Overview

overview

8

Static

static

3

2026-07-30...ar.exe

windows10-2004-x64

8

2026-07-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    24s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 06:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_50c3fa9aab9500773888aefc9c0f5615_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 24.8MB
  • Sample260730-hraw5ssgpc
  • SHA256 e57242e2805f6bfecebe70996be84cf92b24c7be654a34b35279fd417d41759f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_50c3fa9aab9500773888aefc9c0f5615_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_50c3fa9aab9500773888aefc9c0f5615_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3216
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_50c3fa9aab9500773888aefc9c0f5615_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_50c3fa9aab9500773888aefc9c0f5615_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5772

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 24.9MB
        • SHA256 47a2c71a1428a17d2f1f9c931337fc1907b7bb690652b35d253b4648f32ae27f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 25.2MB
        • SHA256 cae34cf6428ce1cbb0641f558ce69007eba710288c867a25e7f74271bb1a57ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 47.1MB
        • SHA256 139a3879075426a2bc25e1eddbe54c72cf64ec3cb5823ff1aa76a648bdcf5194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 26.9MB
        • SHA256 d61845308dc0c1741f50bd8f405382288a55018ba8503e0d8be19df1c7ba76d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 44.4MB
        • SHA256 b97423abcb0d6b0588c233334db92cfda37042e865c227a89b4e44255929f11f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 37.6MB
        • SHA256 edd5b67a7ee40b50ae1dc12eeeeeba1233da68a937208d82120b79747add2110
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 37.2MB
        • SHA256 f3352c91b175c0549717f32bea37f515bf56611163195885821a0a13c1e84f80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 36.4MB
        • SHA256 ce775f0ab1ec5c223becfbd6cebe613f91ff495297dd1546ac6162c43a0117cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 38.2MB
        • SHA256 e90dea4ddf286cf58fd4554c93a057e048e549c9f393ebe0ca5e4e85bb150544
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 38.5MB
        • SHA256 8370535bde3390d12343c825cdf05be0c864422538ef25068d7a43f385f5c5eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 35.7MB
        • SHA256 f2139223b7df66d77fff49c169a8897e0e4acb009b6830153a456cf43c14c320
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 34.6MB
        • SHA256 b1cdeef7544e8f783d781144af16e99e345946fb30c3b9e5b44d3c8ce63d9419
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.8MB
        • SHA256 c0983b0f8c4b55d0aafb525dd3cd07c8d0e31bad3bb894c907dc372892b58989
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 33.4MB
        • SHA256 ef49e08c24fb024b45505a8de30700a4e8f48cc4cc26738a869f633c202286ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 32.2MB
        • SHA256 cb59040914cff82840030b6ddc777e588dd15cd350f2b1c4ec57c6732cc892d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 32.0MB
        • SHA256 984255a43cf99e21b897ce2690c202a1195d697e7c3767584100df0c7cc2a7ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.8MB
        • SHA256 c1b6f225612ccb9c414b8513027c968cc21c61fd946c56b1ecce00f33588f9dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 29.3MB
        • SHA256 467c4142d8ca7a498cdd4c94175d458aa91839feb0d1b2e92a8375b4b0cf76a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 31.6MB
        • SHA256 1b89b09711dc0a417be51de30dd3d433b032d9f861aa2314f03de8784cc435f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.5MB
        • SHA256 e04a91319d681d637aa1741070959a7820ecfc78c56a53108a8f0fc70d3f1ecb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 29.0MB
        • SHA256 8841815a5f61ff6b91c43ee74fa7525ce64a67c4c0f954a28f85e8daa910714e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 28.8MB
        • SHA256 179bd66321a363361ddb001e5a41b059cda44ed3e9f6235e779ca53c6fc1a997
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.4MB
        • SHA256 45ca49f25ef7978600dc4bfbecbeb828077b442af0e1d1e3ace02027ec2ab1fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 28.7MB
        • SHA256 55b1e940a1f561be27d5172449357988f4569f7b16db83583b7dab1fe155b8df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 28.4MB
        • SHA256 e8be29ebc7eee4f6eeb29a84784a6e77dbb803c5958e9e7093f6da9c665bbdf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.1MB
        • SHA256 8df94d9a2f6f8a69c6107e71b627d524a20c5da11273db4afead7576b152c528
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 30.6MB
        • SHA256 d0613f7b57537f85180aca73d8e26e213344ed1c79724a06252a77a9540fd557
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 28.1MB
        • SHA256 81b49468811cca1030b70fdf6c4a07f3e7926805ef0478e36956e357a3668ad1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.4MB
        • SHA256 fcb233ca1b80622cf6ad2e2a343847a75f77e2d492485ed929590339821ec35c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.4MB
        • SHA256 81b82bb9c33fa13d4081d2470fac016ce56a9b9feda90e92f07f44c0ca9a2e02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.8MB
        • SHA256 000212010f3c312828c4b6d05fbf9118fb38d0b4e1cd4cbbbf5ccd29ce0fdfd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 29.2MB
        • SHA256 be2403cd2dc179e47cf8490794b7c5c8def5de2b65f6519372f4fef3793ac8f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.1MB
        • SHA256 1002b1c13a47a58dd219747950f6063298a0eaf94fc289c222f3de7d837eb9a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 27.6MB
        • SHA256 6b8c9db2f750583b18557bacda4baa3c7716e1ae4ff9f491eaa95a496ad978cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.9MB
        • SHA256 0c243dd7450a69731af8cac0d07b547b4c9deb15c34bc5b3e20b4301871de7aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.9MB
        • SHA256 5d264af9679b6a3d5e7b552a0a95d697d41ba2a6bdb5d0da57b06739aca032a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 29.8MB
        • SHA256 b8d12c721eeeeef8631cbccc4e309c7ac59460cf279e351302b83b0f6e076345
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 29.6MB
        • SHA256 84c874e5c3a25e0b7056b0991159821b4a7f241f2cfe8cf09dba7f7d13f974ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.8MB
        • SHA256 db11f716b78dd1933f76a582b2ea383934478040c1d4f0e44bea38c594fb3f02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.3MB
        • SHA256 76586daba12bc6e4601af7cd9f6cd6fddb65d538f245d11153ec88897b5624f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 24.8MB
        • SHA256 89bff84b9be31d6e735db3b8c9d0c0868e28e019450eea12b0a1b22a3b80b38a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.1MB
        • SHA256 baa43d655b6881d02cbcf72769861e8f3ce2faf3800662ec2047cbd34dbc7663
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.4MB
        • SHA256 926578477cd6a6e2fd6439b6bdae56270371d60d1f2453720ea1e78840e7ea54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.2MB
        • SHA256 3d296f1f29dbecc7e59df136e470224567f4a13ab3cb368bb99947edde74164e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.0MB
        • SHA256 f3273efc9f00413256a6d5e2c5a7966ea6e7da164b0153fd6a9a1372652e3e8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 25.9MB
        • SHA256 61c315b1a66fb59214fc4d50dff0e656ebc672b278fec65d92d157e6c9a0c99c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 23.3MB
        • SHA256 15552484c88e70dd7c6ddde69edd7c682a217b63d9c6523d9345ea245c44685a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 25.9MB
        • SHA256 aebdf4049e9af0be84a1653292032ff524c68d329f928cdadc63087a9f2a5a65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 25.8MB
        • SHA256 4df14797bf9d396fb6b4128fb72b2918e8f50a91b88f97939784a284b86f6def
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 25.7MB
        • SHA256 19df3d2fb80759a06e0f4814d1aee9d198530931f6d2afafa87df2f6da244f93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 23.2MB
        • SHA256 aaba2731ece52c5673d6cb50f27685adcb33a9277c88e1e7cc60808e2a96911c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 22.9MB
        • SHA256 a707426a570f4301f8314aaa2c34c8c5d5d395cc96de574adfb6f6aaa6f08552
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 39.4MB
        • SHA256 2c165552143174f2bf40b3bb8216ff7368007b1cca55202f4f5dc2cd73c92e1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 39.9MB
        • SHA256 383ee2bf1d1870d611d6c17c2080c6279c502a83c624fec51a56def66b522809
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 40.3MB
        • SHA256 a70e91fef6bad735424772b5ab3db7c22280f4617a635c4341d3d09b4d8e6301
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 40.8MB
        • SHA256 97343c01e6213e52fb5ff91fc4bef831c1d2400459f23b1678eeb75eb05cee71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download