Overview

overview

8

Static

static

3

2026-07-27...ar.exe

windows10-2004-x64

8

2026-07-27...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    45s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/07/2026, 13:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_52097f875c317afe2315f672aebd4990_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 12.3MB
  • Sample260727-qhy7datapf
  • SHA256 5f9cc98d1d0955c74983b0e7347ab8d680e53814d6636d6135f6a377e125ba3c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_52097f875c317afe2315f672aebd4990_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_52097f875c317afe2315f672aebd4990_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2720
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_52097f875c317afe2315f672aebd4990_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_52097f875c317afe2315f672aebd4990_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4072

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 12.9MB
        • SHA256 6559550f30639d00fa340cded5813a40e7a77c24de2d933f9e634f72a97af435
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 13.3MB
        • SHA256 2b6fc3394df3018c5e0465918739eebe4d177e7fd62694d200f851338a3c909f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 12.3MB
        • SHA256 5f9cc98d1d0955c74983b0e7347ab8d680e53814d6636d6135f6a377e125ba3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 35.8MB
        • SHA256 56ed7765cf33fc2369ca36f8fc69cd8a1014259402c4c37221bf6d3ef633ea1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 24.8MB
        • SHA256 fb379045e572d92de498669c212f00fbd5ec37200fdebeedfa577c1f7c96ba1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 16.8MB
        • SHA256 83f59d4a34ab49532f2211086b08f5b4febbd3b965e800f999aa5e988afe95d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 17.4MB
        • SHA256 c47383da7d21da84233db24dada089a96d8d86727904b7905badc2365993a1df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 18.5MB
        • SHA256 05c2500dc36aedd7415b4b247400816e1981c741eac2adce556c2d205a165c42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 16.0MB
        • SHA256 ac08f80c0e23ce4dcaa68ebe6b64475df83a34c11f8c49720684cdc93425bb04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 16.5MB
        • SHA256 1cf0044b630ffb7f0c6e894c5605dba1b5ea0d829a1502d5c231498baa65af50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 15.8MB
        • SHA256 7d3d38fbef41625fc29e155e56068973d9e1e399ccbedc89cfad22c892c5fd0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 16.1MB
        • SHA256 7e491471a8d715d5dc290c898ad2fd63ec28c3697bbc93001919d9194f3820e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 15.2MB
        • SHA256 9e6d709570906f16aef01f5f9e68e7784eea1c7f9d8c079132dbfd980589aea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 14.3MB
        • SHA256 116eda98b934fa38f271a5d4fe08297bdea05a3994e7479140a8aad5a1e6bbf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 14.2MB
        • SHA256 6c1f8303c44637f88a49f82607b4bce50679ffebbbbbc47b382af1bbaee04c97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 14.7MB
        • SHA256 9ee5176dc7793ef8685b2f76de1c25b3bf49292b3a75bbd3e07e2a1ee41c29a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 13.9MB
        • SHA256 e6880a3d0557a8fe920c0e66728bc99fcb630f5da53b95c4f8f44ab6fd918e40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 14.2MB
        • SHA256 1b3c4a6f2f8eba65f286059e89e0b880d599a808d69f5f11075927481a0964b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 13.6MB
        • SHA256 b90d3315e35e735d52191d9f7958a19055a1f9c67001eccca5411411d7970ae3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 13.8MB
        • SHA256 aadadc1df86591e72fea972af762a690fdd574d57a60bf888219a570fe4a59a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 14.6MB
        • SHA256 e2f57d35aa843863aafbeadd5c34c234734e6d1c5de1316f1fbfd1a972d15916
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 14.1MB
        • SHA256 4be34b2cb54a904e90f34f4fbcdd11822355b028f326459fdbd77a29c948ae7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 13.8MB
        • SHA256 4721b989e4a40dc94e6914480df665b48077efde59c8e473a68442ec86ee9944
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 13.4MB
        • SHA256 60086583246ceea3bae4d491a5b846c8201da20a8c08dda8aae31842eb3a3da4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 14.9MB
        • SHA256 2667526130a65e3e881ab6edc72537d26787d6a59cf7ee9edc124007e53edb06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 13.5MB
        • SHA256 f6fea03ca06c6320556049e1fdae4410c805c0dee84871dd9a751a38adf9992f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 14.4MB
        • SHA256 18a3b14de941791c76a7a00f571de960cfaf4b47ec841233799e19144ebfd383
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 13.1MB
        • SHA256 d88f9a2e363ce7d61d62a80b6977bbc733b6873e5807b66aad7f320baf31b90f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 12.5MB
        • SHA256 7e995d7c7ee8ca5c5a0b9c0e9d035ec76ce711b853db1e6e92de8a10aedaba88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 11.9MB
        • SHA256 12bd4982a6272875d593d7e413edf30518919ee90bf58256fc64d7b6cf81e7ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 13.2MB
        • SHA256 de70fffb0f63f11214df4759fde6613380fe793fc9f734dd08beae891796084e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 11.8MB
        • SHA256 b2abee281efb038dfb776ab239cb08186ce9a06ae45ecfd0da5c54aabb0eb2ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 13.4MB
        • SHA256 705a67a9960785c5e6a7a2e92ba9e2471b5654286abdf6284231d23b08bbe244
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 12.6MB
        • SHA256 3374be4acebb6e250c09ca6351a85c3c10df72df515efcfe58b0d7d5ea93e92f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 3.6MB
        • SHA256 602080096e47c3fb715942bcefcb152642e8f8d4af6a8d238b25e9928f605856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 11.0MB
        • SHA256 eba28b73435d360703695835544e6960b8b03c56a22584d4223cdff1754809d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 15.7MB
        • SHA256 a16be7ccca36f5840b1d58a3346c6436a22e2acf9ed0f8fd42e643129470e829
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 13.3MB
        • SHA256 ed6419aa9ece94736884a18869a3132bbacce941f3a817e270447d0f7d018156
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 13.7MB
        • SHA256 8a3a87f57df49718f947962e7c850ce466e6dc8c0e053750f6db43886da47ab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 13.0MB
        • SHA256 6425f2a849cbfe04de64b6d763fe79ae3001c313f52a19b876c9fde6bf25d047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 12.9MB
        • SHA256 5bfd7e1f5a13d21e7440b237619cc85ea8fab4bd2ded5024ad5ca315b30dce5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 12.9MB
        • SHA256 cbaa1625f0b6e59d5810b3b58f54410f102dcb230b1d432c285c26cd1da1f245
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 24.8MB
        • SHA256 5f4b64c6b764cedf6c2f5f7d19fa732ec877b71d81f0d4caef5b8b4ab63ee18a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 24.7MB
        • SHA256 0453157c47be0a3f8ec4dabfbe27a0af79d50ac98445d2535b3c964b1f27133e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 24.7MB
        • SHA256 09ae5c442d3f284e93967d48b914abb31d83f3e37becf61323556204a00e54f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 21.6MB
        • SHA256 2286a40d23b9fc56615069c63f590d16556374169e500234cb87ba50ac825fbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 12.3MB
        • SHA256 f732779c89d9e6dc85026fca6c636aaf404a23ef2dca5e5de67d1542c9345381
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download