Overview

overview

8

Static

static

3

2026-07-15...ar.exe

windows10-2004-x64

8

2026-07-15...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    20s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/07/2026, 23:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-15_d0d4b9294f656a622740b4f4cc0c483f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 19.8MB
  • Sample260715-29pykabs4s
  • SHA256 012d6a62678b080f47aba72843bc598c7556cb81703fda21f8725bfa357e50ca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-15_d0d4b9294f656a622740b4f4cc0c483f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-15_d0d4b9294f656a622740b4f4cc0c483f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4360
  • C:\Users\Admin\AppData\Local\Temp\2026-07-15_d0d4b9294f656a622740b4f4cc0c483f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-15_d0d4b9294f656a622740b4f4cc0c483f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6048
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:5472

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          AppVShNotify.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
          • Size 20.1MB
          • SHA256 96318d0a699373c1dd0f266d40b2b1515312d40f4fc30147138e37bf1baa03f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          InspectorOfficeGadget.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
          • Size 39.7MB
          • SHA256 51e3855c9b5a2f72fa2162346f75efe116617cda30331def26e3bf6943d5fb86
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          IntegratedOffice.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
          • Size 43.8MB
          • SHA256 f78ca8859941fc71783436b2ced6438279eaee2f2537490ba06de114fe5be9c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MavInject32.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
          • Size 40.0MB
          • SHA256 6cb99ab618be4b3fb2053f1abb3d1c927cc9b2f4cd78d125b0d434830a0cc8c6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OfficeC2RClient.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
          • Size 55.3MB
          • SHA256 273d41aa32f9337298b55464d6e2d4c12ae214fcf485a0d5a8fa9b56e63cd024
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          appvcleaner.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
          • Size 22.0MB
          • SHA256 0dde39c7fac201d38ac5d65f59c4094678d00dc1ee275dafa9f300abe2155701
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VSTOInstaller.exe
          • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
          • Size 39.8MB
          • SHA256 ffebeb82b5282170b330d81bc027298d3f04b5bd5e3cd78e88ec0e60766937b3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrmstp.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
          • Size 45.7MB
          • SHA256 27e435f6fea52ea8a47bb2d5d50eb40cb17edcf07a438dc263178e95953e79f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_pwa_launcher.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
          • Size 41.4MB
          • SHA256 36932809ae69e291931e2dd7d71f9a7bfb59762216a20ed3f75a0534fa31a65d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          • Size 42.0MB
          • SHA256 38d4492319dab025a9c4e2521763f13bbcefc0dbdfd8edb4ff6135eef22c60be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          notification_helper.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
          • Size 41.3MB
          • SHA256 a238e679ccf39439a29d441d6a1a70d1f3bfa3a646ffb3b6acbe802002ade32e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          os_update_handler.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
          • Size 41.5MB
          • SHA256 5d2014dd369bbd078d9b177a2f18892e75bd8c6e70fb513296ee0b678db09576
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_proxy.exe
          • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
          • Size 41.1MB
          • SHA256 87de82a6b6bb710879d5eaed0cee2fc253f064ad7644f45d2a310ed761e809c7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          appletviewer.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
          • Size 39.7MB
          • SHA256 ef13987ed270dfd4becc360a8feca1f108e8423e4c25ead0053d74de842c3e1b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          extcheck.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
          • Size 39.7MB
          • SHA256 d95be79088c69ffffe81e7a2fccd7bf8cb1d275907ccaca1ad6b1d1b0d5b2bc7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          idlj.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
          • Size 39.7MB
          • SHA256 1e20f3caeb186408ca4a10b5202c0be1d05777079330472f666ebb4c559c2842
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jabswitch.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
          • Size 39.6MB
          • SHA256 90585b36f0a6048de80acb634297e36613a77e47741d7ed8eeb466d2b1df23b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jar.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
          • Size 39.6MB
          • SHA256 7405e35541476d01282393e58a7505baf85f27ff5529e45609a819068b92fe76
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jarsigner.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
          • Size 39.7MB
          • SHA256 651edda35c3d90a6d672865b8db88003be3b4f72598d165e9e6ae795b5f04b4d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          java-rmi.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
          • Size 39.7MB
          • SHA256 3e411a0c2486bf1399832198315dd2ec9cecc7731699210552d077f854cd3bc5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          java.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
          • Size 40.0MB
          • SHA256 4639f0e6d1752ee5a47ba715c6a41d0e51e38278df2873e3e732e167284b163d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javac.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
          • Size 39.7MB
          • SHA256 e1b0e0bff9c56fd0dd7141c65324d54bbf7069d2f2c354089ceeaac82a69be40
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javadoc.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
          • Size 39.7MB
          • SHA256 b1c05b1b07f06581955e45664a65a289285d9acec06757749dff88f922bfb383
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javafxpackager.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
          • Size 39.8MB
          • SHA256 a71da33bb367de4e7216a99c2385d9f82d84bf5a9ac34a6b99802cf519f19820
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javah.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
          • Size 39.7MB
          • SHA256 5089838fbfc473dba285246f1811648205395e0d95b2d6cd8eedb1d1c33ed04e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javap.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
          • Size 39.7MB
          • SHA256 d246e93b5ad616644d4650bf5f250e2655224aaa22fbc7cab46e15a2c4c07e15
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javapackager.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
          • Size 39.8MB
          • SHA256 bee32e7ab62a536dd199f0191bdea08962e9746b9f28800ba30713c8968e2a60
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javaw.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
          • Size 38.9MB
          • SHA256 8da79a1e64d006f1ce7faeb9a038f030d9e7eeebe34e56e031e34d6cf11df48f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javaws.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
          • Size 40.1MB
          • SHA256 a035ec8e11ab2f909c6d33d63d0af0514d0f40c4cebb12f1c77baf3c21612dcb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jcmd.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
          • Size 39.7MB
          • SHA256 626040e62e9434cf1cf62938a62a9a6e3bec8408d708e6f5bc8ef54d611fe7f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jconsole.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
          • Size 39.7MB
          • SHA256 78a03283c1a7fc5f5cea92788033abddf73a3bb9bb3c6e90b63cfbdba58ba95e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jdb.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
          • Size 39.7MB
          • SHA256 fdec4fc75896793b4d926fe9c64d29fb506f92b1fb6dd21cffde5b630548a257
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jdeps.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
          • Size 37.1MB
          • SHA256 3486bcc4b8e435ba58c152e0aae3c832d5738938470f6ef352ba7b3b74f4a12d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jhat.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
          • Size 39.7MB
          • SHA256 613ae9f4c604df699e2fe6de919eaa753ed45ccebc67d0304697896f292dd56f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jinfo.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
          • Size 34.8MB
          • SHA256 b05b658a23b1e1e3791c7923f2c5725a548b8e408c39fb7b633249ef05dc97d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jjs.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
          • Size 38.2MB
          • SHA256 bd067d8a45b13c955725270085a3f93aed878bd458d8d6e9e26369d25d5e122b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jmap.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
          • Size 38.0MB
          • SHA256 b7b00a5f308b66cc8e1972d27dc1e20346950e15eefba692b1f181181592923f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jps.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
          • Size 34.0MB
          • SHA256 c0acef4a3249772792fedd9c169c2648879a4a5bc706d9cbebf1d7762efe8060
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jrunscript.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
          • Size 39.0MB
          • SHA256 d890b63a7c33b8e2217efd40e7c7e8e82779413a52dbe54efd1bd7576dfdb405
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jsadebugd.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
          • Size 38.2MB
          • SHA256 0c6f4988977c9ac1ad54688f16958c159747bc6e46f41710ff1d256526a6f819
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jstack.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
          • Size 33.4MB
          • SHA256 0d06a03b89ad5ba91fc678b4972b454bce046447c839b3697712051896d648fa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jstat.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
          • Size 36.6MB
          • SHA256 1a8dbe1d7b6e64d1221ba02da8e19f2ebdd65115b96b0a1ed0b1ce7eb5a93359
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          kinit.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
          • Size 34.1MB
          • SHA256 af80c9a0bd394386f52a91e657c50343621332d04eac13e569610e2d2b696f21
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          klist.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
          • Size 37.4MB
          • SHA256 0c398e256e7d2cf082160c497957b14b5f532f7568cd74410c301f45dd1e6a3a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ktab.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
          • Size 37.6MB
          • SHA256 86360060b0bdac52d8e32742d9c6e9857bfa84c8b6752c441e60e872654fd346
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          native2ascii.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
          • Size 39.3MB
          • SHA256 1381dac284040d567995c581bcf09cfe51fb4fe42f172f9351ad95a108d80528
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          orbd.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
          • Size 37.2MB
          • SHA256 85aeb46ce4e9aacc5c42bae518dc941d632918888eb3ea0dcd1862a26226b024
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pack200.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
          • Size 34.6MB
          • SHA256 02cf98c811367bc20c1d0f759f06d3199be9e38adfb8eca1f72d12a2fb4dc61d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rmic.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
          • Size 37.9MB
          • SHA256 404eb6eaff8fd3fadf19f2e1292ce5f63b63db2e053f7d92bbbe71fe6db1d3df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          schemagen.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
          • Size 34.2MB
          • SHA256 a7c270ec50244ecb2e5e002f94cbe451b35e6178328dbfa5cb6a3c9073d36e74
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          serialver.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
          • Size 32.9MB
          • SHA256 4abe1395048dd6ab997e503ebd4d1bc1645b996833a425086a08109105dff5b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          servertool.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
          • Size 33.4MB
          • SHA256 16f2071f41d9ca81d31a3dcbfc81487a501fbf238443d8c551bce3d0a3abe0fa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tnameserv.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
          • Size 37.8MB
          • SHA256 3a2bbd200724bd002c172592ea140aa9b5af21780d5367410648ce601052f356
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnet.exe
          • Path C:\Program Files\dotnet\dotnet.exe
          • Size 39.8MB
          • SHA256 1fa2805b0f77d5e009597361628ea9bc55da82cccc7b64b9948de28aad373a55
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          createdump.exe
          • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
          • Size 39.7MB
          • SHA256 38a39521e354da9c08587c1de8acd82af12fb6d9fa819273253aba01c05630aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download