Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/07/2026, 13:29

General

  • Target
    2026-07-11_4ce1ad6fa8e0d7d12fb56c8ae92f0053_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 7.3MB
  • Sample260711-qrf26adt7z
  • SHA256 6091d19e41b6de29ca384013fbc6987d86fbd339e391a4771353cb97a0376d02
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4ce1ad6fa8e0d7d12fb56c8ae92f0053_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4ce1ad6fa8e0d7d12fb56c8ae92f0053_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2692
  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4ce1ad6fa8e0d7d12fb56c8ae92f0053_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-11_4ce1ad6fa8e0d7d12fb56c8ae92f0053_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5792

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe

        • Path C:\Program Files\7-Zip\7z.exe
        • Size 7.8MB
        • SHA256 c11c21056975dec6e0438b1e8de39975e951e8f3027385a0a5e5a61817d22550
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zFM.exe

        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.2MB
        • SHA256 d5f3f5df81581ba30ccdebec12409bdc636d2f92e245a078b1296262fe0714ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.0MB
        • SHA256 fc52547e4aedde2a999b4e38162bde46a989f506fd904851456f7f8c6d821a62
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 14.6MB
        • SHA256 a31c7a6dbaf4bdbb35e4d6f97a37a8a9feb1a8e6477215baa2a4fa91d5efc711
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 14.9MB
        • SHA256 1e291c6e8fb44c682045877432338d905882d5657e13d314c1a982721bb987d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 14.7MB
        • SHA256 622bec044f898ba76d54f5c4f0661e3aeaf8bc686b8aae70128a9635f0e93579
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 18.7MB
        • SHA256 9d63e023a4474d250e992c56a33d3e30f6c83eb343a483b172bf9a4cb7251cd0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.0MB
        • SHA256 7eafd5502319152a95805a7a010caac431d24857fe5aeb1845b79de012247547
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 38.1MB
        • SHA256 a85a966129c78f537e8599e72cec9c2a1cebcd7cc7737bc1d4fae744387bce36
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 16.7MB
        • SHA256 e716c761fa190b271784410ed914491f3056eeb201b87388b8b5441e543dbb22
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 14.7MB
        • SHA256 311be6dbc0eb19f7500753001dfec0bc457852b576fd219a9e07a1ff55883b69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 20.7MB
        • SHA256 5f85c655f6b936243b9af22aa3479c000fdf27667d37c15c94790768610e6c89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.3MB
        • SHA256 bb57efeecb82c8e3ccb3ea3954c7c6898eae334fb4857db1b382bc5cd6ffa2d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 18.1MB
        • SHA256 42bc8e2319db90829ce65a1921fd1d4915bfc1a48d6420d6c11e069824eb595f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 16.9MB
        • SHA256 d9a69f425c7338ac4dd7d27bb86225dea26cd79532f511ee43cf00bef7664fe3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 16.2MB
        • SHA256 e6d36dd202ae4fc323e299100d47178438e9a711a4fc7c4425e10d783b27f262
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 16.5MB
        • SHA256 04317dcf048ec8507ab6e98a867ecced464884241c54e0ab40df2f8da5dc3d68
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 17.7MB
        • SHA256 c2c4587c75d247ceebbfa8c1c13359693c84ccf633b144ff4ea47b560f229ffb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 16.0MB
        • SHA256 3c9232dcdbcf7b4790ab3266ba3f6f8b8d342f3094f38068618ce1345b5cacb3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 14.6MB
        • SHA256 f3177f7451daea2edcdc7c02a2759a4c6782aa037bb03949a9b7e41e7dad2a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 14.6MB
        • SHA256 e282d74f361d24e0279b2c692c3fd017ae8db24a7b46cabddc273cfbe40c1a20
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 14.6MB
        • SHA256 be5842b3667d55813a3370535171942c98a93bd03ffaa6fdc649d16290488675
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 14.7MB
        • SHA256 d77ba299443e373688422ad1bf7e612cfe37e404aa511e24be318203a228f7a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 14.6MB
        • SHA256 aeb1b77f94d92100f3ad69ccca35c29528ff695ecfa86b0ae40555853edfc48a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 14.6MB
        • SHA256 f301921e35a6eeb2e98f11067e76fa0a957d51889c0b946f213942027c8c9f92
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 14.6MB
        • SHA256 002ca7b01da38ae655f6c73a53684fba022eef42cb208ac4c8c5b1765713f417
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 14.9MB
        • SHA256 bb7807de2673cc52837085713ebae4ffa0bee4c40ba3c3f98ad43ed03827d626
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 14.6MB
        • SHA256 97c31047bbc92ac11c5e8f8fd5263f2e0354a41c11de71e825ec08590c916582
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 14.6MB
        • SHA256 8eb9104ba1ba70db337e04f5e921c545be6a06969913e50ca27ca9b9373b6884
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 14.8MB
        • SHA256 91a9e4d36654e2112b247a3e98c57536321f703e14b8eb1053213045b62be3ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 14.6MB
        • SHA256 3893d626a85105c21f8a8d6219fc99b84b5eba18d2fe2912e289327cecd56f65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 14.6MB
        • SHA256 7ef89887aa1a8a5f2f65a906984387ad9a1827ddc51a74aaa06e3f370e84dfeb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 14.8MB
        • SHA256 ddab8d87dbe815d147fe4655c1733c444fec7246797211083c0965915a0b2ff0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 14.9MB
        • SHA256 629c780aa26841364923ba1d2bb377eaa1f4bbc53575ce0fd1d4a13d9c2d883f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 15.1MB
        • SHA256 f84c461c2a6e195ac32079d3ead552089f7298784517c9e38dc60ee52a12f826
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 14.6MB
        • SHA256 9c60bab3fa4e474897d60c6c4bb5e3c4af74ae23249c05311fae4ea231f5ae03
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 14.6MB
        • SHA256 4a7f5b0a06017550c2bced5b6d4ff2e67eb064f1aabbcde6123a4794a5c1121b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 14.6MB
        • SHA256 58671d94bbd3f2ef23ba8eabfe2068d49659a789dbaf2b437cbd3837f5baa413
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 14.6MB
        • SHA256 d27c18eaa65984e5dd477985090be2f52ea814d0a154f0da6e96f49a3e5172f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 14.6MB
        • SHA256 b573979c01acf0edf9aaf494778c341362141de3f083d2638ecdd68341123b17
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 14.6MB
        • SHA256 1e7080b6271398bfada511d1a1bd4de3e72173a0cb7f88160ff2a3cd072fe221
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 14.6MB
        • SHA256 aef1e7cc9ffabf87f3c4bc8d9a2dac08a9c43c2f037384d586513e5d092ef615
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 14.6MB
        • SHA256 b0cf9279cc37f47e53705efb53e4fe10b5ce5e198ec6afdd2843139b32dc96fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 14.6MB
        • SHA256 364c0a9e88386426d143ce69d0fcbba629dd07e226afcc557dd829fa17742b71
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 14.6MB
        • SHA256 248bcfe7be2a08da64e875b04d98157a79ad68f325a9bdfa736e5cfdaebcb6f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 14.6MB
        • SHA256 e41605412a6a607921a9342be99712a3a6a49bd7a4dafb452c207708168b256e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 14.6MB
        • SHA256 f75c52edc199d9327704ca672a862afa5318808ead0b0b197380787d35d2e337
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 14.6MB
        • SHA256 520a450626fd71de7c78560646a4a7ad593a6543b8e18e4021aa5cfdb781320e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 14.6MB
        • SHA256 0877a2801f7817d99d35c595671ae422ead0dcf4d8accf38f8ff166933fc994d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 14.6MB
        • SHA256 4f7a4887aa1f2dbeaaf37f8df39ba87f4000f5f12c5c7c0d538756e144a5b30b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 14.6MB
        • SHA256 e4726bd4d4b5f68c086340007ea7fc102362844ff1bed654ef86747d666679dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 14.6MB
        • SHA256 a1950c1a21e1c724e761574f6d64496a115f75a167fcfc152eb54a0aecc09472
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 14.6MB
        • SHA256 ad072592126267ff53d553c0f2844b9fb08d0860342cdf1df9f399b5d5b501a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 14.6MB
        • SHA256 767117212a213059649ef986f25c0d0d5a9de84ef40984c23617b9b3ba1d9da4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 14.6MB
        • SHA256 6ee73ace03a747590db06c17bb601cef9afb0052f22984b343fe030aa5a27321
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 14.6MB
        • SHA256 44bc2c291826269bc9f4b5a1030414da8c78cedb32c87ce19ec77c1cf31340ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 14.6MB
        • SHA256 9ecd85cc7a27ac7e977afa617f0fd0edd1d72c0839489ea4cd1e1553f579f46c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 14.6MB
        • SHA256 7c3f5227f6a29f389d7a0d62aafca0148d845439dc9c18cd422aee38b25ee531
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 14.6MB
        • SHA256 409b9f83179a96e81cb17424cd3244f2edc72a3d99f57f967be15ad1646d304f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 14.8MB
        • SHA256 4ba520b0f47225509bbb2cb58bde6a31f7baa0dcf9512ddd0939f5dbcc2bcd92
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 14.7MB
        • SHA256 08a2a62f408269154ca0a49bc69502fd6282b2e1dbb2debfc7721ef29294b61a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 14.7MB
        • SHA256 7ddd003eba26072f6f87dc904843ee9f324adae6ad98c75001f1634ca002a26a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 14.7MB
        • SHA256 b3aa86c498f587bd8dc66438139dc390bc81f95e30816970c98fe8cfcebc1503
        • MD5 SHA1 SHA512 SSDEEP TLSH