Overview

overview

8

Static

static

3

2026-07-27...ar.exe

windows10-2004-x64

8

2026-07-27...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    30s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 14:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_9edf5d51ac6150c1b90f50295cd39fee_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 17.2MB
  • Sample260727-rp4acavbme
  • SHA256 6f343e90b1961dc334631de6e32c55c930d349387d633ff27724851d328a72e7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_9edf5d51ac6150c1b90f50295cd39fee_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_9edf5d51ac6150c1b90f50295cd39fee_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4076
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_9edf5d51ac6150c1b90f50295cd39fee_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_9edf5d51ac6150c1b90f50295cd39fee_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3532

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 17.7MB
        • SHA256 b527f3907262d8c25bd89df850d469d156afeb719c93a2bb74892443f6850366
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 18.1MB
        • SHA256 4653669c396d76fe4e0e0fdfb42fa757735010ccab112ad0de0debbcb99c5d29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 35.0MB
        • SHA256 7c445d82c214a2bb530860f05a103ed506daba6bd03664c1b73ccd782ea141fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 34.4MB
        • SHA256 053e1ece16646a5bccab640ed079c58bafc56e76b06404985b7f13d6d58818dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 34.6MB
        • SHA256 ef22badb7b1a8ef6a52a3e9c9cd34304033d56830cc86f38569f531d9f35ace6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 34.4MB
        • SHA256 24f62b437e6e94fc4b23047256030f7e9a2f4a2fe223060ba6c68321bcf267ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 36.4MB
        • SHA256 c0ac0fe474e532b0f65aed411dc1cc78e8a1926fc10f6f29541237cd7fb6d4a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 41.8MB
        • SHA256 f289006328117189fa2b1985eec560efb57f4c06a70582fe3c8fc855d2fa4485
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 36.5MB
        • SHA256 96933a35eb1ac169a629e30c4ee3871b3d33f6abc50fba8d1c050bcdb8474a7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 35.9MB
        • SHA256 1a8f37e3409cfe5316a49cc4ba8ab34d44545ba9cc81b749d5a7081170559009
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 35.2MB
        • SHA256 df73b3ca59c49c3375ea03984a01e17fca57d92389369ab4843b6d49759aaa8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 30.1MB
        • SHA256 18914842953b64bb7beb03b80f002171b980a2771a13dd641c758f1b51dbad75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.5MB
        • SHA256 9a3fd6617f7623f1c554d74b48ee79e006498e484f17f9efcc732d9d1d34d40f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 33.4MB
        • SHA256 2ce6c8131eb78995ad58af7e174d519799ff2fad395fd3edaff56eb838de0487
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 34.4MB
        • SHA256 8ddf883b19924a1a49a5a2687ee2e7c3dafcca3109033ef389d9d84904c458c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 31.8MB
        • SHA256 5b9d77fb313af0ba809c793d721487111a3c34b342011bd21e6a93826516500b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.7MB
        • SHA256 b14e746dc98fcc7d4d2c4ecc55ac5e85d6d9f905eb4870bf8d4834f22d0eaf09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 32.0MB
        • SHA256 81f209ac65a484df48093e61651f814a1a5d665696d33c3b76fd8596a649177c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.6MB
        • SHA256 24a955bfb4185bba698a90731ed8f4249b8075e223e909e1b4c9d1ee00d70d0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.6MB
        • SHA256 bc350990be4d2e467b7dd5ee8739dd1135008e8ffaa3885c8439a94a255c2f5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 27.0MB
        • SHA256 03f48c9d163e5dd1aa5e619f2d99e5d620297b2dcc90d2e1bcb6285206ab7dc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.4MB
        • SHA256 15c02a626406f7b7114addb55b496e9de7eeef117f2151ede42cab78ce8c9f20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.8MB
        • SHA256 d9832674299fedaf68c12afcfd1ba9bc588a1c4703d2dee2a3cf4cbd255b2901
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.4MB
        • SHA256 ff584af5d5692b4379e9760e308076d9dc154b05ab5377d0a6455ca4591ec8f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 31.2MB
        • SHA256 2790af798844daf80c360cf28f0a322211cf50f8c96261042290f6723bdd2dea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.1MB
        • SHA256 93effbd7037e5c86007834b561c66ae9c6887bc856d414573c88199c1b043cce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 31.2MB
        • SHA256 c3467f4aa2686d9be5374d5c08dd031aa4b4ed01cde205a7c1e95c19f29d686e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.4MB
        • SHA256 0195f0aad218084775c27d1ce79265e4c67a8a7dd54c5171159dafede8cbac01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.9MB
        • SHA256 1801ed24037ad6f1617569d8aba75b3d82d6893cf8cee5ef880a6a2676594710
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.8MB
        • SHA256 77ec917833f1bd3243c1dafe83e3297f42e2919b55acce28cc0e1253e7807531
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.8MB
        • SHA256 dac28eb228e23db7886792e87fffdc738a539d711e04a4eb2613ac68c0fa66bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 29.3MB
        • SHA256 bac642f6355b8322233a37a167ed4c284c3de0509b45169e27771971c634c0af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.4MB
        • SHA256 50196eb059ed1313157c133c74f80941a0fa22aa602c0aa52a88ef44d505c627
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 29.7MB
        • SHA256 36aebaf3c16123f79ee1ab082bcec24d9aa3ba5e12374303452ef07409f957e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.9MB
        • SHA256 5dd1459828f2216f413a5e1c6acc2d0e787370ad920430fbe06f35b489e46583
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 26.5MB
        • SHA256 ad059ed15a7993dda52b5faaa7d1e2fa9f4f08fbaf02734a353b3ff00488ab31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 26.8MB
        • SHA256 bbad9f717add601d03335c0a4e28301c45a4ca3cb2725b2f5d8fb3aeec2258ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 25.4MB
        • SHA256 a171bd774b0c091566ee9b48d9ebadf60fe76d55229462e707843328976cb631
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 29.2MB
        • SHA256 bb3c7b67335a52f44af9bc3d659961ef9192a1c4d412f5f4108ec6a9beac5064
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 28.6MB
        • SHA256 99448a62f1b05f068eef074a503353ca4ef9c0fe2dcc74de1600fcaee78c9743
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 17.2MB
        • SHA256 3713808b195c8a20c534bfb9ab830532b313ac6c1344c069c3e6cb22ae486e47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 28.9MB
        • SHA256 82accafd3c31d89783b3a92fb6af85b1577f1408db5cda05acef968fee70b48f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 17.2MB
        • SHA256 640a483e5200660298d2077f973d53a4467b5a91b13e4d79eb538efcacd551b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.0MB
        • SHA256 81d6319d82f58d32904f2f601a64bd0e2fbd93a1514228f2627a1f8c41276db8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 27.9MB
        • SHA256 0b55213e036ed951a5bf6ebb3a1de010dcfd2ec1e9849fc2d30dd6947744f525
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 34.5MB
        • SHA256 7647c518d6db20ecc203d611f4f16e594cc3912f2b1ef51a9608841334990af4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 34.4MB
        • SHA256 914578629352df521e1f681821e9944976fde4d924e47d7bc0aaa242c5671cc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 34.4MB
        • SHA256 e23649e3d15b1f26631a4c3f3cced89d721652915f1f8c645c0826fa8137bef1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download