Overview

overview

8

Static

static

3

2026-07-06...ar.exe

windows10-2004-x64

8

2026-07-06...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    21s
  • max time network
    122s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 04:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_3197c54aad9e13d07cf7bcb952c4bd06_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 26.8MB
  • Sample260707-e6hzhshy6v
  • SHA256 cab961a3b033baf34a136311b4dfa7cd4246968e229efcb633130bc710af7636
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_3197c54aad9e13d07cf7bcb952c4bd06_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_3197c54aad9e13d07cf7bcb952c4bd06_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2528
  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_3197c54aad9e13d07cf7bcb952c4bd06_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-06_3197c54aad9e13d07cf7bcb952c4bd06_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3408

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 26.8MB
        • SHA256 d0cc7d982c19b9a77f5315a9ef6fc54ca95ce6029213d34df25f3ab0d672bb96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 57.6MB
        • SHA256 b9132cb8ceb352afba88331558fb563298c93c80df049da638e39a60b84e0863
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 53.9MB
        • SHA256 1a7ac62360ac516787140a4694d38c62e665923258f6944fa91d1935cd6fd45e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 28.9MB
        • SHA256 72dc9ec7fd5851a3a7a688ad2368f24dda2a457f0f72668e578b243a9c2ddbbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 53.6MB
        • SHA256 836b0029d67f62f158fc0309fa581a4c3365959686e250c1fa421069be1bdb6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 55.2MB
        • SHA256 6e67526d9f1eab81f1627ced5fced9da3128f09b746baf7d801a292b00e05261
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 55.1MB
        • SHA256 77fb30697dc509f29d8a6e3a31fab888460dcdb145284d9583ee25a4e71cb211
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 54.6MB
        • SHA256 59d92e5227105d0385108753f8b1035c054afa245241a376ddb72c18ef080a90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 51.6MB
        • SHA256 479a3d5239f377723acb4283ca76a5c83f8c8a77cc6b08716d8d86ecd9656971
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 51.8MB
        • SHA256 feb4bda05d6c1ccc9dc2b2082b8bd2589ec9a125f064604812b3ad6b013749dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 51.1MB
        • SHA256 77e3f64b95c6bc4959a7e351046569c412b87c29863269c69e9d231b2290d833
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 51.7MB
        • SHA256 fc71d1067198ef45f28130e4b76167dab0d781484020c038fa7ed71f7849142d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 48.8MB
        • SHA256 1efa1f3a5b7796634ac85a171635556c3333cd5e85dd3d7ee971e564d1bac496
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 26.8MB
        • SHA256 dba40066c63647a9a5e279ed4ee3ddc767c903b5d2f58de3c392adbd8aa1ca9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 51.8MB
        • SHA256 5471f28b4851e95c74d83f917be4d71be4f852380f463f2ddfa1233e12b537fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 48.5MB
        • SHA256 5fab897f4e7ee93ff2b7c30861f7c12afc2daa7c2e911ea1c0853e789644eb62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 48.6MB
        • SHA256 62df9040cd96f90377a6e98e6506cb619b0f518ee566bde378c978bb743a42e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 48.2MB
        • SHA256 c8f7bc36a7057009aa0cfc97f7ff5bc1b57a0bfebc355fe82701cb799cc83adb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 46.9MB
        • SHA256 669b11b331f24a936512757c41fc14a021a2cf820e2da447fd85c4ccd14010bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 43.6MB
        • SHA256 94735c8808440644a68bb0aa791cc458bd1b17df4bfa8b35e556ee9247f7455f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 45.6MB
        • SHA256 a1d9145abf0eec00bb96f5df403aeebec93e35af54bd25bf04be4bb443060c33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 43.0MB
        • SHA256 4dc412389f221b24fb2be318c00989030ef35a87577f9c7cfc4ccbc63643c856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 42.2MB
        • SHA256 79c5366deef10e2f93677142982e4f325f4d0f3acd47ed7f415209999201800e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 41.1MB
        • SHA256 7c328bc944287813997d873c08b1b27a1a782496accd644b0a95565a36ca845c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 40.4MB
        • SHA256 ca1e3f08f7d9ec32b0673bef7148349f10a089eb327da5668dcceace5e94ae24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 40.1MB
        • SHA256 fbc804916deec9bae61733c444cdefc12c04583f69da3b41276936804e2c0e0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 39.9MB
        • SHA256 793896e04c111c436db0d0f526e3fc3fefd3fd27c361f64b76b8d865ae8820a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 38.8MB
        • SHA256 0ccd5b383f6dfcb04f54dbf3f6fa8bfd126dd1292e6ffb63c456e8c106d69eb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 38.2MB
        • SHA256 d8abecd882cdf553faf8a06fac05825a9a869df8d57b69a7512d6b29049fb942
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 37.0MB
        • SHA256 5241067ea02f931840c204370ae4ee21ac20143f2bdf2f956b7c1b5cc54d8a4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 36.1MB
        • SHA256 98d71d9acb2696829b3e69b9a8da5e6988abcb6480ac2d500233502c2fec32f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 35.9MB
        • SHA256 2e5b8b7d234743a2caefe768562c227a9e09ba5210307ac36be0c6b72ec5be69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 35.1MB
        • SHA256 f3936a5d36c89bf3dfd9c63c0f3dba3a5884d1a761d30ec174ac425aba91870b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 34.7MB
        • SHA256 65134619012889fdfdd077ad58b6598fe97373a410e05a7ad1ef8c93784c7f22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 34.2MB
        • SHA256 6df8b45baabd7b67e700113b59283fbed25bb6fde3b688546893e420217ed824
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 34.4MB
        • SHA256 93374a350b08cfa742503e1e9b1c4f319ac592acf2ebd6790ed569fe984ebf78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 34.2MB
        • SHA256 5876cae65e2da1005ebafe9bfd0f03787dc9143c91c2bb18f9958db05281095e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 34.1MB
        • SHA256 8091b87138fd429af05c8c14186ad7bec149d24b41ed12a545074520cc627fe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 33.9MB
        • SHA256 98cec6e86feb8df972f085e4a292890bd5921fe4d3c1e5f8231f23d60fec5ec0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 33.8MB
        • SHA256 18a92d486616f82d10b0b9ee025cb702a79f9c25dd7f79215f48f65031261133
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 33.7MB
        • SHA256 ed3e3025a1b0c72fa762880e44896f8cdb863d44f83a20ca7c60f132873f66aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 33.1MB
        • SHA256 7c1e0700435618d8a84065cb4215ef5f5dc9609fac7d867ce4676878a69dc35e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 33.0MB
        • SHA256 88d138a408e5823f454056285e23d6b0cc8f6bea0f4b4ee186ec44b5468d72f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 32.9MB
        • SHA256 e4950788bb5e99bdf561c3c876367303eeb0b890fdce1505738b731fe0c73e14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 32.9MB
        • SHA256 1589607542e85cfd5f3864bf6f1abdf72a39e74b5418466c32def4b766cd4785
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 53.7MB
        • SHA256 408c6026a9899010ddc21cccef88082e8d65ba3e72547d68c36a7305f07f97b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 26.8MB
        • SHA256 d2d9f6a08f1f1aa6df9bb79ddeec0f769d7ed32dcdf3293fd0fd7d2dcbb238f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download