Overview

overview

8

Static

static

3

2026-07-27...ar.exe

windows10-2004-x64

8

2026-07-27...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    34s
  • max time network
    79s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 17:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_8872b20a6dbc0aa223ee8931c7ff40c7_cobalt-strike_elex_emotet_glassworm_icedid_remcos_stealc_vidar.exe
  • Size 35.7MB
  • Sample260727-v2fxcsaq41
  • SHA256 61a816c7fc2caa9d7f110d775aca67de36bd6739ec5d871af2f090bca05a0623
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_8872b20a6dbc0aa223ee8931c7ff40c7_cobalt-strike_elex_emotet_glassworm_icedid_remcos_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_8872b20a6dbc0aa223ee8931c7ff40c7_cobalt-strike_elex_emotet_glassworm_icedid_remcos_stealc_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4428
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_8872b20a6dbc0aa223ee8931c7ff40c7_cobalt-strike_elex_emotet_glassworm_icedid_remcos_stealc_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_8872b20a6dbc0aa223ee8931c7ff40c7_cobalt-strike_elex_emotet_glassworm_icedid_remcos_stealc_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1052

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 36.0MB
        • SHA256 2fce6ba78a7e9edad0a31a6a3fe57d32c299daf2aa496ff4b1ea8a363252baf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 59.7MB
        • SHA256 1bbac05f251922198ec003e584b804ae6bb1e4c18e3d5b369a00c06e999152fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 60.6MB
        • SHA256 eca93b76425cea2a55132187cd615f5461912b4af0348377a4f47533c114901e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 56.3MB
        • SHA256 cb5795c71ce7c6fcfc01046fed6821bcb4408b406ceb4e298ff47148f667e14a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 37.9MB
        • SHA256 463f13026d9c9c7ae9ef8450740735e79cdb064b49f069a933d8f05ef8902bbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 53.4MB
        • SHA256 6141cb09f11555d0ce3070b9decbafd7cc1f2434a1a993c079df5dedf7e4a3f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 46.6MB
        • SHA256 d0926f58b2cac513ffeb2e07948ff1f509f7d7c07932f825d41fdd1235b2a00a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 43.1MB
        • SHA256 26a0fff4dcea556ce134b8bf607b6d9e9dadf08699dee14d948a9695a5acc26d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 48.1MB
        • SHA256 edcc1347ab680db7885c5082d350b0120e0038ce0bd51c41f1409ac2e34bb50b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 49.3MB
        • SHA256 3ba6eb418c93b2e8a08adc51b9bdcafa0de8892026c2f66bbf196d956a4c0b20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 44.4MB
        • SHA256 b750429f3f597831349df80abcccb9d88f5eb2101d47249a75b75cd50ae6c298
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 41.4MB
        • SHA256 00c55b9214f6c588f2a2778200ec21af225617992df57eb2677a7bf26a64f725
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 39.4MB
        • SHA256 cab89f64c659adcedc8322e61018cc82bf6a15d6eb6bd26bf25fb1f31780d51c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 39.8MB
        • SHA256 801b654b7ff2af5f34e53e7f18db332a97748adcbc112574a259f6df042e5082
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 38.1MB
        • SHA256 d21526fdc250cb6cf368333145b3400c32a12b2f5ef84c4bc74e00897fa01512
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 33.8MB
        • SHA256 72f13f7ad11d524cca81d5dd64a4874987b1cb755a8057fa952b2267642b76cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 33.0MB
        • SHA256 ccbf294d1fb31ab425057c4fe31537a6b32ce2c1cdc39c3772e3bf1a3e7a8304
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.6MB
        • SHA256 b32213f32799b6640860c0d0c4bb88adf787b07458b75884991fec6076d37055
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 35.8MB
        • SHA256 68f24b1a6f8c8f02b45b02d9381ad35240c414f623a7769efea172a967696048
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 35.6MB
        • SHA256 3079428634048f1aa164c4a2c9de04ffe3296c5b6d1dc31d5395aa98809cb3eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 36.3MB
        • SHA256 ed96dfb6c5dc30e0523b2cd9c818ff48f10af611559100bf92c715030ea1fddf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 35.8MB
        • SHA256 a00dc460c8961da0b619aa8535b5459dbda6673e01da9771c4f00d25c55d6344
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 35.4MB
        • SHA256 1067fdae7e7be42c174c51fd4948d0452fda60ce25a947948fde0a329d2d7312
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 31.8MB
        • SHA256 8aaffbca776e1f4dce1e54c73786ee5cb4a07eec0f5d170b0cedc2aeaa803160
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 34.8MB
        • SHA256 66ff5a89ce65416a26074ac201575d3eb18c4db431175d7b31f40e653e716888
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 34.6MB
        • SHA256 a14a17050b227f02a721b6d903ab9916aeffbc036d08c37a3674977e6bd7a1b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 34.4MB
        • SHA256 23b17662a8415e69f849cef7fb465b4b7b882ad5b065570d61b6a085becde177
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.2MB
        • SHA256 340c11b753753f01a2cbcb508776d16f8b980914c6bf37bc0dca3cf51a0a5615
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 34.6MB
        • SHA256 858fc149d809cbc473daea6065423cd21d5aa12a9454261e0c2414dcd23f6e87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 33.6MB
        • SHA256 9b4b5d7cbffe1c965b242ed327506dde93c7358a4c8ab8e555c4faf3637c2437
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 29.2MB
        • SHA256 faed148f4d079ebbcee43777f83dbb07a3ed9b6431d9522916041052ac429f6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 33.2MB
        • SHA256 687bd619906cd8dbcf65c0f4a5c863a8fc693c3496963e416666c581e6b772bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 28.8MB
        • SHA256 082523330d560e209f1d664f5399b56289dbf99890eefe08e0f54feeb16f6d89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 32.5MB
        • SHA256 755ebba71084c3e495aa3d3189d1e66f1cf45665216accd180c290bcec8cfd5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 32.1MB
        • SHA256 597fadd26c5079f83db44692a6ec7982a96a0611f0b06d6c4477a7040949771f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 27.4MB
        • SHA256 5774ff61ab220a91138ba3d8081ee31d499684013f5c5b4375714fe332207023
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.1MB
        • SHA256 9cd3940d4c9bc2c1565c8d7a1d986a4acd7f74ddf526531d6edcc4003dd212f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.8MB
        • SHA256 48ffe37681e72721106d20e36657203c824a3228fa6dc808a0456be9ee6095c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.3MB
        • SHA256 9d00adfa9bab61980a1128613c93bd68379e74ef2882f34f930d8b2982b0079e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.6MB
        • SHA256 34ddc4d68b9423c717103244b2317549fd79e64626d71733d67d4c2dc91324b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.1MB
        • SHA256 e744ef317144ef0cb4d49a68f999fb5588f418af0b32ada3b552651266691387
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.8MB
        • SHA256 9453331c27ac1cba6bfb6deb2d81927dfa334596fb4e29cf71f35717d582bce9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 27.8MB
        • SHA256 66e42b08930690f27451fbf5528c4dd3d756cee0ae58cd4aee11791353c7f8ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 23.3MB
        • SHA256 2084aa1d4ed81474909db78a4cc94be97743ed2532159e1bbd7c47133d4737f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.9MB
        • SHA256 2178b78473c4d7a31c6f0e003d5c4a9166d5d4bcdb1674bbdd8abcdc06fbb5b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 23.2MB
        • SHA256 01e9d67c610f57fed37caa813571b76ea035de20ccc7193365dfcf6fcf35e4ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.7MB
        • SHA256 aa522abb194499c3343f6e642f34ddd3f7e56866bb8fc196ced62dabf9f0e3c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 26.6MB
        • SHA256 429d43c3a96305e680db9a5d4c12ad9e4198b7d713c747ea53d093b89fd21d4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 26.4MB
        • SHA256 43bd2f60a9ff59223c7576cbc27235b296f57215dce8acbd8be050b89696f3ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 26.2MB
        • SHA256 a0009e337838181bfc8b9eab0860bc6d3534513a7e351918d43cf026f120d976
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 25.9MB
        • SHA256 5ef47dad9641d10769d71e8dfa3df304b5f2d18c6b9e9502cbbb20fc5db1063f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 51.8MB
        • SHA256 2a8ffb2be6ad7f51bdc0f673a441c5cf0c99c164302c6468b0211521625ebd3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 50.4MB
        • SHA256 9b5238068fb945cb5b9c0cb86538a7aaa2eb493ee9e77da093f700ca99681399
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 50.6MB
        • SHA256 070e45d7285a491ba9d05016b15c83c069777328f2a4ae66b753b4cb2bb8e6d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 45.2MB
        • SHA256 451254396eeeb0307919f9f96e7018fd30254da6fa9c43abb3c3435d6fad3a5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download