Analysis

  • max time kernel
    148s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/07/2026, 04:24

General

  • Target
    2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 3.5MB
  • Sample260701-e1hrkags6t
  • SHA256 98e4f944046d6796526855edd1d1b4765267b2b948d89fbe09a0a53040b79704
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1756
  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1832

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe

        • Path C:\Program Files\7-Zip\7z.exe
        • Size 4.0MB
        • SHA256 86afc3d8aded4dd98ab74835f1360540ac549ce1356858549f665fae1c52aa3e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zFM.exe

        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 4.4MB
        • SHA256 e4afd7e25c5af2a041357ccaafac5f8b6982cff66b1f30cab4d3b367ae69e112
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 4.1MB
        • SHA256 8998cb9d6c6fc18247d73fd7ba302a55f0b68bd08249628513c30fb416de3142
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.0MB
        • SHA256 420516e5cb20738ddc3f69623173e15d0c995aada1bd77c85791711275cc4647
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 7.2MB
        • SHA256 85c34e8c48ef88f1eb65573c60818e5e1e6a637806b628b9653cdaf684db4100
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 7.0MB
        • SHA256 9d4197c365d6b10bbe7a964bb7e06d3676df220b8ca1115d67a1779824d4c298
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 11.0MB
        • SHA256 f0f9a108efbce97708653d88618dd627c0e4f3e578a816bcd7d35a2a454dd674
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 3.8MB
        • SHA256 2f2ffdbd4deb75ae5994b349860f9b152146d2722bc955ca0ec7706c25a0313b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 30.4MB
        • SHA256 b11230686596bd1e1a5ba2c2f317fe299a3d3b0753ad6e2e0313068fb055ca8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 7.0MB
        • SHA256 6a3e2a4b877367f2ef0b8f83f21cbbcfda384eba7c602a929fd9d2c6763dc2c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 13.0MB
        • SHA256 dc0a8cf3478759d5cb0968b894159295bac688f37975d022b459d5337be305c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 13.0MB
        • SHA256 6d8d1620853edca6eaf7b7afdf375e5ee49aafa57c8961a758c1e4db942e7c67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 8.7MB
        • SHA256 bff128ad53efb07d85a82e1b70c71ca4206f24b31334c264b65240de50d9c998
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 10.4MB
        • SHA256 1b15ab7dec95b63b2077ee3868e5aa227bf37ebbd40c82ca04a61654278eabb1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 9.2MB
        • SHA256 d4a635f452af40b411ece27f741f825303acabe01248adcb5ccb58cf379e403b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 8.6MB
        • SHA256 82a73e2033613ef329b9452e272e329de97d753491a6baa1f94465a62c66d6a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 8.8MB
        • SHA256 eafacf7697da88c2c80020c3567bbf1cc01e7d2e693f141396a345a7f31f5f66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 10.0MB
        • SHA256 139516fde2f35dfe0733b9ad1a4904d727341cd0ae8706b47846be461a7ed1c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 8.4MB
        • SHA256 9721c3880e3e2b2645489f6d89a5eca4ecbdb460b0098b81c807a1c07ab18d2e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 7.0MB
        • SHA256 1dec2b0640a2ee19d8d65004d2a5be1c6ceab1a8e625f678386bdc470e75602b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 7.0MB
        • SHA256 2f8a9711cb8206a83b37ce78871bf6c262faa322ea596355f79e2ab674452abd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 7.0MB
        • SHA256 3353eddd6f87fa69e5bf9ef88d7435c2f67cb97a7467b8ca7332b86671a0c1e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 7.0MB
        • SHA256 3a164bcda64c9040009d6160bbd4dff71d21d92c845c04680f994c0cdb40051d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 7.0MB
        • SHA256 56182e5986f582fce1d342ceb671bddf2adf6994fdc7b2ec4dd1a11eba31415a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 7.0MB
        • SHA256 ede735b1c84b94838817dfe32fb141fdd53232ad4788066a08d54af00e66e31b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 7.0MB
        • SHA256 3c848d935910057c748ad91cd60dc27dc34a094299a66c80bd341445100eea23
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 7.2MB
        • SHA256 7583127309cd40b8cac443f961ec336d737f82e1fe96583a8e0b7bf6e5e0c93c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 7.0MB
        • SHA256 1a9bc91dbb8cf24c8270f50623e0c01d26a45a06a8e072c3c442b7daec50d912
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 7.0MB
        • SHA256 6904f81f688d5c6636f518e03b67d906a15c9a2081907d54914de9f926e30a5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 7.1MB
        • SHA256 70ef33f4d9fcf102ac088aa6d7f5504030868931bb7dd330312a005d5401e77e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 7.0MB
        • SHA256 c68e0aae7b2dcb467bd9c6a93d2cf757a54ec15b3409e25ce8a62fa2e4050845
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 7.0MB
        • SHA256 6b1c7d9bf588795d024991c6b80a4c06d2d27010a8c0251da63a1ef2412c7aac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 7.1MB
        • SHA256 adc27d1f2e58975270ed352394a17404a8e066350540eb207cb4c5e6a9e1dc89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 7.2MB
        • SHA256 c1f07cb2b1c1b26b0c83c4a0c78fe8c32187ce606e6b41a73cbc095521992825
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 7.4MB
        • SHA256 31aa6ad0480dcc7909da62d82f3eb209028300b5a26bfebfe02cb96ad194374e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 7.0MB
        • SHA256 6064437dce2de3b3028ba1a7c2879bf9019303920bf1b8313e5d16e17ab73b6e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 7.0MB
        • SHA256 4c54f7a6366689b11dfdc03018b5c2e2db8f88311ad84bf251b5d0803b87a5cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 7.0MB
        • SHA256 f90e7af8eafe1ef2a898b3c2f92054702fbfcacc02035ad3cc5730469a9aa02b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 7.0MB
        • SHA256 0127c2bddec33e86cf069cb1fbfbbde41c8a759ffba2bd25df16e67d01f1b402
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 7.0MB
        • SHA256 7209be880c543dbd8d6f6b72151169e8eb374617a7ffd8e0e582dfb189fe366e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 7.0MB
        • SHA256 9c30a07f69da9263c0c06cb52cb2bbfa66581b0e22198401597fcea143319a89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 7.0MB
        • SHA256 f7b2c2b0f15dbe71f0f95beb8738b38c8214ab9ecb992066d4366c51b1fc7a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 7.0MB
        • SHA256 4beac9d76ea70ba68c53ba50f190ba73d14271f340afe84eab4083919a97f728
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 7.0MB
        • SHA256 6fa8b468aa9d8fdced4085e830bbfb273003934126cf9d674767a5a4739ec08b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 7.0MB
        • SHA256 7da4752b94da38b829e7a83942d416eb87ebba42080486724818d9c3ec81a879
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 7.0MB
        • SHA256 8465dfdd66281709248b0f3845431b4633c0ca4b9c7f744e6cf88877025c9f8f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 7.0MB
        • SHA256 4aa73eaeca14fbc838a3125e6ed8970cc63e6615d633b4468ff070baa4aa62fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 7.0MB
        • SHA256 3d576722734ff9257e1a4d4c87636126598696ab801cc1dff4b89fcd6c044906
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 7.0MB
        • SHA256 5fbf5478564ad501f31b8d21c23659aacf076d30777874e88462b4ade2ec46be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 7.0MB
        • SHA256 8a5edfff2a1b16c4898d8e66c2e18996f1dcdc0ce6cbc3edb9c031a895aacba5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 7.0MB
        • SHA256 5fd068104ef9ae7870289ef42480704329ab5df14657665abba3b951eb210f11
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 7.0MB
        • SHA256 d16309d46caf8f19529a613edc8640a320b0c7c0894610b5725bcb7953e81b4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 7.0MB
        • SHA256 13597cc1d1e54023c7f389b1b5afd2454349a4c693cdce9f92f59de7eb7ac656
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 7.0MB
        • SHA256 b720765543533ad30f8562d9509f2047b927e677df93d0dc0536f03b58fe6678
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 7.0MB
        • SHA256 43309c4b77ce8e42cf7b2b6e415abe721e8491225275238c2491cb78f0b67a09
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 7.0MB
        • SHA256 41f3bf951521eb37d8c248f8e7da0d07b667d4da5306e39ea00bdecc12a2ce28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 7.0MB
        • SHA256 0613f8ecf27ca1785690fab4d365465f5b11bc723c9c528fdd69076521912f2b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 7.0MB
        • SHA256 90e359caa81e6f4e291c9338b585be70cda611244c6e9e0c33b064f96d4ec661
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 7.0MB
        • SHA256 1f5e483690817a112de8e2c521f2cf7190a36eb309e5f5f2701e6583d10c76d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 7.1MB
        • SHA256 cc87e54db633611805dbc1e19a75df08ee6bdbe3ba3fbb9003aa051db004c01d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 7.0MB
        • SHA256 4829590259bc50aacb969f9d751d819ac2606a6013b6bfd6dff4f30cc350d952
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 7.0MB
        • SHA256 a39bf3fdf9d29acc6119cd83e46517f98032ecce7d0f32d69e8ac4c3fc563089
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 7.0MB
        • SHA256 3541668835bd5817729f6124ae1962653b18a81a79533b38d1e443a4e68ee486
        • MD5 SHA1 SHA512 SSDEEP TLSH

        spo0lve.exe

        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 3.5MB
        • SHA256 98e4f944046d6796526855edd1d1b4765267b2b948d89fbe09a0a53040b79704
        • MD5 SHA1 SHA512 SSDEEP TLSH