Overview

overview

8

Static

static

3

2026-07-30...ar.exe

windows10-2004-x64

8

2026-07-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    88s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/07/2026, 03:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_1a448fc2f294ef04f8b0ef3a108f2308_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 47.4MB
  • Sample260730-efd8msygke
  • SHA256 2f8779cbb328fed32ea3564d741a73afee3a5a2568ce94f9bbd8965b2720627c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_1a448fc2f294ef04f8b0ef3a108f2308_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_1a448fc2f294ef04f8b0ef3a108f2308_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4604
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_1a448fc2f294ef04f8b0ef3a108f2308_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_1a448fc2f294ef04f8b0ef3a108f2308_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4456

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 48.1MB
        • SHA256 d7a79c204902efd1bf72e4f24ad5f9f4b2f3e87c3e51db4caf0d69e3005c3b69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 53.5MB
        • SHA256 fc36052e164000a08e242b3e714d594fb9dd35334f7a0ce62a8984dbe80eed75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 47.5MB
        • SHA256 cb187722393ca2aecaaa989c1181beeff7c7d90639b91ad99b3b89b607d9a8b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 94.9MB
        • SHA256 248a6dace1a40c65d06a8b49dbac703224a1097ea574703ef62f1ee9743852f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 94.9MB
        • SHA256 fd778ec904e136febbc8da17444be092fe510f359625adfe3752208abd81ec95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 94.9MB
        • SHA256 9b94f7de735d39eeca1cd4cf155717fad5c76442848f56236e033501d1ec3e66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 94.9MB
        • SHA256 d63b369b231691f5a471b4aa0f53e1fd6ccb501a16325b76c570eb4d8cd345c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 94.9MB
        • SHA256 97400a943de4237e6f4d10811f46c66555719d1ba084433982bfed809f100670
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 84.4MB
        • SHA256 50bb37445419d6725ec5ec4c97fda6e8188c5918cf1063b10e8174929181b041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 82.6MB
        • SHA256 3950bc5d4b16e8cae3455b27e325c6dfac46f3ab7172f9fc6d90390cd1103c82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 78.2MB
        • SHA256 418c97e8011e205401026ae61574d16bf8db404b5a3940db60b2a95f0d091734
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 70.4MB
        • SHA256 7d7b6b6bbd23abd34c4bfe0e5e006201e0bac5238df8f9611886bcfcbb99e263
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 68.5MB
        • SHA256 70ec992196eb0120f90d8c6b23771d9046f71d4d16c2e781ea36ad1e7f071801
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 67.8MB
        • SHA256 381081a5019a2462ae8df57bbc2854b8e6d239ff1b6fb5dfb8d021cca05db3bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 67.5MB
        • SHA256 4be8d33defb38719a350697925f6f64215915c80b4033bffe7f5348ecdf62962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 66.6MB
        • SHA256 f48e793d2e9f36508de4aaadb4e3c760c271c9b00a77d6885dc38b78bba11453
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 67.0MB
        • SHA256 118439da29d7004c17f9f97821880bbf8ed280be75721e09938d0ebb479e5f5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 63.9MB
        • SHA256 858be5e3ef3915893c9b3dba8bfed98a66f6c6c2f1284d80b9b042134af45adc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 63.6MB
        • SHA256 d2e711cb4897c4e4d5e1cabeefa6de12f6c764f157f3462822603cc0b30973d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 58.7MB
        • SHA256 38f0c490ee36be4f897cc2068f3d3627a402ab8a713e490248e23d3aa58f60f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src
        • Size 47.4MB
        • SHA256 167f20f3b13f9b223f33e9432a7e78707e9b2281ebb1fc5b0df5f93e87a63959
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 47.4MB
        • SHA256 2f8779cbb328fed32ea3564d741a73afee3a5a2568ce94f9bbd8965b2720627c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download