Overview

overview

8

Static

static

3

2026-07-02...ar.exe

windows10-2004-x64

8

2026-07-02...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    14s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 06:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-02_a227018b9948ee0fa52760ccb1513924_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe
  • Size 25.4MB
  • Sample260702-gr64xact6y
  • SHA256 62c444682db33e2cfd6557c2391c9f0d836f353ad422f261e38f62004a5291a4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_a227018b9948ee0fa52760ccb1513924_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-02_a227018b9948ee0fa52760ccb1513924_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2548
  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_a227018b9948ee0fa52760ccb1513924_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-02_a227018b9948ee0fa52760ccb1513924_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2704

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 26.2MB
        • SHA256 96c091a0aa3d0256f9f889f5f551c03adde35bbe4378f9af33c771b1c22db229
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 26.1MB
        • SHA256 6d2bfaeeb6097232a4cd582dc6966426da871fd8146676bdf1452ba0c073e396
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 27.3MB
        • SHA256 5a2750cc2845eb27ae0e2b0191553ab77c9d3b3adcf311d97de35628a3f06e61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 25.5MB
        • SHA256 05f3efa17832fc8cb08cf1eb1f65dbbb8876fd05fb7dab211304d538822e6893
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 25.4MB
        • SHA256 62c444682db33e2cfd6557c2391c9f0d836f353ad422f261e38f62004a5291a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 25.4MB
        • SHA256 f56cc90d3c84149d67d63593dda62cb70828e7cb7f089255d64d699b6b450a19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 25.4MB
        • SHA256 41c8b5faf3a47c59a3b33008a619898e5e0e423df0bba18aa86fc03bfc967f85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 27.9MB
        • SHA256 226ef3995e6bb027e6b8f6aa4c84056b2ecd831d55254c5e4ddc339b61b2415d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 25.9MB
        • SHA256 7cb6fc7c288dfb671523047bbd8fdbdf36268cf1722b642068311e3b9ee667e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 28.4MB
        • SHA256 7ce2df6f087271152df000af4b297fc5a9562fc65e25a471647889993cad4fd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 26.9MB
        • SHA256 a8e40a0f867e971323c29fabe8c9662360710eb7da23867afb5d907f0c9fbe77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 24.4MB
        • SHA256 c150ae6f7ba9c70bb98b6a38ca660d4b1d1f7c15d200bba19aab94e3a2a9f4d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.9MB
        • SHA256 b48932c3183741e8686413a737431762cf4c93d45126f7e5b39e4cd6d63564cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 25.9MB
        • SHA256 25ce15fc20bc1f258256305cbe8205c18e5f49f9e2a8a9d6052daa086d0a9670
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 64KB
        • SHA256 561e710c0f12a9ecf3c544ad6eaf227983f3f3f2dcce0bb2f803afccc641ad14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 26.6MB
        • SHA256 4141d1f622a98fcf958a3ca00f328b83cb6ee29acde56a7755229eeace4aa937
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.1MB
        • SHA256 ef8c38f946793159cfb806b47759e9b320e0501a74bfdd4f0100dcd64d7a48f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 25.8MB
        • SHA256 15279aa102e0c5cca05b5ff08c50db7b2c12174d71c1a211fa119ac8ee1ad995
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 26.7MB
        • SHA256 4ce644885d96070a4f336dd742ee3b89361fbd548632d99084e4b4cd43425a56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 26.6MB
        • SHA256 d9ea644dd091d4a0208d4e94a0fdf63b763cf4894cd378a0d7d5fbaae8c945f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 26.1MB
        • SHA256 080036ce25bcbb2e242f0b6abf9c207def195f5d65384a97cbb25e14e562f54b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 24.4MB
        • SHA256 be3b3331db5eae416181dd398516b1e54a52f7843459176e8ce42d94c2be243e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 25.7MB
        • SHA256 44857b926946534dd13867d2cb8fa96693291fd052a4eaec1373545fe16dfbe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 25.1MB
        • SHA256 e2837faa24c04989b4b10acf8ac60a6f1b646b0fe92b43fdc5b43a5774524386
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 25.4MB
        • SHA256 c2700995f3ad003c0d63a806eed4b69d1dc36e678e4e07592aedacf7fe2a1342
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.5MB
        • SHA256 d71e796d3f287a25e4ed9a34ff6b057441775ff7cda839c444d49be0afbbf89e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 25.2MB
        • SHA256 3f1b0e65d341436b9aa8550c61e7ebfd70895086c0d870b87debecc2bdf84c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 25.9MB
        • SHA256 bbd29bb88fdf191ed5587086a7ad1ed75da458ebd3d73af9fa8ee472e5747851
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 25.9MB
        • SHA256 71e5e74f1f940dba91ef765d5b5558313f03845738c9cda89dd7fe6cd3830118
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.1MB
        • SHA256 889d6fff91fd1e934cc573e0cef970b6f0afa217c4dbbce596b984a492f198fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.1MB
        • SHA256 5a3bcb688ef62e6fb7db1929b1a6c6d308b01457186df0c2a14c37978f35401f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 23.6MB
        • SHA256 2028694888a498c00ab5d4ba870fab52443b16a3629a2fba51a047277a169efa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 24.6MB
        • SHA256 48794436db2b833f3763e5d18031442e5beebd729eecccc0e589a43b1ec3c9eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 23.1MB
        • SHA256 c13f354827a8789ba47f21bc9ed973ef5f1b0319f79d643f9bde372e8744d92f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.1MB
        • SHA256 94913339e8ef52f44fe8129a49f718046110f4bcab66798d5ded17f9e1939809
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 23.9MB
        • SHA256 cff1e28d7665719210dc0066c35088fb0e5a77ce2f3fc246f845b7d04678a180
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 25.5MB
        • SHA256 858bbdd0e6f60bfa51274ecd7ed329ae42525be2a18f1b0d7374bc8172da8326
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 23.4MB
        • SHA256 a098ab85c738dafe3a96b7b6b4d8a45cf02030dfbdae01566d56a7d8a6989e1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 22.6MB
        • SHA256 35ea9bf8caa073e0e03e6b4b9eec3e90de8f122bf3e6ea301712921fcd59ee87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 22.1MB
        • SHA256 226b2d5aee4f55c6e6e8a2a5301b732b68b3bccd348883810a26b340d0d49f6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 22.6MB
        • SHA256 991dc60576c2877fcacee1b1723d4e63e5cea8aa1e0779f25ca3637640b445c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 23.0MB
        • SHA256 03e6236d04f7f00da5a47a9bcb7e4d722038c0121e326f3f70ccbbbcaa1db1a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 24.1MB
        • SHA256 6defd9a5914c171482083b658962ce21d0ed0b2a55a35c0691bb29699302c14e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 22.1MB
        • SHA256 42e27165436153ee797c473bcc964c87f8d1ae4a316303c5adad73d2c11a0e52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 21.6MB
        • SHA256 7bb625074d29cf23345de5d5d992082121da7beeace36157328dc6d9886893ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 21.9MB
        • SHA256 5e4cbf756449cef027e7d78ef64e5136a4305f0010e7b6b19e96d3e89108f442
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 22.1MB
        • SHA256 af238dc6faa97342d7dc9c1d8f56d2d8e380f355964e1f0c1204f9e5996aaa6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 21.1MB
        • SHA256 80807355ba84eca6abf85cb1f1ddeddc8646943fd10f2d55b7c7303515962f61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download