Overview

overview

8

Static

static

3

2026-07-20...ar.exe

windows10-2004-x64

8

2026-07-20...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    89s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/07/2026, 10:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_0391b06b7ee5a839f369ff186c78439b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 32.4MB
  • Sample260720-mpsrdse15m
  • SHA256 6fab8115965200ec4afca010601bbd8ce886ac31007c1a786e2df4c29837976f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_0391b06b7ee5a839f369ff186c78439b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_0391b06b7ee5a839f369ff186c78439b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4664
  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_0391b06b7ee5a839f369ff186c78439b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-20_0391b06b7ee5a839f369ff186c78439b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2128

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 33.1MB
        • SHA256 82b137fc5579dc28d8bb50bf1e15bf360f2ec5f05eb711b5e8c45baa2804d7af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 65.0MB
        • SHA256 6cf5d2e5610275ac24539ba7d4686d273c83ec4d647b8483406269af63940158
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 64.8MB
        • SHA256 c1b022a285b1f0b2904a8e131a41d31a47b67c368e8f7701e514eb7c7aa1106b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 68.8MB
        • SHA256 0939c545af8fb404ae6b1a24676da588ffbb7b5f85fccaa5451d6bc5e72dd5bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 65.1MB
        • SHA256 db87f95a91ea9b1aaf16e91f4c61fbd08c7ff99240888e374199643769c9fd7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 34.5MB
        • SHA256 6e19f5e300618dfc66680e980134aa7edc601b47c574d4cf06a2c5f51c187eeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 64.8MB
        • SHA256 ec397d493486229249287a6fe1efbd97b78b6de419c9253051740935c2f3b1b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DisableMount.asp
        • Path C:\Program Files\DisableMount.asp
        • Size 65.1MB
        • SHA256 522b0afc35c8c7bf6c1878c770da856e989e9dda8b79a11f007de61895ada864
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 58.1MB
        • SHA256 0394b1899e7f35ae0267181650d1dd708c00aa8a7c819f648f5d11aa50d0e172
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 60.3MB
        • SHA256 f061806480cdf6faaac48be3c76d513012efa50882c9cb065defee8c9d7774e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 59.6MB
        • SHA256 363e5f096db5868c3885a4b4424ae4e26eb60448fd11fe80d9eaf47caad783a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 58.8MB
        • SHA256 b648db532bff6dc9a549d6e68c3a2fae87ef95d038a4526ecbd9c161c3e279ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 56.2MB
        • SHA256 96fcc96b855ab75103dc632ffb4b522c02338a45eb30c0e608cc85e34b27f75b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 57.4MB
        • SHA256 adf3b565a00a13fa0b94ff34605308e95cfcee1ecce3815d196b894e09db718f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 52.7MB
        • SHA256 e6fb9320eba15e944d0ee5b871e078d1d0e7ef2df549a322c9467d0304c26875
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 48.3MB
        • SHA256 f3c0feee284ee7ba5d498649efbc5e6bed9c954a1a6bf636983b9533740ab984
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 36.8MB
        • SHA256 157909556e853778f12ca00e45789b6bad61ab2b7a0ae05b1d2651dead9429cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 37.5MB
        • SHA256 2aaa42d2134436104f0af4d7dcada790c26cfd98f1120ba9a24cb83ddf6d381a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 41.1MB
        • SHA256 d177f33adcd2fe2e20e694bd7dc0222f6ff76e7539298e8b9f41b7cb7eb98f87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 37.8MB
        • SHA256 97d1a9350f5b7416cbc20fefe0efe8659dc0352e853ec10fd328a884c3df2330
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 35.7MB
        • SHA256 4bcb1843fb20e67cae23f045a7df0fbadee12bffcee8ff9a06427ad742e1ad55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 37.2MB
        • SHA256 88d47fffef178675c150612f709269036e62e2756b5da5e08a4c66a6d2023218
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 36.1MB
        • SHA256 dd3cc985854e0211835b815eb6bf031839328879b63aa62bf45c0f37e38665d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 35.5MB
        • SHA256 d869ca5cb2b514af3cfa0829c3a87bf31c3a6b9d80a3dbfa9b9dab57921a5dcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 33.9MB
        • SHA256 f474ab81f3ea481f4f6d11bb651ec9a90cc9a801d067ad531ebb5bfb22749947
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 33.8MB
        • SHA256 7a1b4781d192585cd07e29865ab3cab5fc35b2e792d1640f9aab8d69c73ff762
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.0MB
        • SHA256 e9e2c83db82d9ae723e369143bd55ba266739b57983b41bf44c1d9c82efa0df1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 34.6MB
        • SHA256 45a85b343d9b1154c458d455210ead75f7f0b271699a74a9014c58c45a3b50cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 19.1MB
        • SHA256 3aa4acc3d0a05016e98c7fbf0c0aae740e704f66f5807d5689a596bc1a8bbd2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.6MB
        • SHA256 0c1c6f7e01d88361af0fbd49a43366689857d667153f9b877b562fe6372fd385
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 33.1MB
        • SHA256 81983891267d0e85580aafeedb3ab9d8a34e435f242cc5b49509e25a8f473738
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.8MB
        • SHA256 98a97dd7241029478c99f8d67f22e3293cd03124399f1e2669ff54b6402f0a8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.5MB
        • SHA256 ccbd897d9080b29633aa11f056bc42b679dc409aaae4695742f86192961a48cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.3MB
        • SHA256 5c48a4217a0afa52a4c590ba27567d36b0bb5bf4c103093e128da90325553721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 30.8MB
        • SHA256 897123e0e0bd4ca59adc51692cbaf670f826b4d4624202905d2862731c18f081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.2MB
        • SHA256 96666f1aadff0504895238de1d726d4ca76ac6b201c1d349ee6d49e8ff328818
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.7MB
        • SHA256 4f19c58a59c4791ab79a4a784f04e2893efbaffc5943b7d55c53b29eb235914b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 25.2MB
        • SHA256 ce7676f5fae3a37ebed75324a21212369d07158a0ea3b093c6e6ec603a081252
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 25.3MB
        • SHA256 0be75f736c736c8ce49bc9eeae8325a228d6aa7b93078ee849e886b5288ef2ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 25.4MB
        • SHA256 1063506d1580cc5ea39f1af5980b808649545351ba47c8392594ab4e3f0352ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.5MB
        • SHA256 840f70849d5b4177faaade8720913b4b94e380c094846c63755a4a0f124c547e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.9MB
        • SHA256 1d5b14740f18f7c1b999a838b7fc3700d3c0333e186ebbe39901b7650ccdf963
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.9MB
        • SHA256 c4645c99b491bbc20adfa457d6ea68a263c28a0da05b3d6cf306daa579cd0dc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 24.1MB
        • SHA256 a812d4941ffbcc3d7f6bab406d517b62686068c60f2eab448cdea19480d341ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 24.6MB
        • SHA256 7009117daee48eaeff46859cfc0f8c7ca6e64b437865e4404b35aa7c2376b675
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 24.8MB
        • SHA256 13055026370760fc120a044151d72a281d320378b87881880d147fdd303ec582
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 64.9MB
        • SHA256 c59547010e8b8b0d0812df82a1889b06f6858789346ca70ee86e9fbd17bc4be5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 64.8MB
        • SHA256 add681b845a5c87f85dbde3bdbd6210ad1dbeec7b186cca55470206234426984
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 64.8MB
        • SHA256 f0eaad970ddbcca67a48071fcf0283b4d12095ccce6dd7259722970e33aa457b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 64.1MB
        • SHA256 71fca8e72832406a605cb4902fcbf0cb516fb76ae13ea74a6250bbb48493abaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 32.4MB
        • SHA256 6fab8115965200ec4afca010601bbd8ce886ac31007c1a786e2df4c29837976f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download