Overview

overview

8

Static

static

3

2026-07-27...ar.exe

windows10-2004-x64

8

2026-07-27...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    52s
  • max time network
    120s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 15:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_c5c39ead9147f7e4170a2393de60a69a_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 17.2MB
  • Sample260727-sxtljswwcv
  • SHA256 bf3f47eb17f78a8408a78904548143448edec86949c1c562e443b0f90ebdc678
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_c5c39ead9147f7e4170a2393de60a69a_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_c5c39ead9147f7e4170a2393de60a69a_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5064
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_c5c39ead9147f7e4170a2393de60a69a_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_c5c39ead9147f7e4170a2393de60a69a_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5916

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 34.7MB
        • SHA256 aac8eae65f37ea9d374804c6ab00d968703dfe73a8d984db07d6765a0faf5e2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 17.3MB
        • SHA256 24dfb18bb7a7bc542e6569356997216c19565a4e4a69bc31aee51aac3bcdbfdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 38.5MB
        • SHA256 09f87e743c8adf6cf918f8255ea3afca5881c1ac133a0c5b7706dd56185caa31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 34.8MB
        • SHA256 173fb12f6b9829e7019023f1169d287467d3c0bc52e69972afa6b40ce3da3ebf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 57.9MB
        • SHA256 8cd33f36d7ec0091285b290b85dd0ff6fc38f241424c51c26a2768e52a9144ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 19.3MB
        • SHA256 898663c50cbbf185d34b7d782dee8a68a0e3fc28730e6ce2609d1031f29aeb3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 17.3MB
        • SHA256 b31f1d887cfdfc0c331ee0b6935135e8be849c5dfdf54f79e262184764da54fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 40.5MB
        • SHA256 0592a3b64beaa8bbc89b82f480f4b9474237d9a63b4306074bf0d5d16d1d0946
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 36.1MB
        • SHA256 1acecd56b696d54571c796b5615bab06da52c28670d708d4b46fb43dc6683041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 37.9MB
        • SHA256 8ccd5edb819916a6418ad7b8c25f5064046698f1152bcbd876da3ee2fb960a99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 36.7MB
        • SHA256 ad67e0ec37aa7245eaed7e1cc27ddd24785645974501e7bfaef0d81fbe9a580a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 36.1MB
        • SHA256 4e62b78ab860f114ee90b226a34a360b0f131da0d466d0cad54661eeef520178
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 36.3MB
        • SHA256 d81143276553f5c563e773b2aee690552925f85fb0c833248c3659dde85bbb17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 37.5MB
        • SHA256 a9640a670ab4738504d466b4812e6813cd2b4349d7d3140eb582474436a2defb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 35.8MB
        • SHA256 9276307f5b00dec78210598c597bd65851f170229f83c9030b47b42969a6e4bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 34.4MB
        • SHA256 ad6036966388ed8ec00b1ea176eb9d3b583462c0ce9459697fdfc31b32947187
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 34.4MB
        • SHA256 21e4a42b7f21cb874ece77f451f6e288c4be5ecb269c44e09af17c663dc77d6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 34.5MB
        • SHA256 c7dfd8ee0940dd33156b7da7fe39aa161a09041258ee7e8ede02022ea4efc260
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 34.4MB
        • SHA256 8bfc5d3506275a07b46c417964e8ecee3e834095196b764b21d5f27331b7f2e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 34.4MB
        • SHA256 39f823da91df97b9ac305652f0acb8a9fe73138cadf048926253e1efbb965f12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 34.4MB
        • SHA256 28e520d5a384015225a3420a324ef750368321652059d1a32a7084f2486d275a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 34.7MB
        • SHA256 6b859af82bdbc971ce712c649fb09b85589d787bb2d2cc4cc210ce8fac974e70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 31.3MB
        • SHA256 ea3d9e33192dc26094ecd22c88b219df59898e133283c64c9d80c3f3db6813c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.9MB
        • SHA256 0a662077b0b5f9799f69aab564f6fb8446ceb0232c5bb79c82b52205cc8071d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 34.5MB
        • SHA256 b76fe784237af2ef5c81b6d7ee3fbd0bc9b615608bfcf6b49ca473f4c73373fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 34.4MB
        • SHA256 df33ef0ef5d8f6a660595521960bbd68208ecdd9b93143ca3163b2aafb6c508e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 33.1MB
        • SHA256 da763e91147c7359fca390622068cde2a2b1f891b90378628302acae99ba4c9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 33.6MB
        • SHA256 251eda4ac29711e402610762db5445c13ae4be20aa8abe1f0fe741f1dc906929
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 33.2MB
        • SHA256 1ed567d876f80104aa817f27b2662d848b8491cd5a297971979be83db5de71b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 33.8MB
        • SHA256 813b0c2b6045ee79ce487f90b40fb0ae62973949ef0085e7566f681b26d4c899
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 33.8MB
        • SHA256 29c9197e4fdc1d036b426c4c11f43092a6fb01ff9193696271c12dcd44a19690
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 34.4MB
        • SHA256 72d2f6595f5a7627d6c6d0d547e6efac081b5c5e9126c19fcd7f0f3595bd6140
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 33.9MB
        • SHA256 0c5b684a1846222863ce9e2438b684b669e42de92ad3abfcd13793ca6d942afa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 33.4MB
        • SHA256 e53a9f8e0bd4acc6c5533a7970647822b8ba8696e30baf3fcd193b5e41b5354e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.4MB
        • SHA256 e6f60fd690111654562999bb6fe32c86e9814021d6ad44c2a8fe62849e97a62b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 33.6MB
        • SHA256 d0a0627d245fc94ecfff3b8d7a6b401ecc2d80a3f67ad37270e475d8de061f99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 34.4MB
        • SHA256 9b7175f5f4a8dba624fc9c17607e151550288358326700eb2fabf5f630f6697a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 33.4MB
        • SHA256 69b0e1febfc0d03b5dce7cd403c46fe9925ced4032e67ce838be812f976f95dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 34.4MB
        • SHA256 f427bb38f3dc6ef1af3bfa1d937ebe9cf5047c308a8e2ebb42a8f193a7c9c294
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 34.4MB
        • SHA256 df3b542954e12333dc9790d89d3148a45d71145e872f37a67bcfd42c7b368e1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 33.7MB
        • SHA256 3521b64d20aa55c120759b030a90f5061ffd34f310efee4eacc0f4c268f88f4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 33.1MB
        • SHA256 c3bdcff8ca2c7e48fae1013bead6ce3aff2a45356c007b3a236725c657cdcc31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 32.8MB
        • SHA256 861c6f5ccd7a22669d1a98a9be49c1bfeb11d5ccde09125c7264b17160953df4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 33.3MB
        • SHA256 62d893cfe99f08667b47bece80b8e223568832761dfce485db5106e0b7b1d39c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 33.0MB
        • SHA256 181c95c10bbc11f446a11e850bacacb576056aaeb1b8df8ef9f8032c01d158d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 33.1MB
        • SHA256 1c9ad2229feefdd0a6a36dfaf42e0dc990efe8db76312d4dc07a9d2b42816849
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 32.2MB
        • SHA256 8dbc258ea2c40912e05d9f52e6b4196afd789bbd398dd8e680545a3166aaf3f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 32.6MB
        • SHA256 7c3a24722d5e86704b3a589ca995f9685c5a41feea4b64ee37c3494f61b59624
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 33.9MB
        • SHA256 a520c1b9964732ee865e4aa7ea4e945cefeab780c7112bc376036fd12f391d43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 34.6MB
        • SHA256 6adcab6d028e62e8afd1b3824531462881d481a8b79ce288b449016bb73d5a94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 34.5MB
        • SHA256 e14f41426b44973055f3f4ab5aed3875baef64b5ff2d0ad0c62f0b2daf6209e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 34.5MB
        • SHA256 9aeab57358e334998d5e6af3c60c6248730a8383e1e75e45c0baedf0ec837f1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 34.5MB
        • SHA256 cf6c705e2a1ec5ca67ca0fedb2beaac833509b1d5154d6cfb57398d1fc0e5297
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download