Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 06:09

General

  • Target
    2026-07-18_d9905e6aa24a2fe8b860f5b021d3aa4f_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 9.5MB
  • Sample260718-gwkfpsdv51
  • SHA256 87a933f878f0f3f35505c99aa64d7ceafa5ad8918a36880b345d20c8195e505e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_d9905e6aa24a2fe8b860f5b021d3aa4f_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_d9905e6aa24a2fe8b860f5b021d3aa4f_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3564
  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_d9905e6aa24a2fe8b860f5b021d3aa4f_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-18_d9905e6aa24a2fe8b860f5b021d3aa4f_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3076

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 9.8MB
        • SHA256 6f529cb592e5d398d8ac6bb335cfa43d133e58e216cb55e18448320d3e025e8c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 19.0MB
        • SHA256 2fc4e92468c9e09305e18824c17b4f9b738a21b7cf1eb022b57ca25b05ae3d72
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 23.1MB
        • SHA256 b067e7804e5c03b47b803b2ecf919d18fa2e8bf8b10c228bb2545a4fe3cb8fb4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 19.3MB
        • SHA256 ccc2a6c58c5d971e5c4ba360290ae8f0f987084c4cfdaaadd81644c3edab601f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 42.5MB
        • SHA256 0e3a725f251de46e939ae23f01d7a9e783a8a59776ca7c6525846722abb6e9ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 11.6MB
        • SHA256 aed990567ff001ad7fd1d788f3db7ad2a46cc08a2b89db409124a2674cc8b9cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 19.1MB
        • SHA256 568f765378b7dcef5ad2a8c03e797684d3ebb892e17b93570bdbc38ac7c339a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 25.1MB
        • SHA256 a3b0b7ec9e4b428b274067008a9e6d939fadddc4e30555a39d474fb849eb53a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 20.7MB
        • SHA256 f1bd296fb85966c55b5431d1979628b62a24b354cbac302b4ce61fc58f48753a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 22.5MB
        • SHA256 77c72db7ebda53011d241fcec64d7219d3ffebc59528e5a5c05519348f7af457
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 21.3MB
        • SHA256 913ace47e014b3ea52b7aa2da3e86def5691aa856a100668c9858cf43f0a96fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 20.6MB
        • SHA256 4a24cb7d40d2667c762e9610c43fcdfa329e7622e36d4286acad73bfc9ff6dcb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 20.8MB
        • SHA256 31093bc5cb8bbab10edf2078f28810613d5d86d62d4d40f6044c53bfa5e930ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 22.1MB
        • SHA256 1bd9e8770ec23b6339559c63b8bb0e27a52a99364ba4a69a6b9bf5e620522249
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 20.4MB
        • SHA256 8569798ae4decdc12c73b9ef344b64cf8c8d82e9e71476a9d3191570aae9d7fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 19.0MB
        • SHA256 28478bfa6dcc74e4bc4e9565998f933cbd04c4ed88c240e8caa9209df5d73747
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 19.0MB
        • SHA256 8d912903d1215aa832fb987b360efe79a4e0872730ff6c57ee141c1af403653c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 19.0MB
        • SHA256 faf341fea7d247651d613e7d37abb4b833a3aa7eb6885cb09ef69e5b7c00c719
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 19.0MB
        • SHA256 144341dd1af1aa8c41b63cd49f3358ea32f1995fcaa6e1a1b57872bfae649e3c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 19.0MB
        • SHA256 e7f29edd91cbb13e50d027e917c1f2ea38a47c1873ac3f95a36d4a84457d10fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 19.0MB
        • SHA256 194865fe5a13c2775f9a51c0454d705e7f3d79b0f798265bf3d469d7e48af223
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 19.0MB
        • SHA256 2741456bb55a0661297e662a4d65b89abb644e65f8d1c0a91148fdc19c4318ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 19.3MB
        • SHA256 658982b9b5dde0d1d7827d9cc84603c0cc9344c515d4209b85e0fe1015e9c841
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 19.0MB
        • SHA256 930c2cfe2134acf9280f32525ae4d1f805165ae33fa69474c38fe5846302aa60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 19.0MB
        • SHA256 ac59f326c76749e9f34cb5b5b487210133c005a16932ded67f11c94dd55077f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 19.2MB
        • SHA256 0bf4dbb0b7ee0891493bf55b7721f8f4be4bfdb2164f6050fdbf1078c22f7012
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 64KB
        • SHA256 561e710c0f12a9ecf3c544ad6eaf227983f3f3f2dcce0bb2f803afccc641ad14
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 19.0MB
        • SHA256 f3883510bb8f3e9a0eeafca4355a1bd11a667c2833aeae53a4756544bfa15072
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 19.2MB
        • SHA256 6a70af6beec4992e04334c0e95c364f5329ed8c5236c76c6ff8c05b6b1f93af2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 19.3MB
        • SHA256 0278a15a4a9a5cde96f9a899c73796b7dcbf6827d6e9851772cd675683b18671
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 19.4MB
        • SHA256 3070744f63005ca13639da57c367c7d63ac3a7c1c0579bdd8fffb56796048e70
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 19.0MB
        • SHA256 a4e38f376802d2409aaabbc3141965768ff8d57e27af3b1e4699c4dbf7a56eed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 19.0MB
        • SHA256 96ff2905b9228243f6d55ac572cfee210594b3ddec49e87d745bf225033e7550
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 19.0MB
        • SHA256 62bdc308ed55da49683938e30eeef8e4f7e921ed3f8c919472fc5ed63c93d300
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 19.0MB
        • SHA256 f4d98bfe14a9d3acd7ab43bc6aec8de6f35a03f163e271c65e4e113f16a8f1ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 19.0MB
        • SHA256 ccca8c9bcd9fb9c7b310d0f3b87c04f4de23494963bf7ddb4050f79b3138f092
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 19.0MB
        • SHA256 821f3c13089c1349711e2a13465dc529990d27e992d61f303047372c2ccc3f58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 19.0MB
        • SHA256 aa02e2d0907e7349eda0464e49fcf6071d9bddb3eb4942c6892e9aea75049038
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 19.0MB
        • SHA256 33adb050e0d258a522052af6184c0f208edb79e27bad9da1e73d65933b2bbd1f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 19.0MB
        • SHA256 3fd4b092b4a47ff5e18010de1d9ce453dfc823e998131e8f01bbac0a98b26535
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 19.0MB
        • SHA256 6595ddb83edccd77c494108b5d97d4f230905fe30121edff19916aa15c78cb00
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.0MB
        • SHA256 08618ac9585b1656e844cc724c76d1f1eedd885efbafdd8381655451fc0dd51d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 19.0MB
        • SHA256 97c9c4c47b584c959140bfa0076aa8d170ddec5b2e163479b8529336b850d52c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 19.0MB
        • SHA256 b2ad2fc1a4316969b57252ceae5cc385b4eecc8c0cf085c6ddcd3bb0bb40cd7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 19.0MB
        • SHA256 4c26b4738c14feaf1b7b3e177fb6433db53f3e5ba7026b04dc7fdef523c171d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 19.0MB
        • SHA256 65ff06f984770453fc2bd1c40a2497bff55c089d7935f1926ab19665c4aaf67d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 19.0MB
        • SHA256 5257c2ec78f52ca8db9035353167cd89e45ef45516a470aab35bad627eae44dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 19.0MB
        • SHA256 84de6a5297c94b8d64cca921a33f16202ca65f6c408896156d2842ae03ea3376
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.0MB
        • SHA256 18ef0950be8fe4f2d948424fc0a89cfdf3119e60e3860055d06f8593c652de40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.0MB
        • SHA256 0860bcdad87018764a18d8a69e7c00ee349d46fa8786598f7e2da7cbf1b03f88
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 19.0MB
        • SHA256 6a442605a758c2c3782944401c3c596eae1a1d95d0986ff248e52706b98b4f03
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 19.0MB
        • SHA256 f0c1f082e2d0c0b4c844e1f145ba355e6a5b7f8890f6ec2a54dcaddc721b85e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 19.0MB
        • SHA256 f91e0bfe4d22e1b1d849709d19d2c1a0ba0ee3e32f7631a92dedfa9162957863
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 19.0MB
        • SHA256 5359db94f10469f0b006f460b0c0308bdef487b30be032b24bd0d0a4ad3c22e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 19.0MB
        • SHA256 b25b3fb816e2791e12bfab2110ef037a1a0e774f4d8ae7c5738cd2f92ec955f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 19.0MB
        • SHA256 792fe6473a6188bb457fc8cf34a1ce0e3dc64008fb8bb53a04536635063dad00
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 19.0MB
        • SHA256 7bf6edfd37da07bd3919ebb6e0a657e93fecc5c4a7d82a6f7dd6c0823ed56631
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 19.0MB
        • SHA256 b819671781b6b4bc710ea68a173c279a132e0aecd4c108941f6c508dfe693f0c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 19.0MB
        • SHA256 31cef57f7644677d569e87ee169e08b334446dccdf477687a0214ba3005128b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 19.1MB
        • SHA256 3a490f93c764724ff11b77fb39d18dc69d5fd1e637de686702e1002a7ec632ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 19.0MB
        • SHA256 f662d8b8d5756bcdfd68ce4cd2e95d02be542529eedbdbaa9344ed820252f167
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 19.1MB
        • SHA256 ee7f3b462b76241a5c805b944bb93755659f661166a60bcf327d0ae77f6d49bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 19.1MB
        • SHA256 378169b72adf103ee2652410298ace45cb632e88f8bd3b7e7558dca305055948
        • MD5 SHA1 SHA512 SSDEEP TLSH