Overview

overview

8

Static

static

3

2026-07-27...ar.exe

windows10-2004-x64

8

2026-07-27...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 13:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_52097f875c317afe2315f672aebd4990_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 12.3MB
  • Sample260727-qhy7datapf
  • SHA256 5f9cc98d1d0955c74983b0e7347ab8d680e53814d6636d6135f6a377e125ba3c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_52097f875c317afe2315f672aebd4990_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_52097f875c317afe2315f672aebd4990_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5568
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_52097f875c317afe2315f672aebd4990_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_52097f875c317afe2315f672aebd4990_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4932

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 24.7MB
        • SHA256 354eab86ff802b38dfe95df0fb1c5ef56b8c8b10a9e7b757f8bfded2eb443e06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 28.8MB
        • SHA256 7c253b2e2332c0c4ce52f0e887fbfd7113556b74d5488838d2424629cba2e419
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 25.0MB
        • SHA256 7c9097f84f0a3e03d04b64012ab9355732a4b4b1a25b28560652bab04ba5843c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 14.5MB
        • SHA256 3dfc819b1db6ae0a179b15c4d084edb40506d6dd95bbe65012165653d7464d9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 24.8MB
        • SHA256 fb379045e572d92de498669c212f00fbd5ec37200fdebeedfa577c1f7c96ba1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 28.1MB
        • SHA256 429f9e271a92a303a45f27ab7d3a22c08371de757803518ad428c48fcabf6aad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 26.9MB
        • SHA256 51b5945517f682bde8513b3147d00d67b58e176ba5d41da00cc950df08bbfec8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 26.3MB
        • SHA256 e2a9f907b7801443fee0941e3cb84ea6e3a27fc57379ac6849185918b54966e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 14.2MB
        • SHA256 9d020eb1a42b99b8844beba4e347323ed4a4a63b3e996caba63373d7744db912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 27.2MB
        • SHA256 491fd3d287ae2cee6aa9ffe2c7bad2df282754c7026fc9c687f588b15eb6eb66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 24.7MB
        • SHA256 973814ead3023981aad16b6d4e4cce387328988babb187f293a800be73ae3555
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 24.7MB
        • SHA256 5d5ebc6fbd84d939e666b86aa4ba215a45ffb3fe0c5a79e1c882f47dc2524d89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 24.7MB
        • SHA256 5522a95ed6c8f87feb6f0c81e0761d8b2e13d9a2ea0faa086fe0f4fa2a86a5ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 24.7MB
        • SHA256 de2d579d61876f1ff9828d9d470e03c5b8fddc933212663f21978dc6c137395f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 22.1MB
        • SHA256 be660eeecfc6f8e8254268b399483dc6c5279b7018c9324598d8386b8797c1d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 24.4MB
        • SHA256 51268f850a2fd98a93eac0b0fb68a7fd97026c2a339245858f7334c891262d23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 23.2MB
        • SHA256 9e2ef9a4d4bf59d379b543427ac970374a066ccba21e7d9a667e9a924636950b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 23.4MB
        • SHA256 acb16953f129465894891d330b8a8cdec404817c62d4257b1ea4eb6b43f180fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 21.6MB
        • SHA256 8a376aa661cecb938d7e64c9690470bd330a2503a5f270e9aa018607321e99b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 23.9MB
        • SHA256 50a25af7fad021e1777398d7aeef25a155dca4a4657666bcccfde787a33253dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 23.1MB
        • SHA256 ab200dac88e70dd3543b2034c027eab42fb14c22d93c1672bc3ea4db249d13ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 23.0MB
        • SHA256 eb95a4275cc59f68f738a183d7a0427c2bf4c32981ebbd77ab03794bc5e68c3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 20.1MB
        • SHA256 29e2ba3f2513b4c085b7300055baf28c8dcb00581c90acdeb683bc9b21c7cb02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.2MB
        • SHA256 7a5dc98a5f7342484944425dff594405a0069916fee42c9e87743f088bbbeee4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 21.9MB
        • SHA256 f8e9ba9215fbc660e3cdb78bc5781fd9c465f587bb0741c857fa023fcf5e3c52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 20.1MB
        • SHA256 6a42e16ab225d95bb1f7369dec730c73877a5641a0bd29029990fc49e531dfb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 20.4MB
        • SHA256 377652abd79f0cf1a0147bf0163c0743a8900382c68f07544cd69b22dd9603eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 19.8MB
        • SHA256 be6cd5041f0e454211fe24d158e85fe1c58e7f53be4d1ffda73350a85f4ec162
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.1MB
        • SHA256 1753c4aba4ba5883d5cab991c720ba6ea2503a810267c83a749b811a31f9ff20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 20.3MB
        • SHA256 2595a9673d314108b05b3eebe55d7f330160041f3a370ad6d49b554fcb05c0fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 20.9MB
        • SHA256 f86f76e6a39fb817f06a83aa5ba1e32c24a925c5e24a4c300220be28c6f8ffb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.7MB
        • SHA256 752935a2ea5f9291acd8f0cf68e252b4ffcef4d86f1deea5a47e3fd57862a595
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 20.4MB
        • SHA256 7bfdbe4dafe2a3763790c20a7034c0ed5bfa8b71f6fc9dd2ef2b40a3ff445b04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 20.5MB
        • SHA256 f8d0d6ba01661107dc487543b13f2604e032c9a620c49846f144c3800138b083
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 21.7MB
        • SHA256 fde45dbf2b3cfcbe4472aa0a26cd4d65c71f405ade37f4db41e5ad323ae1df20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 20.1MB
        • SHA256 33863f75667516b70a04cb9305c436d27b441684d316301e599ccf9b146f1df2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 19.9MB
        • SHA256 9b9f4ca7887cd4d0a588283988a5fdb4908cd3b5a957de70396d58d09f328ed6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 21.2MB
        • SHA256 7040f8888b76bc83e643a7b8d16defadec0b0d8e0d6de65d0edde3d41f3dfc6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 20.2MB
        • SHA256 580225147ee912fd41e8b90d7add1833610d1b514d394693bbe754ae01141495
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.4MB
        • SHA256 0ccff5629d24ff67ad919511fd482f2499695ee2a04bab44906b596c732e161d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 18.4MB
        • SHA256 ab8371ae9e7f3d81952288a5ae8b2ba225b8c9d785a0a89a160df35f10593ce3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 19.2MB
        • SHA256 61addac3b439c9622285e6007093c19823dbfe51c0c46598d4e19a2d4b006990
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 21.1MB
        • SHA256 52fedee016b1cf9725a6b3aaf00eeec34fb60239031d6010d0b5033d5d1f128e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 19.5MB
        • SHA256 6a473eb0857a557e6543311d6b3ab27c5d389a1149fec7236acf63a3a4bcfdae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 19.7MB
        • SHA256 6ed23ddfc1b6ebeed2ffbfd3b055bc5367eb1a106cc9e92a29c7f5ec8bb6e64d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 20.0MB
        • SHA256 356636bee269f223d29f1f95049240d371e6862b5d8b99a0e3ab74fcc861bbd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 18.9MB
        • SHA256 8e6fd0f59efa321b1843e3808526e82029118d36033a062d0e3880bbf1f6f27a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 19.2MB
        • SHA256 7c47eabd19bca0d5ec5018d0ea4852095bd26a2975f37edb8677f1c6e0567142
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 19.0MB
        • SHA256 8ede9bd22860ba21a2c442151684a94e999dded362b288a9adc3ccee1ccdc337
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 20.0MB
        • SHA256 5f65c26008623f42535e8319a91a912f218dcc7ff61a989e09034345fbe7b6f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 24.8MB
        • SHA256 5f4b64c6b764cedf6c2f5f7d19fa732ec877b71d81f0d4caef5b8b4ab63ee18a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download