Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/07/2026, 19:08

General

  • Target
    2026-07-14_3cffe8afcd641001c68a02536e91945c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 7.1MB
  • Sample260714-xtbzjsby6m
  • SHA256 9527891bcfd21eb5ae7cd615f611a24d05f7e9660e6d0a697bdb6f575fb2cb11
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-14_3cffe8afcd641001c68a02536e91945c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_3cffe8afcd641001c68a02536e91945c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2164
  • C:\Users\Admin\AppData\Local\Temp\2026-07-14_3cffe8afcd641001c68a02536e91945c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-14_3cffe8afcd641001c68a02536e91945c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2128

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.1MB
        • SHA256 49a539ed1606bbc8474d82c589f5142f4da2149520ac35fe69d2f3d782b9f84b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 7.3MB
        • SHA256 ee70e69ca1fe507c6bc844e2e8a7537888e845f44611c2c0578fb92106cb0c55
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 14.2MB
        • SHA256 45fcac274e5778b0b4e80c6b71dfa741cc770c87b051979fa26770bbcd6d3a8c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 18.2MB
        • SHA256 e028135849baaae6b7e7dd1ff9031b75263d621751dfee6a3dc643d6af9f8675
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 14.5MB
        • SHA256 04efd6f06a91fc8e66c5f69cc1eed6357ea906cb998bfb3ac0f0931bb5b6d8b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 37.6MB
        • SHA256 285839c5dced00d1c7b9540e28d027d626e871d7635d49f9a10269b060092ef8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 9.2MB
        • SHA256 aea10c7e2f7779c58e0a626d0d8b728b542936a73d7f5de8f9161643249e4d2b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 14.2MB
        • SHA256 73213e57d8834d66313f4f588f2f0d451dffcf4e572e9aea81a0285fda801f65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 20.2MB
        • SHA256 9984f4b896277de8e402aa9a30c0b00d74132520cd1a2215a6c56bc8a9f04679
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 15.8MB
        • SHA256 978a11d09db024d1fef0238ecc645011ef3e92c3910836cc203b337f1dfc336c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 17.6MB
        • SHA256 26ee1b9bde77d43b7ae760ad121804861af0ec832184a9b83b901eb883d9b7ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 16.4MB
        • SHA256 d91bf4bbff8d01c5c4bd1a929be68192af8f2e382a16bb6f992f707ccb140978
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 15.7MB
        • SHA256 81fa7a1167950843f56c6c54cf91cc06a4c7aa3abb6707ea1d3fd4b82ba01166
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 16.0MB
        • SHA256 2211c51c683a722f5dd3f4739c7e3bc4847aca68463667665fa47367d71f2a0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 17.2MB
        • SHA256 e262ae7ca9f311e03cb51fc9522c530abdf4c815ee07353366fc03c8bd8b1dba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 15.5MB
        • SHA256 e386ba92f5c6df164df52939c5dedbf5bbc8f28caf85aba2fd0ba3cbcbaf6972
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 14.1MB
        • SHA256 fbb99b2a4756674d97f2a9572a8d5993064a23c54be987ef5b40fc145e03b526
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 14.1MB
        • SHA256 01e408746ec65917e763e0025f70ff6b3f9cd2c15ede74da3ec8e11e84a238ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 14.1MB
        • SHA256 dfcccead1f0c6772a617246465ab4ed35f87ef40c4236a2c5b6aa383575e0d0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 14.2MB
        • SHA256 e447acdcc06c85c3a8dcd43ad149a5890521dfe5c0a0c4be33ce3e7e43681654
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 14.1MB
        • SHA256 bd1634d66a62a3329ba81d917c0f9422064282f6a7082955e24474e827a8344b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 14.1MB
        • SHA256 deace9e838fb17804ae945dadd72e412149f8529b1ea53e1b864ccbba87aa622
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 14.1MB
        • SHA256 880112616cd2607a0d7a64d338a1f203bf144b6e3f767bc8c82888d4e60cf00e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 14.4MB
        • SHA256 4920eeecaf2277ddce168c79a78296f70cc0c94241230df481809fa9f2d24bf6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 14.1MB
        • SHA256 c54bb59861813b4ba5a5b0b168bf21e2443d4558366d26aaf6f1874a2d0073b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 14.1MB
        • SHA256 9d0b42ce5dbe408f24310b719c82ced0c7676adf6b13114ce5398e3762ad8455
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 14.3MB
        • SHA256 6a7154180d1add23f7ba2860ef0f924d52c1bc0c63344b62eb28252731598178
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 14.1MB
        • SHA256 fbf2e3c02591a4d3b4c4af15d36efae4e49a7cf790e830c39986b265749c360d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 14.1MB
        • SHA256 bb6deac8438bd071d499c4321180bc0a8a40525f8ff8134a9790ec423bc83849
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 14.3MB
        • SHA256 753c91f0f634c3b339f466798fc10973a76194c8e2812e88bcf9161f0c324978
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 14.4MB
        • SHA256 a759c6cd6c7fd279f68ada1e7a5d83c3d24281122c59c13e76d039fd39e8d9ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 14.6MB
        • SHA256 4d7c22299c48ac10d135f08e9f36acec99b148dd4f5caca96ee33bd6c3bcf10c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 14.1MB
        • SHA256 7684496bda016a3d54a208c05145e42a66a0f95f18f19b522ad1a40793a86047
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 14.1MB
        • SHA256 7ba488240ea1c99a9f1de3adabae997736f60a1482717e0949bc84f115202f78
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 14.1MB
        • SHA256 86d0b5c6f68aa90778e4894e80fae93686fb18a5e9d1c6a7339edcc9f5320754
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 14.1MB
        • SHA256 84c8bbe9ae0e75b5f639bf6acd63052d79568291b2af18f352180a6cf4a746c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 14.1MB
        • SHA256 dbdeb4f0e40b13124e63ca51985a7eff2a94369d0cd87a0a6d340b77931644ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 14.1MB
        • SHA256 15e226579390b519952c356b2790a6433874025f1e98696e27096f06e55c7a0a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 14.1MB
        • SHA256 1682e537383558ff49ff679d8d2d7d21e9b0fd720da2335092c1fd46beab427f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 14.1MB
        • SHA256 f5279da2667a47e320ec80b4bcd68210db05cc363895383ab3b913d2bfaae092
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 14.1MB
        • SHA256 1f587217e7fadec09981e07e9adbe100c0b1e0a7853f157389d890f1091b492d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 14.1MB
        • SHA256 41480b7c83a2de46e05850b19839c0f9a31a7e57292a3c7e4a19bd581dca98f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 14.1MB
        • SHA256 c50fe6cbb40116db4cc094993019bc852ec70903e1fe98ed4078256a3d33249f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 14.1MB
        • SHA256 2c44b19ea35acd961f750b72d06342bd813800c426d0d1e85a9f3df6b0bb11ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 14.1MB
        • SHA256 d6f2287112472b0fee1040f0fb4f6edc56160493a5d05028736ff9d20b2e2684
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 14.1MB
        • SHA256 e23ed66ce435f9bd2006452344b73ac87733cf4575cf776bf4957634a9401347
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 14.1MB
        • SHA256 621beb5a8dbafe30a27836d09c3219a002869a4b60d19fcf5382bc1581383f5c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 14.1MB
        • SHA256 533c380e7883e398742805b860c7421648d473ed5ac112678dfbcd2632574643
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 14.1MB
        • SHA256 2708ce8e5cb274c534b98a71c5020c75c17286e4a061707f56deb64d0c936efe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 14.1MB
        • SHA256 69cf49c4146ef67c591102a5a32fce385161512460006482d2f4fc6b7c86f9de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 14.1MB
        • SHA256 1ac9ec4b7c6a2c5f4729e3ed084de92473061d77a86d0a8e410a65d155608273
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 14.1MB
        • SHA256 0f12ad1927ab0a8b07dd2c242feabc4f26974a60965de2aad04916e9ba0ba2d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 14.1MB
        • SHA256 4c439088bb48c5981010a306d0df43bee518bb84f8a9553c7379a83ea648465b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 14.1MB
        • SHA256 0da2c989d5acd2cfe5b5c947d69b824bf4a0c8cb48b49a7c88b255a20625c5df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 14.1MB
        • SHA256 12996fd6c74ef6f93c887f7ce9f243ea899efec7cd62b42e714f64b90de31484
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 14.1MB
        • SHA256 82846d2f1da6ca4c8e0538f07df477fc53c0989082336324f07afedfeb82084e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 14.1MB
        • SHA256 57b45cafd316c21d6341008a812cf10dae2217e142cd830aafc5674aba88c566
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 14.1MB
        • SHA256 304886ab7abe2056cb5e369983c503daadec137d3a25e7ff138099beca5fab46
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 14.1MB
        • SHA256 66e6d369f1b3a431d74e6c82898ebdc4562ed75cc5fd2e2a9f70991815ea8eb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 14.1MB
        • SHA256 a3bc1552c2f95cb1ee42d967d0c349e8a99f24a15a9a6bc4c6e59c6290d2f142
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 14.2MB
        • SHA256 a02e6a85c4ed7951080e5d7ecb7d1a0f845bf01d64cb1c46c1f900def2b2811f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 14.2MB
        • SHA256 4a654fcd25a3db3f7f3cc65e004523cdd2a979096c0df51af0d7103333b4c2c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 14.2MB
        • SHA256 5a89fcdd9253705dd4d9d368e3ca1e2794a9dffb7097aecee83c0306dc90fafd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 14.2MB
        • SHA256 ee0a17b49d24fe37e437efcd210d1161f445a1755f442dfb474a13457cea224d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2128-27-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/2164-0-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/2164-1-0x0000000000400000-0x00000000004E4000-memory.dmp