Overview

overview

8

Static

static

3

2026-07-18...ar.exe

windows10-2004-x64

8

2026-07-18...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    34s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 07:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_60206a042b331b5b6b7af3a5702b214e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 26.4MB
  • Sample260718-jpfv2scy5k
  • SHA256 e9cac2d419ed1cc462823dc3b2b1011a49e1e5c32e0c0d2905385233ea79a4ff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_60206a042b331b5b6b7af3a5702b214e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_60206a042b331b5b6b7af3a5702b214e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2408
  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_60206a042b331b5b6b7af3a5702b214e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-18_60206a042b331b5b6b7af3a5702b214e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4948

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 26.4MB
        • SHA256 e9cac2d419ed1cc462823dc3b2b1011a49e1e5c32e0c0d2905385233ea79a4ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 52.8MB
        • SHA256 13ea28fee173f7aa41e4cac828036877065fa6e73f8646ff5d55e964944b2a34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 56.9MB
        • SHA256 8a58f77382e7abaf08715904c6b2417fa99bf4fb0143b9fa9464d40bd80a02de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 53.1MB
        • SHA256 8bb9cb3adc5ff136bc5122dbd8c955c9d1dfac1e7d285eec656ce21f27e2be4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 63.1MB
        • SHA256 16fcfc5251e85a3988514ee03062bdccb32d50b1a035095c29a19b27e3f1d5a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 28.5MB
        • SHA256 365764707bfb05848eaffa4ae1edb9538fb73139f4aebec13aa226721f2756ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 53.8MB
        • SHA256 07940238e3908529d25182a1510305007534202d10e4675ac13bef8cdb4b4189
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 52.7MB
        • SHA256 ae3e4e6e8ae857c41ba8354f95ab6b60160abac56c066676ddeacd3edeea73f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 54.5MB
        • SHA256 6a52a6c60ff99819ec3880ab20911c89d2e11dd4576973f3fc93f03dc46000de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 56.3MB
        • SHA256 5f4f663cd36167cf85c3e449b7d99f9d84c177d9c33161c5440d34f1a9ef9c36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 53.4MB
        • SHA256 5e89fa0f2be6259a769dededdf0f64e9839fba391b06c2b10782e75ce5c5a97c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 51.6MB
        • SHA256 e15a643eb23de48a389989f7ab388df9ed51c8b352406fcb5f31d4ef40a10ce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 52.0MB
        • SHA256 c102fdb8d18e1901f4b0168418686829c4e2e4a638033baf7fc8e2529485d886
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 49.9MB
        • SHA256 758fc97cd60a92c823ad6a7a6ab96df9e5ccca9d6707e7ddcc91720fd1052a01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 46.9MB
        • SHA256 4ec5c3a157f0bf3399ec62d2ec367fedcebfd8a527ed041d0e4ae7ae85efcb40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 448KB
        • SHA256 ef1671569d85236e5e1438807fc26fa3d0c89d95284243558028b54dd4ac3913
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 42.8MB
        • SHA256 bf599543b2cfb889635dc400ec40b6dc4845b9e72d17ba3e05b934b4951af1cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 43.2MB
        • SHA256 697c193be248c2bb1491524d4e86bf88f8d36775889cde9239e8c05105719d0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 40.7MB
        • SHA256 773e33ae32ed7704f011d248b8941f529961f2c4f5c8c1d3e89d25ecdba58944
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 40.6MB
        • SHA256 08b41c330ed2c334bc93db21e464e315a6e4c0cea24798a3b1a46c19aa6556c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 40.4MB
        • SHA256 9f36f5593733f53189890512582ca13e4aa4926bdc5dae61e0bdfecc0e38ba31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 39.5MB
        • SHA256 f76bd89eac4a0ed8c87b83a9095830b0b3162f2b2c609dc461e0459a7c900325
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 37.7MB
        • SHA256 88d15766aea3e976fee7f3ffa986b9f56aa00e6d0c69bc4b3dfced65a1482084
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 39.1MB
        • SHA256 bc07d3a10a2e6a63791264037f71f4ff2bba0d05f40fc60f79127855f71dc28d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 40.2MB
        • SHA256 a80b5e4c418fe2b5c3d78ff5009fab1e7ce3224fdf2642d418e69b46d01be9c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 38.5MB
        • SHA256 c2f43e32d09291dfbaa0687c06ee96a2c740d73fd25e6a89b1ca531636974703
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 36.5MB
        • SHA256 3657f2d0891cde5da2eb7cd21a52f2208ad06adeac2d490ed1f77f24610fa9ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.9MB
        • SHA256 112c58992233114cb7ff68ea772da3ab3581c163576967f131d0697b5cb3898d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.7MB
        • SHA256 fc62ec461c5edae543a11862ea8585a809542a0dade0fe8891fa18b98490e609
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 34.6MB
        • SHA256 96ba8cd8373bc0a1ee3b03a1f4b683b2a13a192ada0fe7391edeed3cedf01d53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 35.1MB
        • SHA256 b22899ce055e31a9ed2f1b2d26293f5fee8d6d06c28088600c009bfb858a65d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 35.0MB
        • SHA256 f233a60bc36905fa9ce49b7208f96c5d53bc1f67ea7d95e3b96a344a97888d2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 34.4MB
        • SHA256 0cefaf98d18d4b2564ff4f0f30dde7ad2fec20b1d01a41083e50ecba642e777b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 35.1MB
        • SHA256 c834516141052c3b574ec7ec126382e2e0f2f381a9aa31183e3486a9729abecb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 34.3MB
        • SHA256 4ef64bfb303f094c0361f3b2340835ef05a88dc53cf2b375239e259f9071fdd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 33.8MB
        • SHA256 e6ce90a8152cf30827a22f054fdb8a2c3db314b6af261eb194f7cbd0609890b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 33.3MB
        • SHA256 17591274e88b869798b34292038b4a9472d1d4338f1e1720a363cd55bf9cef7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 33.7MB
        • SHA256 5e032644ebcc79722c81175f0805825ab9e02895a977445591742d3b6521fad3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 34.1MB
        • SHA256 d5c24611348f7285bd746a2da14e303c6f21e15e0746587e0eaba16aaa435e62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 33.0MB
        • SHA256 c6aece16477d19ea1a696d99d3a6e0bab2ac088e1b037aefc0be8e99d3119628
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 32.4MB
        • SHA256 96ae73fe25d3f7e1639948e413c72e39e2fc6fafee3aca6b36b653f983a70bc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 33.2MB
        • SHA256 9faeb7298fe32caeac9a3a9fe4e9e794bb843d6a01615e53adc76addc498824f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 31.8MB
        • SHA256 dd16689ceb3265ffb79e011440d3b85748c5901d50a5a3d217281be591deb3bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 32.0MB
        • SHA256 1e9ede2d6ac1673a2349d96b60137e819fe4ea30e72ad02793fa60ab98f64ba0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 30.3MB
        • SHA256 92eaa40929b4acf1965e695835b345fad2bd880076422cc06b96f4b0e0cfcda0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 26.5MB
        • SHA256 cc913c5bc378602e0fbf0b87ef62cbf86a2ad95dfb82b3207272b7ac482fc2d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 52.8MB
        • SHA256 d11db66516e8d30d9ce74bda271acb351230c6b73deb8e8d3e59af78212f450e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 52.9MB
        • SHA256 8d7c7d6c19f68fbf4bd72c59b954fc6d55c319e3e193631fe129b8b4e590a532
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 52.9MB
        • SHA256 cf4080f788a5952e4fad7836bd9711042b29fe978f80385ffc71d040b771c20e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download