Overview

overview

8

Static

static

3

2026-07-20...ar.exe

windows10-2004-x64

8

2026-07-20...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    30s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 10:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_0391b06b7ee5a839f369ff186c78439b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 32.4MB
  • Sample260720-mpsrdse15m
  • SHA256 6fab8115965200ec4afca010601bbd8ce886ac31007c1a786e2df4c29837976f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_0391b06b7ee5a839f369ff186c78439b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_0391b06b7ee5a839f369ff186c78439b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1068
  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_0391b06b7ee5a839f369ff186c78439b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-20_0391b06b7ee5a839f369ff186c78439b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2220

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 32.4MB
        • SHA256 6fab8115965200ec4afca010601bbd8ce886ac31007c1a786e2df4c29837976f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 68.8MB
        • SHA256 0939c545af8fb404ae6b1a24676da588ffbb7b5f85fccaa5451d6bc5e72dd5bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 65.1MB
        • SHA256 db87f95a91ea9b1aaf16e91f4c61fbd08c7ff99240888e374199643769c9fd7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 34.5MB
        • SHA256 6e19f5e300618dfc66680e980134aa7edc601b47c574d4cf06a2c5f51c187eeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 63.4MB
        • SHA256 1548f0ab0523f7678a4e1f4e07fe0fd1b18afeb86426599023720b6c5e7f6548
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 55.4MB
        • SHA256 83cce7ee5c15e125ae047d8e2ce1fd09725f1a199209b79444dae739e528b049
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 55.2MB
        • SHA256 fa1472a3ba49aeb628244545b59cafb174b277efe3764118ae8101a404d6fd20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 54.9MB
        • SHA256 b6bf91af6be3721e5cef9c54ff511aa2cd7ea8a2d2cce13bf4c254a773f4982b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 56.3MB
        • SHA256 80a2ac92c4dea6fbd2efccd6ec6d923dba9cb662b669d967508afb04175eb28d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 57.7MB
        • SHA256 0d58b9aa6ffccf485c8096e125f70965c9a488578addb39f71c9a373210dc602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 51.6MB
        • SHA256 38b1d5377d94e939abc0eac289e7e0a041e6a1a2032e2ff8cc420754a64383ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 53.4MB
        • SHA256 1f0338ca9790d9574dd16d2e436dfc0d487c13d8ce3828f9e508c1f13424a73b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 52.9MB
        • SHA256 77b6dcf0141521b10a066bf9876be372507a91c0a8665d2e1b54034936ace0d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 51.7MB
        • SHA256 e1610182d13036602d6003505601e81613828800b3eca712b3f8b4d659622778
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 50.6MB
        • SHA256 9e4b8595022d231547e042bbaadd202d61d712af85b70a2a3d21f75ce92c93cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 49.4MB
        • SHA256 aeab91eeee5fe18d5863562bee0978164fd1189ca686a043f77b342ece69aa38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 48.6MB
        • SHA256 4044b7f66328ec3d987e02accc9f36babe8b71d696bf86cb93c3357e6a4df82b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 48.5MB
        • SHA256 fc49cce51ae92f3220443eeb847ba10143c7ac642268802adfe6b1f2f1b410c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 47.2MB
        • SHA256 e429b0c9dfd6e55a88692b781c4fd87a9a2841fb2c23b73df4cb50e0e62c5c12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 45.6MB
        • SHA256 4fe840dd18f28993e1bda6ae30c53816a177a3b68e2c59dafa8ae89ac4efc89e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 44.1MB
        • SHA256 74081287c2e4f7d21d8f09051927f687585da07c90e5d35596be0aa36d4f6fdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 43.1MB
        • SHA256 40adb4b16e3225499a9049344989fc04888404db6d36b217a8bce90a901ece21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 42.4MB
        • SHA256 f3b6b344fe887fae1033dd790822ad85e241675bfa6b90542c2e0a10138f66c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 41.6MB
        • SHA256 03792cf2152083be7a34c1473fa4e08e9f9074978651542fcbb1125df9b37cd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 10.7MB
        • SHA256 8e4c474926c4ce3a5717e662764cdc528aef0f25868abff868c2a45e70e579ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 39.2MB
        • SHA256 f4dd7765425db9eb3ee98a9f592559f1df5f07df13cb8a4490a556cf8a4b40f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 37.7MB
        • SHA256 8a4e334fccf22e56f5c3a028ddfab5157275a76af8131667d67b459888f35c84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 36.9MB
        • SHA256 34fe503807036337ac9a33e88fa6409e4eee87f8077246c44315fd5304e29b1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 36.1MB
        • SHA256 854d796f963762548e2da259d3f1d93da576c46b9ba955df25cec6cac3ce251c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 35.2MB
        • SHA256 9621bacf6877a41c6215d913cb708448036caeab12d5f32efb9183524b9b5e14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.5MB
        • SHA256 ffa2c6c13cd628594d7eeda2199e0c0114adfff2686425006eda51b3ea4b70dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 34.4MB
        • SHA256 5ff3b903b227b3242be015276964a8bd7ce5153bacab85e0d2ff20e3d41bc4eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 34.3MB
        • SHA256 88e51cae3ef972c7936b31d39442dbcff4041e812a027459494419c95ee76fd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 33.1MB
        • SHA256 81983891267d0e85580aafeedb3ab9d8a34e435f242cc5b49509e25a8f473738
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 28.6MB
        • SHA256 9b2dd9ee18cc458321d4d48089b0e1440655e44e48438662ba16275025ba7bae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 32.1MB
        • SHA256 485810ed8a6640fa205b4c5877da95172245c9a40f077f0f1e17eb3720a63154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.0MB
        • SHA256 e9e2c83db82d9ae723e369143bd55ba266739b57983b41bf44c1d9c82efa0df1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 31.8MB
        • SHA256 c51cc989211e6cea91f99faeabcbc8e16bb57bf3f59b1431c7e590c9693fc6fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 31.6MB
        • SHA256 0c1c6f7e01d88361af0fbd49a43366689857d667153f9b877b562fe6372fd385
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 31.6MB
        • SHA256 b4a325510c16b7b7f27cc87fdde24da1a867420980905bb3b8570befd4963d7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 31.5MB
        • SHA256 15b8c7526815a878be2177e5d3c5d01f2766f5291573ec2eecbbf39c817c2af0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 31.4MB
        • SHA256 802a11972a0d9ae25e75782d58a37073f434042ee9188d76fb8387818339887a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 31.3MB
        • SHA256 bdd3be55bd02c0b1ca8bbc00d46010295f92ead9ed4a2ffb48aa6d683f72fca9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 63.0MB
        • SHA256 a110e02a11196737e404bb3a2393fe84f33cf6074f7c365f70144c40835e8542
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 60.9MB
        • SHA256 aaa0e80cb40d70cef235e780bec94b69be78d539ab5589617789804bc0441c6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 59.5MB
        • SHA256 a83f49c09a545303dce9ee5f69b2b74409b6004ee43b542586375674758efc40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 57.2MB
        • SHA256 feaec9093d6f106b92d2c0ab4cda44ed2a09974a720e7af9d586bc9d1a8a2193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download