Overview

overview

8

Static

static

3

2026-07-30...ar.exe

windows10-2004-x64

8

2026-07-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    77s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 03:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_1a448fc2f294ef04f8b0ef3a108f2308_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 47.4MB
  • Sample260730-efd8msygke
  • SHA256 2f8779cbb328fed32ea3564d741a73afee3a5a2568ce94f9bbd8965b2720627c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_1a448fc2f294ef04f8b0ef3a108f2308_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_1a448fc2f294ef04f8b0ef3a108f2308_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4164
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_1a448fc2f294ef04f8b0ef3a108f2308_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_1a448fc2f294ef04f8b0ef3a108f2308_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5484

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 48.4MB
        • SHA256 9628b5209233f3a66231ed37c191ce670fc4817157d2705938453dd82537986b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 47.4MB
        • SHA256 2f8779cbb328fed32ea3564d741a73afee3a5a2568ce94f9bbd8965b2720627c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 92.3MB
        • SHA256 73cae0091b71333c12878d5b38bde47580371323dc941d3ad5fa1a5409ab4956
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 87.3MB
        • SHA256 c6e889e2095892628f56b04e877a08d1979c26e8f9a053b0cd11510e646ee563
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 82.6MB
        • SHA256 379acaf43b2d366c6a151d4b506334bf3a121acde6a11f490aa48c2816f488f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 80.4MB
        • SHA256 f8982770291ab2f768e1a99a08c92767fe58e7e708e5ddc1d3b8be62c3ac010b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 90.2MB
        • SHA256 ee671e46eb1aa2875baf786d9917c2de875823d601dd5ff6e8594906c049350e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 76.4MB
        • SHA256 a80f27f131171697c1165f648f7fbbd7f34caacec70048d3312e73851a836fc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 69.1MB
        • SHA256 e3a1bf54e229ec8e591089ead3bb2297dba1b4427c27cdf1e35faa1af1186248
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 68.5MB
        • SHA256 70ec992196eb0120f90d8c6b23771d9046f71d4d16c2e781ea36ad1e7f071801
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 65.1MB
        • SHA256 17b9e509e13959778f8b406ffdfabe71dc5960338939efb4e4b021b5de670d9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 64.1MB
        • SHA256 220b24ca31661e93189fa84029038e58c727676753552c827813d0cdcc4433c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 60.8MB
        • SHA256 f4bf951c2f5f60e60972112c7bba230fb3ec20db08492a211ab8cec8c39b283b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 40.0MB
        • SHA256 349ed0d7ac3e80a803c66fbf5263915258ae5c89ffef488311f06db1e8ce685b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 35.9MB
        • SHA256 e6920524a088bcc22c9be2dc191fb3005b0b98fd8550f61aba638339121b9ca2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 33.9MB
        • SHA256 b47b1f30095bda1900d334f16fa7c9b28e0a36c7eecd82ae385c4085aa705836
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 32.2MB
        • SHA256 4db42a13542fbc1ef3e090a50ef1dec2627616bcbfbeb6e7702e52b42e9a9693
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.9MB
        • SHA256 8462a72cf976eb040499dbeb470e9f5da13a4a259c7d138bd5a7e6b5fdf1e6d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 29.6MB
        • SHA256 334580f3cde3769744a712e25867978e01065611dad69e3124eaa68fbd0cddb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 28.2MB
        • SHA256 152478f7f6cef66bbe1833ee772ebc4b7d28afc6507a51d6b85d4319f9174981
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 26.7MB
        • SHA256 891a5cb9144f7b2b694510decb7b2f8e6980048ec0cfdce8c967a143157fbf8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 25.9MB
        • SHA256 c2d49ef41a74d36e5cc2bc47ee500b4f524c19916dfa256b67fb9322e00fc4d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 24.7MB
        • SHA256 45c44bbaeade5600880b2947b694c76d538622fdff53f37f5477c4cbaa9ed327
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 24.3MB
        • SHA256 fc4da7d293c93d4b5f194db820f25f847d212ca08d228e32015e2bd706596a4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 22.6MB
        • SHA256 cbb6aa9f4203eba968faa5b928c500596293f99af45da048930e9f93d10eccee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 21.9MB
        • SHA256 c7083f08272ae6f4ef74feeafa8e3e13bbe18cb395ae036eaccf08dc9e93aac2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 20.8MB
        • SHA256 c44b7fc903e1e7689fd8d43d3b11671d049022e3c4fcb8be696421be513e5c0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 19.6MB
        • SHA256 a46bf233e0827203258b90dd9139fad164cd7426e4132f65a17787b8329b161c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 18.9MB
        • SHA256 2b5dd55187477358b7c8725bc6dab0ea0a2efd5ab0f50a3c0a5371d5d655d697
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 18.5MB
        • SHA256 71b8381627976118e1538e5e0f297bccf9b6060fdc379eb22e27a39555ed4ee9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 18.2MB
        • SHA256 cf65cf5762fa4f497a47473a49c5b09f301fd3b24c5d9f66d4e13349082ee9c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 17.1MB
        • SHA256 48abc9584c12f0283a93f8953a39f1a162f43f56a3b2a18479bda038918c3346
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 16.3MB
        • SHA256 b5a9a829c25c5901cf463559089175c6311d7ea0e8c1df00a66abb6b3feb278a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 74.9MB
        • SHA256 75b5c18735b4c90872c5691a7c48267607a8b8607ad24a8181eb0b8e8f296219
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 73.8MB
        • SHA256 9f8ece58ad488eb6d8c5970be6d4c663e98b48a44bff525715f81f7a1c03fbe0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 74.0MB
        • SHA256 c47cb954d106484cb0ea8ee9ad0f749ec62a5fb2fe3c8eb2a6f6626ab781138a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 71.1MB
        • SHA256 8c9863a80ddffe9e226ef0a78ecbe66cc1bc3786e80db0eb858ef5198c33d3fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download