Analysis

  • max time kernel
    150s
  • max time network
    117s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 17:25

General

  • Target
    2026-07-10_b44210ee4e37dcc2c94dba3bc679446a_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 7.9MB
  • Sample260710-vzbjvsdv2m
  • SHA256 ffc37667cb1be3d5f02748794d26eb75c22edd947d2ddae4378c082b614c7c15
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_b44210ee4e37dcc2c94dba3bc679446a_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_b44210ee4e37dcc2c94dba3bc679446a_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2548
  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_b44210ee4e37dcc2c94dba3bc679446a_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-10_b44210ee4e37dcc2c94dba3bc679446a_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4884

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.6MB
        • SHA256 ecb6f54e0f59ad3ed0e4fb5e5950a81d729e67d27f6a5d79e9075debb8402029
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.8MB
        • SHA256 5ce839a9238c356189b31847960a58ad9d8729fa7dbb26f63fa48f890c86c171
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.1MB
        • SHA256 8b39d37d98f8c3f5a2bc998c22baae8f2d187c745e7fa23211c1dbe2eaa329ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 15.8MB
        • SHA256 431940d8baf26109e59c94cfdd49493f9cec8d2e464e0d9fd66a8b41f5fa858d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 19.9MB
        • SHA256 3ee53cffd4bea380cb1876bd6316c74e6bcceed5311a45959fd4490dec292f6e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 16.1MB
        • SHA256 9363123ae24517692b8240dbabf7f929b28f7fc58abd44471774ea88e2fa1ade
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.9MB
        • SHA256 6e0e99d1160448319f98bed3ecd4b5323a012a4a8bcd87641bd4bab6fb951e4e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 14.0MB
        • SHA256 09fe15eb87294c15399236f7e2c887768ba583a7593f887359fa14a1453472fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 7.9MB
        • SHA256 ffc37667cb1be3d5f02748794d26eb75c22edd947d2ddae4378c082b614c7c15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 10.2MB
        • SHA256 5042a1ac78f34a333798a3f4042c45e11ce9f097527ebbbfc4e29afa0b0bf468
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 17.4MB
        • SHA256 e9d0da969604b7aa44a025f180558d7f8e8138133a45bd85afe965c8f28f1abb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 17.6MB
        • SHA256 aa3123a929a6c2b3270c7fd20b3598d0448dfe8f61efdb55ee7b073d4a38223d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 18.9MB
        • SHA256 0afbe848094e7fd4db0ce392b1d2a5259103ca4446b7cd9550533af410e1b252
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 17.2MB
        • SHA256 57f77d4465838e13895a78e3eced92236a9fba57dfdd56211f8a21504515fb14
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InitializeAssert.exe

        • Path C:\Program Files\InitializeAssert.exe
        • Size 16.0MB
        • SHA256 08f0f38afc59f8f1366c5b212bcfc4d62c87480c3c1b6a28cf1bdfc2d18c665f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 15.8MB
        • SHA256 dc55d9a8064d03cf4f1d1c1759cc25078521193a53f65976ae757d95efd87a93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 15.8MB
        • SHA256 976c6ac2a010978a5313ad8105ca64763fe5cf1a7a5c3e543587406d66939b3e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 15.8MB
        • SHA256 c00b9bd4f1c3b1410ab631b4d271bef6012f5246cecc8460d01c95c849d5aa2a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 15.8MB
        • SHA256 e34425591fc5506d7ddc37faf95783bce18d11ccacd85a891514b6eefdc8a96a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 15.8MB
        • SHA256 0c2fedcf671ff75ce93955fa9609d19da0e44ebe6c5e8253f46ddd0add5becae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 15.8MB
        • SHA256 e3715ccfe030af1b526695f99725bfcade7128603b56aad790cf2491cf37ace5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 15.8MB
        • SHA256 364edfc4ad629cc70ab2fdc66ae8d71c7a926881101d0b59b9877589df464ae9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 16.1MB
        • SHA256 d29ba037afb452e38945061512327974da82308a883dece2e137f520119c7925
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 15.8MB
        • SHA256 2b29f2c2e7eff65e7ae5a23195b6069dd56de4433db68864cc75cc9d16ef4f50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 15.8MB
        • SHA256 9e9a27efb44abedd1139c448c98d913ebb43fafa58840e8bdff4db1e48458eab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 15.9MB
        • SHA256 eb72784d62a9d5f856fe1895720f4471f39d49d2c5cba6c8aa36e921ab0c5f32
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 15.8MB
        • SHA256 0a2ef990f0c01a5ec422e48d555ba9bfa30684f32ee8dd35e07dca8acc312140
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 15.8MB
        • SHA256 21dc906b40f24dc4d6415e93d40f142cee6fa2a02d32ce3ff8409da8f1da3e16
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 15.9MB
        • SHA256 d482b79cfc6e692ebdeeb21a7a71cd1ae1b4296fe6b308327d677983f922e34a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 16.1MB
        • SHA256 bbeaec7c2f3190a3b4336aa1a645ae1ad70685b6d3d738ec41f5a1fa51b67a50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 16.2MB
        • SHA256 5c50d5ecc98ddabff06286be0fbd35400f371d92471a4ba4be3e632504a97442
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 15.8MB
        • SHA256 80e67fe1880d157aad5eabc4e6405ffe91943e5a24077e57768d1a654fb36144
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 15.8MB
        • SHA256 d98d887136aceee9d17d4600623149f784a2b07bbe90526c7f55145c80877842
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 15.8MB
        • SHA256 93561691ffed9ce5b729927d8baf6f90849a0c59dbd30b269f640874db06a067
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 15.8MB
        • SHA256 ccb3fccee1a70f3e7068a4e74c1b09a04c66908b0c5d4da68c813a0b99e2cfa3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 15.8MB
        • SHA256 8f1788b7019b79d36475a9f77eb76f920ed229c3a51b8708879e49dbe1ede1c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 15.8MB
        • SHA256 21417c93ca402245ef48bd52ced062e4d59ba8da68b9a7ad00922a2f75d8d348
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 15.8MB
        • SHA256 5be7ff4d96f859ea2620e1cba0a9426455cdf43d364fd6a399df72f9d18109a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 15.8MB
        • SHA256 ed5f600d32bb5d446df7a2932bbff184020037aae73d77e815695a484bfe44c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.8MB
        • SHA256 f9b6cd688d1345beed6c9f69c6657769d4170e7198026163b315ddd8baa1db85
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 15.8MB
        • SHA256 fad5f12c7089c2aa7935e760cf2bd3d7385535d961ee2d653536473d4bb31dca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 15.8MB
        • SHA256 d10c0e72ec3631572a8af2f492ed6eddc9dea2697df13193f964c6fc74d7c252
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 15.8MB
        • SHA256 0f669c5633011ea7294c66306edb134cef87adcd263d296eefb227fb84b1d6fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 15.8MB
        • SHA256 16503e65a4a2b02a279c50d158f8b8bb65aaff4e14d38d0e6f3556b2c2e52612
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 15.8MB
        • SHA256 9fdecdcdbdd8755e22d707efc1acab4679a74443f67a7e3192abd6a08dfced0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 15.8MB
        • SHA256 218ac229a61d76131943f01e041fdb0748ed61e0342a9cef7b353ed043255d57
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 15.8MB
        • SHA256 5a39bd005e0ba2a60f4b3b9f6b0624ecac19acb52ff93c24869bc1086f02271d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 15.8MB
        • SHA256 6c1bdbbbcca291c14dfe9b94e365abafd6b0ecb30be77860a58f25c5ac5a1b3e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 15.8MB
        • SHA256 0a9a0dd38e9cb24d12b1abfdd8d78530c81b895afdea50c1cd2374ece40e355e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 15.8MB
        • SHA256 f9ede354b7c57f48b1d2a7f394819e899e9f132afac2619875fa4cc03313edbd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 15.8MB
        • SHA256 a1f7b4c1ff68f65c0303ea44d50cb32cb0d95bc600cb252840be40cde76c5c30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 15.8MB
        • SHA256 77182929551a23ec54d80a1b10d8523b6a2019951788062d895629c595ea798d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 15.8MB
        • SHA256 f591d449c8742c0fdfd70018b95858369772b9f980a6044ad06e03d3d730ecb7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 15.8MB
        • SHA256 316eb38d4632ee50d251e1457e3572459f2e5c496042f2c62acac5f8257c3cbe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 15.8MB
        • SHA256 cca63c262024d89741eb8b59b9bd1f436568ac7d2d506549dc8b15ed423011fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 15.8MB
        • SHA256 08b6d43c1b508256fbcacb442959360f59deec1f3cc6d5e8d4744be2bb47b83e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 15.8MB
        • SHA256 8cb76b1473e87020a4b91b50a2e1313b3da3fbff014d359b871875eec592f474
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 15.8MB
        • SHA256 74d0d6320add9e6115473b99d9c7631bb71f179d7d4d2eb9a3ce5fe88a795974
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 7.9MB
        • SHA256 9a83d96faf8135feb58562eb16239fa36cd0fcda66273af4fca1364ea867da58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 15.8MB
        • SHA256 eff3bd01b90be4957ee44e1034a1ed05a1abd501cac62d984b4b83af1104df80
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wsgen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 15.8MB
        • SHA256 427d4076e97811fd2e378fd17144b757cfc009d0ae43606a030b616c15b5ef30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wsimport.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 15.8MB
        • SHA256 74134c509d137b3d49f2cc79efeb0b8be5831c36645b92e7746ded71d7b61972
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xjc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 15.8MB
        • SHA256 0577aea94b2bc1710ef2a680b29084f90ee4b59c9826eb51b57ab1b5a0db5dba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2548-1-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/2548-0-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/4884-25-0x0000000000400000-0x00000000004E4000-memory.dmp