Overview

overview

8

Static

static

3

2026-07-02...ar.exe

windows10-2004-x64

8

2026-07-02...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    30s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 06:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-02_3c3ccd0b3c4a174bac5b2268cd0d387b_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe
  • Size 25.3MB
  • Sample260702-g897wsbv8m
  • SHA256 aa88b368cefe1b6fb5e726be66e358349a29d947e200b1bc64c3103aa701f9f3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_3c3ccd0b3c4a174bac5b2268cd0d387b_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-02_3c3ccd0b3c4a174bac5b2268cd0d387b_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1000
  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_3c3ccd0b3c4a174bac5b2268cd0d387b_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-02_3c3ccd0b3c4a174bac5b2268cd0d387b_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3260

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 25.6MB
        • SHA256 900d2c5746aa780912490c49785d98425b08c2197e61cc9139ad44b1382bd4a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 50.6MB
        • SHA256 5e12c159a170f72ba4e405068c17e194ba7306127984ad703482ce6f19f0818e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 54.7MB
        • SHA256 e982bf8d16ca427707abdbd43f0586635c6aa8ce07c5be7c033b905ccb7b5f34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 50.9MB
        • SHA256 06bfa3de3bd1d8d9338c225b3b93558798e3bb838e7f320aa0456ebdfc7cfd01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 72.0MB
        • SHA256 137ae8fe95c53b2f887d6d12b78ffeb621bd413d179fa3555ec834ebaa250353
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 27.4MB
        • SHA256 56b8a7eb2f1ec8d1eb9c40eec41b1264d66a3f59d4b5b0dba579ac3a2e731baf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 50.7MB
        • SHA256 f0ab8745cfe790e71e616b1069e6663ff614e6f9abf224bc6805aab6f145582a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 56.6MB
        • SHA256 99a3d4111698a69a526e44f0a5e33cd7339a1184a57842c359ba23621f35bde5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 52.3MB
        • SHA256 5186c85c9436085eed02a4fb8f50fd9a7581fc85c77d79d8074a04fcac1c82f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 54.0MB
        • SHA256 be4c12020cc2ecdc8bee7c9d4a774db7f64e0fb5f0e7fd7e5686351afafb9008
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 52.8MB
        • SHA256 87dece1bafe1f86a8f4fb4fecad4a28b6e5cb548e7ce3d74c0df4ae6781e9c96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 52.2MB
        • SHA256 4e2300a20bd92418cf40117336ac1f209c1aae07ca38a0576f8aec27a58787b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 53.6MB
        • SHA256 dc4e9d58e7b4c5a05f1b93409cf313320dff9f792542a8cc07e975e77d25bd50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 52.0MB
        • SHA256 3d0f443eebe810d5fd4b9f18f4fb3a225e59226916e6a02b5e579251cc298392
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 50.6MB
        • SHA256 4eacacbab33ba49261e3dbdf5cb6e03210b904a36034006ede0370990ac9cb6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 50.6MB
        • SHA256 c523b08ec40ae15b7cdb8a173a393a060b3ef11e95162f8900e53708b694a7ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 50.6MB
        • SHA256 1ce6d75a7c02debad20ada6559257bec96d5cd1593835f20243253883647d2e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 50.6MB
        • SHA256 8d2699c9f58bbcb133d93c5c44025ea45f7acd2b744b5de90de4bee7852ee1c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 50.6MB
        • SHA256 323d94c3a9b0159e790f8d87037b7be59661941ee94eaa92dd185c6aa61ebdfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 50.6MB
        • SHA256 6ae20a860eaa575649e3345d446bf7cb7ff3edb280c3c63d2fc5e34afe2457c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 50.6MB
        • SHA256 f22f7e4ea9d03e9cfa9b609fb7660f71b9d0f17cf68b9fc023f23918da44c310
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 50.6MB
        • SHA256 ed6e922381b9dd2bed7e83c09f5d1fdcd83e0fe7af384d531cd90b8d4f7b2314
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 50.7MB
        • SHA256 28477f1e3b4356d34aab380784195d7955b9c72ef48bc19aa5ec84660709462f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 50.6MB
        • SHA256 91063a40edf61ab1f60babbc53bbb06c7304cfb8eb76d101d1b662fb8faeabfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 50.6MB
        • SHA256 7b55101b4be29b99ee8e8006d705068801bf59c35eef11f930e14a67b482bf3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 50.7MB
        • SHA256 9519ab3e401c872cc49bc45ebd634aa6a5b412b39bd12d3156cb6f110cbf06db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 51.0MB
        • SHA256 e5faa3face703b7c3063fbce9336235c9cb11b0a4e782e9f35d2bef96d8da0b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 50.6MB
        • SHA256 203f6799f80389bc670bb5a9ec668aa339f5065d299d9945daee1279051ef640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 50.6MB
        • SHA256 79a70719aedf976d95265d66706ba329948acc306b447c92f5f16f5ce72ccfff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 50.3MB
        • SHA256 c9e91e40fb5d1474418f4651c3fef461ae200e7139ef7d3b8721ee3daaa9923b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 50.1MB
        • SHA256 01653d8e0f3c52e6c9782c9691d8a047aa47bc14482f9494fd963336374a25dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 49.7MB
        • SHA256 eb7e2d109960f5eb41919d341d6ad9e2168659ab7ca52ffbe86c54e8a5c864f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 48.7MB
        • SHA256 f2a27809711b57b047dd39f52c7715859e1a2492517c191a8c3f213d9cb0b688
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 48.4MB
        • SHA256 c3ba80ce713f04986478fcda30252e2819d9c08123e2e98f07354bb28ae065f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 47.9MB
        • SHA256 e6a5f3eb5ae020c8fc0992a7d6faec272fee80e61b0c2dc9f2cc3bf31adc5aa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 47.6MB
        • SHA256 d7c739164dd659c8c5631da2ab9d2dadf8ddec8f2047e71759ed6a992d533dc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 47.5MB
        • SHA256 d841ff0074dcfed40f75bd9bdb252fd56f1de513dee562c6a6a91b63e93ef997
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 47.4MB
        • SHA256 26ad196a97dcb17c774ff4e43e12329f95c81bf02ac6b7912ad4d75241532962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 47.1MB
        • SHA256 aad4d79c492a3e51046604b986ec18f2902ea9ce60890e1ad5542b1de54437b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 46.9MB
        • SHA256 94d07fb3f57db8a57b6ddc96ba32e5030fb7bdd2b12c083e71692deb3bfa9b01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 47.1MB
        • SHA256 f6a30a883cca0071735c3889ceb9c1a8575c3a9298eabb356638ddc2f34e82fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 50.6MB
        • SHA256 7fad28f6248114d397cfb0e758ae04cc35727126317f3af70c25e427f26f267c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 50.6MB
        • SHA256 1d96ee5d5041bc4326afcaa6ac73860fe877467b08e016805506370b3d49c889
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 50.6MB
        • SHA256 e0aa873a90b5d4dffdb7de734306d5144d18a21cbaac27b9632bffc56ecefa8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 50.6MB
        • SHA256 24b6303f3705b5f08feda626443f5f5b41d0f5f01ab88f609f496e066881958c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 50.6MB
        • SHA256 0606c28aa7f47bcbf84257cd226b2a059adf4c02231b089a403896aa090fafdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 50.6MB
        • SHA256 734fd362b5a0d90da8f49304e8df79108a2d727fe4287aa0b493955f2ac694d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 50.6MB
        • SHA256 66a6abd8bc8fac11013477ca4e600befb72dc66731270770860c78f04af3b617
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 25.3MB
        • SHA256 3ef5202960907ad7a01b62a23862353655dfd1826c9b2a53bc0a36de96ac068e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 10.2MB
        • SHA256 dcbd1008e4d9cc8f85e5cb033a6a38c3245d5dc4beb2233b26ee01c2182581fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 50.7MB
        • SHA256 4d47d7b6222901fc016f28b0d2925f595638b2e3cdc122a4e229661a7fb9219a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 50.6MB
        • SHA256 f2922411e3b1c2a15c5c3d675f144ce33aafeb4485925a314c2db06373674acd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 50.6MB
        • SHA256 fa495ffba5c88a1b67614e4a164894182820a070aa601765ab77e830b9b3b474
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download