Overview

overview

8

Static

static

3

2026-07-18...ar.exe

windows10-2004-x64

8

2026-07-18...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 08:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_0cb1685d205720c5bde15b38f949aad3_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 48.6MB
  • Sample260718-ktk61aev9k
  • SHA256 f09ff4503caf906c0d6d0f62b38daceeed5f293cd878460cf6829c7cc7e1fe03
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_0cb1685d205720c5bde15b38f949aad3_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_0cb1685d205720c5bde15b38f949aad3_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4388
  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_0cb1685d205720c5bde15b38f949aad3_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-18_0cb1685d205720c5bde15b38f949aad3_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2020

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 49.3MB
        • SHA256 d6d85089c1608d2aa1c57acd3e3e9231bb4611e79f25859986d8d4fe54c2ac49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 97.3MB
        • SHA256 fd8e5f7350fd0d7358d229eac6fcd3939a7e3a30fc9bb8fa1a0e747ad4910af7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 97.6MB
        • SHA256 4bb047b00c74da5c2332b45c82e1eccc70b4356fe9dbe7a3474d69fe02d62821
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 97.3MB
        • SHA256 4b3975a8b876ed3d0e384d5b0e0234ccd99563c490da064a30d84aca502f1055
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 97.6MB
        • SHA256 041e25058aee60ecd359b2bb9aad0931f2c52c76fc33b91b8a1c08208f658c07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 97.4MB
        • SHA256 41ec3342c23111f77948b1cfe6d46f16a5fcb860fb33080fb015a9d2b16bd613
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DenyJoin.exe
        • Path C:\Program Files\DenyJoin.exe
        • Size 97.7MB
        • SHA256 90581713db193e325f6622df7b0c1648a64f35d89741680de6d382756a4ba8df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 63.6MB
        • SHA256 cb39d8266577ad448c59d72fb7866d42150998c17fba8bbb5bbaed031a719d97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 64.0MB
        • SHA256 b74344c78952922977704f9e4d1e2f21b3fac0615be402668461c696ccb374f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 67.7MB
        • SHA256 875a5d3de5e6d6da666aa85a74cd165a818427cfb7279ae2eb522fd500a58d7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 63.8MB
        • SHA256 d3e2ac6ec6b7d6d3190931d979c62e53565017ae82fced2e4ac42f44601b5c2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 63.5MB
        • SHA256 839b4f3ecbdfc4f2a230da84bf0f2959b6a2a85be1adab0de676269a2aac0c4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 63.4MB
        • SHA256 7fc9fcdedb13009f9c0595891dfd346735e7e51cd11019968ae687f2cd5d52a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 59.5MB
        • SHA256 ce9ca44b53ef3bdecedbd1ed780b1c36b28c2e7c4275015b498dfad891a20ed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 55.1MB
        • SHA256 6cc33bad044bd6758ba41f384d9ff81bc4b5833b1fe6e72e5212ddf6363db442
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 55.2MB
        • SHA256 abb5cff0809d4b7dd3b9a35caf40244147889b9b6ee18e57a7d60138b86b7095
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 57.6MB
        • SHA256 9e06fadf397e101714bb3d5892d28a5f05c4d8fd00c7e4aba13600f55682560f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 55.9MB
        • SHA256 b8d4f65ac87736e1441156fcc1d9b23a482db523770157229e78289036a6296a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 55.4MB
        • SHA256 1f7ede75325029a0dbb5d5935085faaba07e524d972fab930ec22707871248ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 54.0MB
        • SHA256 eede0ce34188bcde3101e1daa924c76f5fe46492b7cef9e249c2106288235268
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 50.6MB
        • SHA256 1b1b42431dba78fbc2b7b2b01282b106a3e2b7032aefbec63df76e289811ee93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 51.9MB
        • SHA256 bf606e87a06d5c7509eb4b956a1c91cb9c25cf452b7978b32ae90406f12c50f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 48.4MB
        • SHA256 ae3c4f186c3e8d48f1877eb97f6dc955faeb499a0d5533bd37c34361823b9147
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 47.9MB
        • SHA256 da32e06e6fce4243797aaafdfccc2c2a1306affb7c27f0eb9982cd0d2998b584
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 45.2MB
        • SHA256 be2b00273aee2ddd1d0f7c1fb71d969f21881357473e8e771fc18892292e1beb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 43.0MB
        • SHA256 c435d80d883d5ee193d954f750a5665ae9732688bcf279ee092e62a36f824ce6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 44.1MB
        • SHA256 e17d7e0092c0e0157f54f9e4189712d2b536c11c43aa37aa0e1d64e9b8443401
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 27.7MB
        • SHA256 f0a725454a0c8d0cdd2ba5fc8b432023c22ba5c419797a2ae9621b64d71ce4dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 25.1MB
        • SHA256 49765d3388165b4b55917dcce963ebeacbbffcd3250709d9b0dc47d8e6b2f040
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 25.5MB
        • SHA256 d7675666480bea1ad11506e739e21d835a221df184a1b4c2282480d50f324138
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 28.1MB
        • SHA256 5ae7635275a9bb734462a60742b6d9dca15a05ebd36e95b38e8a0f22b466b620
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 25.2MB
        • SHA256 4af47cd9f6bc8c64779e70999bffb559c75e3237f48d9a3b50e063fc70b2f1b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.0MB
        • SHA256 ee8d2afe1648df916a93b1f2181c7e3830a40788ea14d9aae7aa488a97e2b707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 23.4MB
        • SHA256 81a083d1517d4b669899760da7be7e07fd7ae979c917ed319ce7ac3c8faf8ce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.2MB
        • SHA256 b2bbb6de7625f60d5966ac071e55118451bdb96a901f969cfd5baa5de50b7465
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 25.7MB
        • SHA256 699a8dc83fc029143ebb5316b822dadfc6ba8e768ee8ac7b56c8a2a3ab7b1bba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.2MB
        • SHA256 e2c23c877f440951c6fa81c92689b21b3a648890e985015360a051702957bc6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.8MB
        • SHA256 f57fc8226552fd345d58d4fbebef488829f3099b1bb450075feef6181cc6cbde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 20.9MB
        • SHA256 a4960b2f329e096542af0d351f853119d0a3e22f910ea75c0ed097ba0fac1cfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 20.4MB
        • SHA256 ca0d511b75b66b28349d3b35fd8231a18bd1ec906bb5b6b7368294a238d1b0e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.9MB
        • SHA256 11825282454bca668510f077a2b7d1e11f736c07cc58d183ce25f5575a0e3977
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 17.2MB
        • SHA256 d4f5ed30c26612b3a2da2768c29688ce14c4107ea3a09319455f732b338a80e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.3MB
        • SHA256 a4b150ffbe017fd143eea82778830f77943a881918f2929f73600a02f84ff9b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 15.2MB
        • SHA256 c49cc469fd96fc68f21b5d37b3032ae2554477f4bf078df2bb43bc79db5af311
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 13.8MB
        • SHA256 7f3c33434446dd5f7cb88afbacf507127f05270fc46609ce2d7231cae59188af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 11.4MB
        • SHA256 0b4ea11bc7ec8dc6afc544a23a42bd34af270682926c05c67aa43a7b7128f816
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 10.4MB
        • SHA256 fbf7e2e95464662610645943af81875f648cbea4da8b9d8af02c4af4b02c4af3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 10.2MB
        • SHA256 9bbeb96a26813af02533a829066a18700dc4f41817ab3196c26f505c3debd945
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 96.0MB
        • SHA256 11672ee2ae1dfe477f49bb61a87ee07ce3501a3c9d5f05199c436cc11b85de76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 90.0MB
        • SHA256 75726c1aef95755dfc232e5866f6044f2a2ccefd2e253112c1508f38a4ad96a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 91.8MB
        • SHA256 062f9a9de203397fa5f4d101bd5587865f5eefb5471719f70ba8f98a05435b95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 85.4MB
        • SHA256 4053bbc96b3bf3f16b36680df3b38d81af679a1ecebfec75702018b7ca5dac86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download