Overview

overview

8

Static

static

3

2026-07-23...ar.exe

windows10-2004-x64

8

2026-07-23...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    47s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/07/2026, 22:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-23_26390b31315b0df946393cfe15534082_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 48.3MB
  • Sample260723-2p7b4sybqa
  • SHA256 4a3e54cce0f2cbda6814a342ca654bd39e6cb4d9067837b4bd10a57532742856
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-23_26390b31315b0df946393cfe15534082_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-23_26390b31315b0df946393cfe15534082_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4500
  • C:\Users\Admin\AppData\Local\Temp\2026-07-23_26390b31315b0df946393cfe15534082_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-23_26390b31315b0df946393cfe15534082_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4176

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 71.8MB
        • SHA256 8d3b72effb0e7c45caaeb73dd8d6ee9feb3aa6c86eb6343540f3adb3a743371e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 96.8MB
        • SHA256 47f56e9bf4873e8eea8e680c37eb06e34bfbe9aae619cee046e5d809832dd584
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 66.6MB
        • SHA256 bcfcb0d7230cf79322d3371d5ad01e8c2005571276172a657f82f1617be0c2d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 66.2MB
        • SHA256 e635558d2699c83ede1bd1468a573e01ee93bda9d1184c963dd77d2fa7247bce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 60.6MB
        • SHA256 5f2c997f72248eee31623dc784a2416614a596e8b1cf4a3e9bf76aa4d61292f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 62.3MB
        • SHA256 581125ac7f31b2f1934b08fbff6f90e5b8de0362253885be871ede48a8198193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 56.7MB
        • SHA256 64c5e3d9a1dc317e54012db48a2b5cd6b592ad49173bc0f5eb0071068f319fe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 57.3MB
        • SHA256 4dbe4c7ab564f0c403249b7c45ff1521875a7db3e2c012708db7b3254ab05a71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 52.6MB
        • SHA256 cd5c835b14bedda006c457bef986a185c35d50c165d56799d84f5aa7941229f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 54.0MB
        • SHA256 73aae57cbfd93f193f2962e97058b3bb480a97adf4c8bf1460567e2f62feca81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 54.9MB
        • SHA256 c018d0b54e001415fc318c719e6ea710072db9f36402ba9b84ff7d0e56d23c2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 52.4MB
        • SHA256 4061ecd8dabaf0b76c1d606eb4ab87593392f71cd2549ac55cbf68ac6677b61f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 51.1MB
        • SHA256 872fab7f50e8d75a94ca180a48a0db47fb5a0826a6363f06af1b95ca944a6167
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 49.7MB
        • SHA256 ccb763505af96a2876b285cb81b5d55e688bcaf38499bba797116bc1973dfae9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 47.2MB
        • SHA256 4f6a41cd9f36c25f29f2227cfe1c884a34d4d4def50299cd02efc385acfc6a0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 45.7MB
        • SHA256 072c7217f1341ffbd0cb2f4ccc3cd7795c3fc0cdac03de9c5d899b4e1d686af7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 45.8MB
        • SHA256 d46b24d4a4bbce46be24621638031691b9e0e6a8cb74c632c285885a4b285ac8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 45.5MB
        • SHA256 315b99901a17d0ccc2e93e57a8403396ce849fe2a0db9f725418c2a1eb3b4702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 45.1MB
        • SHA256 319aac41430bb765f6fa90e7ac9b7b7a52ad7b53021925a95daf28a38bd206bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 43.1MB
        • SHA256 7ee0a9bcd254ac1b4fd15d0ed54b0d37aeca5b175058ff0d68c840c9f261c526
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 41.0MB
        • SHA256 ce596c77af472f04b984de0d0882ecabac4c378d0c4984a5a756887771225867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 38.2MB
        • SHA256 ac2c16feea20c8ded43f6f3f3e07fb7d149f4eed404ebc01625008c3e83b5566
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 37.2MB
        • SHA256 f528d7349da738b33045a121cf0e4f1453d2858ad39c543972e4d69814eff9d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 36.9MB
        • SHA256 c06fd1ab035427c8e80ec9675169c7e869cd3ecfdc9ff15e3d527eb025474e73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 36.7MB
        • SHA256 a4c66cd00fa13b7452bc196b45a976b7a228ef19160705ef7313c9ca7d79f684
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 36.4MB
        • SHA256 530eb42440d5ffc38ac7e46cc1140a37f3a4c3132079d7de822aa5cbf27a3e0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 36.1MB
        • SHA256 f55e6af079e79dda08a10b884d5acfc8c6ea39ed340858908dd7de17a948a83c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 35.9MB
        • SHA256 ce9563ef91f11870d30a68b32107f660e025cfd58a7d00c448c8142e6f8631f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 35.2MB
        • SHA256 a524d8d807e70b88e15f248858923667028beb2f2eb430cce08597ebd1aa8259
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 34.7MB
        • SHA256 cbc58ad035b1c58d04c27fa4e27f525268499d810809f6fea16430a72e8c9628
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 33.9MB
        • SHA256 3c7b8da226f27c4d7d4d63e6abdb7662fbd586c34cad45fdfa0db8cdfc960be9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 33.2MB
        • SHA256 fc1edfab57f926f180df97996d467d1dc798f58b571e6419cad0fb7e130e1be8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 32.9MB
        • SHA256 17fb7b1b5fa39c2ae89423c129321b395f19f52146489f6a4c7c3894abd11f3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 31.2MB
        • SHA256 421caff58f2af89b0dfbded3a56566bd443c2b34051b94b0ce18d0261953573c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 31.0MB
        • SHA256 5f459d4637cbb72c54dd9dbb369683953009f51ada85173b3a8213d1b5e4878f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 29.4MB
        • SHA256 3e29a7d694242f9bf763ad3a34784389f7501372bac35e5fc57c9e3b2986aef7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 28.6MB
        • SHA256 88a1f5e32f898d97d3ebf0846e916fa44b2d44197341bf79fc68a52ce2fe6159
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 27.5MB
        • SHA256 5264df046c399c809b0f317187aced8d6771352ce352a9406bee62c0bfbdee0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 27.1MB
        • SHA256 7081b6c80922fe47994329391e7044d79c101116e20d3eb7b29a76fcfbd03cf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 26.6MB
        • SHA256 dd20096c7bc58c4edceaf0a7d3a53f7391c5973a63df9eee267b0e9d403b65f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 93.4MB
        • SHA256 c5085ad36591568d84a2d965281a2178b4233e3062295089596810ba5b0e2a0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 92.3MB
        • SHA256 0e27a17c1e983797da50e8c826df5375b494e039c33e28884cde5bf53f476bba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 91.8MB
        • SHA256 125dfa951c262bb55ab46fda2879ab84f08e3968200d66f7b5ac55977f151017
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 85.2MB
        • SHA256 bc2faba066fe81be11cac90e7178a7b44d686aec5e806ff531bfc53ce4e706e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download