Overview

overview

8

Static

static

3

2026-07-07...ar.exe

windows10-2004-x64

8

2026-07-07...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    79s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 23:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-07_5c02e87d8879e889a4138bafd1291beb_elex_emotet_icedid_njrat_remcos_vidar.exe
  • Size 20.1MB
  • Sample260707-28hsvsgw2j
  • SHA256 6dee7a51847bff62cfd51b929fbfd52811bc85e01bb27e2ef1ff2c00c65ec5a6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-07_5c02e87d8879e889a4138bafd1291beb_elex_emotet_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-07_5c02e87d8879e889a4138bafd1291beb_elex_emotet_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5560
  • C:\Users\Admin\AppData\Local\Temp\2026-07-07_5c02e87d8879e889a4138bafd1291beb_elex_emotet_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-07_5c02e87d8879e889a4138bafd1291beb_elex_emotet_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5936

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 21.1MB
        • SHA256 d81ceb69b8ab9f180aa3ede42c33484ebe8023cc3902efaf97521dd8b2209d5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 20.8MB
        • SHA256 9d01350c1640060311a0e024636b7b30ca026ce526eb220d82e06e5e42eb9ed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 40.3MB
        • SHA256 5b00261013d604374647d0f0a9d6025ef9bde19dd42094a59ede391525358574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 40.5MB
        • SHA256 dd9d50951b6d7a936e86aa58cf2ae5d64ac56141f4d001e35fc07fe8feaee6fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 20.2MB
        • SHA256 f68aa5ae228f3db1c0e30ef4dcc2693ef2e6b4d28a4609106adb837a412a39cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 44.3MB
        • SHA256 9977520a05feac6c9205bfa8d373fdb7a28bdbf67e8200e7dcded1e38f933fa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 40.6MB
        • SHA256 cae03f1edc235d25dcbeefaf5bc2a2e0aeda40250116840f96c097859c09d66e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 63.7MB
        • SHA256 af9180eab911b2419de8b3392e36284913fc1dacb76df8432f9d256b23d5507b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 42.4MB
        • SHA256 c64b6536eaa28188201edf161ddfd511e4e9f6c0aad0de5ec0c7086367dbcfae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 40.3MB
        • SHA256 92d782887da699d8ecb0f192e10f38191d313ccc21c0e9ecba535a1ccdceb237
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 43.7MB
        • SHA256 77c6dc27dc20f312a1d3732995e2f7adf1882d691ecabeaddbdb4a122d3ef7e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 42.5MB
        • SHA256 21061227907eb257a22cfbb3b4e18b23a6efffefbaf90211ccb96feb8e8e91be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 22.0MB
        • SHA256 d6529b4afec4841b20e9b3466cf7b3115c370137cf4805efaf11ec6fdab939bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.2MB
        • SHA256 06aa070a9a08a1b105ddab2f0764267ef5472264714e1168c1973bf3e853998f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 32.2MB
        • SHA256 3dd1d0dc175e0049b6930614ce9a63e74f13694ec055ebb100f790765351b2a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.8MB
        • SHA256 9183e9f561e456b21010d79ca64dc4f5c63ecaec450a75819bfcf21b0e838082
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 31.1MB
        • SHA256 10f3dff80f1c815ab1c2c5e46d9850fe348243dc4192db495bb0d3cb77c65b42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 29.9MB
        • SHA256 0bd1ba93275da2f73e4c75d663c4373ccec5d9e75b2131c026dd17a1c2d40cc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 28.7MB
        • SHA256 c8d8d27e2d55fa173b7f583131002bc66c2cafe0d80c999578194b835ba8c8a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 28.4MB
        • SHA256 1a41ea5185f50f6423763007d277932be0a0bd0b72d8813b4ef201492e290208
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 27.5MB
        • SHA256 a43fc753019b2d1f9606ef832c7cf059161bf10a246f37a5d719e993c993e5fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 26.9MB
        • SHA256 82e97759c6f5d9c704e2783ce6284f717fe7aeb0e5424d211fb93b7ed606ca67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 26.6MB
        • SHA256 5dc57c0f8e11a3a40817cce070932ebe31e17de93554cbe6445bdd059e152724
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 26.6MB
        • SHA256 d070e6044020cdd35d6a26656ba2d988d078554eb9afb9c21ea52690c6803b02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 25.8MB
        • SHA256 3d19d1e6a75997cba72ef0c936d10e0205a2c1b738430dc9f32926a76eb2fc31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 24.2MB
        • SHA256 6541a611545fdc34dc05defa4c7f36aefa5a82298e837627932e49b16aa8ea7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 23.6MB
        • SHA256 f601631f4281d00278fd5c16ee9f0cbe61302dffd174ae4968034f39e7483481
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 23.0MB
        • SHA256 f4f02a42335a114814e58277f8b2c588a1fb7be7e047bc4d034cca28623c29fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.2MB
        • SHA256 6d03451e70c16b448c605cc34e3f002cbd00758f762caae87e72fbc91ef9130c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 21.6MB
        • SHA256 85536e3ced5eb6724c6d4c67c4893a054d58f1b80d3b546f0f8d44240e81c1fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 21.2MB
        • SHA256 cea49f3021e21bb2397df70f4cf215af86e095c2174bb3136e9b2b4006f71e34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 19.8MB
        • SHA256 03cd792531dc52f0ab9e29fb4b55804098f8a8d2441153e2497a62d4630118d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 19.9MB
        • SHA256 f6fa0d66edb0773614414fa59acc1ce26fdfc1412962f6200c2b800941c9a172
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.5MB
        • SHA256 03daf297c4021549f0afa65c0619ff7498cbd5ff758d4e88de5ded2a84e99859
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 19.3MB
        • SHA256 798e3f3673b730eceb6b38a7d3db202f99cee47f7b317ba8472ee1455fab969a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 19.1MB
        • SHA256 80fb55103a43fec8a9f9748264a3e68882d1ec6f200533e648bb69b23ab72642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 18.7MB
        • SHA256 923789204ebfc074be52c35617ce706946d756fe337e722ff05f059384dc40b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 18.2MB
        • SHA256 2c8e0251414691bfc9f2dbb005dbacf01107ab9791b0447502fdfd8b18efca33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 18.0MB
        • SHA256 c73b67f10fd05c54e085f1d78572fee47fd80d563c854ce85124971f3f34cfac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 17.8MB
        • SHA256 e0a7f0c72c76f105bb619b4aacabfcce8c66578df9164679185083e0d5557bc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 17.3MB
        • SHA256 60aa5d168af1bf37a4a98ee233c3f3c59e23be18d1c14bc17bf78b5596453361
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 17.6MB
        • SHA256 62a072d9babd0566bb76e2f668635bb423289d545db9d209a0fc696f129ba3cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 17.6MB
        • SHA256 d568ca3c39919b1b5c0786a98d7eb611a1eceff845a9736a1464a118477406ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 17.2MB
        • SHA256 69c0830188eddb929b015b33d411b37a246d820daff3c004c6b5c4ba71f3c98f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 17.1MB
        • SHA256 347b1c48882890ee72d754a5adc060fb53f4efabdf93f80b7cbf0c2df869016a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 17.1MB
        • SHA256 fc7cfd41b716de1a5ce157199260a2dc354d2f72dd2149b2042686732c7ec56d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 40.4MB
        • SHA256 56bac519ae67e11f3f0608b9443074111c345b0c62a8fcf94c3bd77cae3c08d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 40.3MB
        • SHA256 b11bc416d1724e84e2f98807340c08f6c6eca1b95baed76d4f34668a94ba1ebc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 40.3MB
        • SHA256 a48e7454994218d3a51ed04ee09ea4f238cadac80f357d9b9ea1ed601c9d1d69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 40.3MB
        • SHA256 2b41ebbca5c3621f5c57f32311fc16d7bcf51affefe0d0e92bd44b1eeca0e425
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download