Overview

overview

8

Static

static

3

2026-07-30...ar.exe

windows10-2004-x64

8

2026-07-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/07/2026, 06:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_50c3fa9aab9500773888aefc9c0f5615_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 24.8MB
  • Sample260730-hraw5ssgpc
  • SHA256 e57242e2805f6bfecebe70996be84cf92b24c7be654a34b35279fd417d41759f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_50c3fa9aab9500773888aefc9c0f5615_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_50c3fa9aab9500773888aefc9c0f5615_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5968
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_50c3fa9aab9500773888aefc9c0f5615_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_50c3fa9aab9500773888aefc9c0f5615_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4884

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 25.5MB
        • SHA256 51c439d9d0cd1c9efd4947c0bb58438a03e2d3c4c86598b171f0fdb9d06a1579
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 30.9MB
        • SHA256 8d0e564de70048db8c2d4cfb40000792a2650b333aa64abd14d2eff4e2e54d61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 49.6MB
        • SHA256 aead6b4d0d6d0ac55d0b21d8ab9473e3526b2552b015684e55356fe4bdef015d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 49.6MB
        • SHA256 016a1a13050762ac6a0444ba0e366697373d0560718108eab246a804dd29ca35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 49.6MB
        • SHA256 da0c33c3bcc0520098311044874764bf8788716570f0ffa5b3123160aca95fef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 49.6MB
        • SHA256 952b9b6da4e50f3401483f1d7e9438ef7c942ab7cc8e2a5d12895b1cf8232ad2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 24.8MB
        • SHA256 e0c813db6aae4e309113436ce184f1b31534de5ba6043d6f8fa25c5785907b2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 49.6MB
        • SHA256 fdb090ebeb6bc824398ffe63f999838fe8680e535157791db5ed4b6299500114
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 49.6MB
        • SHA256 4ef09ff8c42d589567ea2a09fbaf21a728715d5481d4ec838376c0d03fca3cc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 49.8MB
        • SHA256 3a075a7ad7ffabcea44c1c67a4af10f42910206b04757ad60134ade534dcdc70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 49.6MB
        • SHA256 ad07ece4e40cb324a35954fd324f7622e79e06bb50e200c23e725bc6074ac6a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 49.6MB
        • SHA256 575b8e6c17bf5068fdd42cae0704762e6cd9bb3aa9ca2e96ce595bbb91095c1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 50.1MB
        • SHA256 94c3854757c751a045c6278943100ff4b261a897d442f8b6cf3d0f327dd593db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 24.8MB
        • SHA256 324138b24cb4377926e632307e3c24097fb64807dc68ed6564ebb0048b040433
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 49.6MB
        • SHA256 ab98ddec2256d55842f97064ebc4c704f0e9eedd126c22eb2ac0b787ae003337
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 49.6MB
        • SHA256 3d7b6f47d5c2604f897dbcda682a814ad2f84b359fa2f81a9333ac02bd2af4d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 49.6MB
        • SHA256 ccf66ed1014dcc860e64e26198e9c5765cace19d30a503987249eadae5b578a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 49.6MB
        • SHA256 67661f047a2fc92fa2ebaef39c93ff3a38b5784f95406065bf9dd020027f94fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 49.6MB
        • SHA256 8b4729008bfc4a1ea70aee5a5c28f9ee39626a8c0864a189e978d5050ab73aac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 49.6MB
        • SHA256 804b7255e52b71417e423c031103b62e9226ff6f915ee04f455ef98f803c0f42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 49.6MB
        • SHA256 cce4686b21749202a945feecf0f280b866e6f316c0a352be9109af0f525620de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 49.6MB
        • SHA256 a675d1a4877382f200da9d28b38b66689ea7cd481b1cfaa43efcca1784cef917
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 49.6MB
        • SHA256 22c4109182ff629b96a71f3e9c847a050e30dfa288b53b6fa9af4fce036b0d28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 49.6MB
        • SHA256 a99975100b638f29f2af1bc0555e3400c32a36c0569a405054ec3d3436cebebd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 49.6MB
        • SHA256 be5cfd021f54e3379ba2168abb7cb3305cbc1d2c82170c95e0f3017f4685171a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 49.6MB
        • SHA256 1365d21a9a389016323dce013a1aa703fc91f45916bf53da05ff59261c5662af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 49.6MB
        • SHA256 802d0bec8e187542b42e31199c16020297a6166852cffabb5f3b3a12c2547661
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 49.6MB
        • SHA256 b10d13d37134a0c4d0df7ce5775b6f3849965ebd2491f1ea6bd419f79900b77e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 49.6MB
        • SHA256 2f696653da7c307f0bdedbb8ceaa404e9fbeb669d179617153a1c4e3739f6038
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 49.6MB
        • SHA256 9339bc00ccdffc967c1762206190b70883a254089de17e1c00e29026b4ed9baa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 49.6MB
        • SHA256 a3eb55ebefccdaa27229e3ae2ae2b8d65440ee01c0b5b61285320f542fde9280
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 49.6MB
        • SHA256 3a97ed3b90b15954e08c5060d4f96829ff0833b9b7fe5dba63d0f2da3c9cbcee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 45.2MB
        • SHA256 68e9dbb11da7fc11ff0b21f11f1ab1baf4ada17c0561ab662b844ea4fbcb8080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 29.1MB
        • SHA256 baa43d655b6881d02cbcf72769861e8f3ce2faf3800662ec2047cbd34dbc7663
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 27.6MB
        • SHA256 04ce934297c27432c89060facdfca027a5c9899545ca54e1c0c7c4008a4bc8bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 9.4MB
        • SHA256 16c275d9f0d1c3dc86eeeb13186b0c5660fdf552f78c295f3fded619d8ffe2ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 24.8MB
        • SHA256 e57242e2805f6bfecebe70996be84cf92b24c7be654a34b35279fd417d41759f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download