39.0MB
        • SHA256 4cf542d93ca746ea230252b8f1c09aa9cd671a112596656affd8991f412af5f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 39.1MB
        • SHA256 dbec4f86fe45cd73a837d315839769754dca4fd6e05744ee53c02c462608e119
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 38.6MB
        • SHA256 59ad6de4728a85d367e950b3cb116bafffd004448261f61a7fbaec1f2719990f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 38.6MB
        • SHA256 330e7ac95cea703fda4dcd740b101f3a511feb51f5077bf529f629c27257c57f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 38.2MB
        • SHA256 8a7ecfc9eed09d63f9c8594f2cbd8df53484379b2d3a18f75a245ce560844f12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 39.5MB
        • SHA256 0f9140eeb7a384e63ed2a897572ea7caeeea812b057edc3410f0f9d38750271e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 39.2MB
        • SHA256 35f1f6ddae2ce04e380c58a4056928c9d3fc7393acd7fee8f8b2234fcd91bebf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 38.2MB
        • SHA256 bc484faba41c8bd9b8075141f42a018e16b09f59d434241bf7a1fe3408922f2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 37.8MB
        • SHA256 a2d600dbbc6752d2bbb3127b46563b5421a07af23598d06b7de20af9db49db6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 39.4MB
        • SHA256 d26c2b947ec45c603186d7fd49dc07389f69c54dbb454cea95a48b244c753439
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 38.4MB
        • SHA256 dce34e737ffb2ad088cbc6c50edaa5e0b650968ceab6d732d95d5695cb36f10c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 37.5MB
        • SHA256 b5080815643cce89983b150bd038fd5e44d11062e2e070dd87e118175f860a49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 38.8MB
        • SHA256 c2079f131eac9ddbcf407c378714d9ee8169cc3aa99ea7518572f0734e0706d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 33.7MB
        • SHA256 0e1b11202834b10edce01cf77962be8fa3687bf12e0931887c4ce2cac1b256b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 37.3MB
        • SHA256 8f997c9c285a53047b665ca81693fc8242ec518aa4bfde3420cdaa5aee36f3c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 37.2MB
        • SHA256 f59ef79bbb0863a5b5b9bc668de21db84bb335c523185b7c29bffee1c6553816
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 36.9MB
        • SHA256 a96f7fa4862d11bb948c6adba842d27af47b18c7d86b6d378c063a5941c3aa04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 37.9MB
        • SHA256 7211f86f8eeaeead7dca9e61b8a07dcf9e1fd1fd38a719ad5f91ad13a492798e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 36.9MB
        • SHA256 10c426cde42e57768309dd867afde623ffd2354de863a48a1bc21390f1e31620
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 33.1MB
        • SHA256 da5fd87a04ece704aba1c03cdce12d8470f292437a01499ced4e4a1356f790d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 36.4MB
        • SHA256 4d1fad0611bcd487bbf0fd0ce11dae4df2088309755ed7c4f9989fb94b1a5e18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 33.6MB
        • SHA256 d678807749586aa4c80876aa70f7f6d422699427f30a0f989d7d228d5532012c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 22.9MB
        • SHA256 b6bfcab6d73a7a7dfff08bdb5b4f23d1ca46d072926e4dab2a8a28ae02b2b259
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.5MB
        • SHA256 963297924f3ce7b9a6dede89f259c4659a52400e7111764009b1ed203fa655b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 22.4MB
        • SHA256 8659a0f8bc682b2b6d9f0f1d02e5fcf7ec7d533a75319d683eef796b438e8ebe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download