Overview

overview

8

Static

static

3

2026-08-01...ar.exe

windows10-2004-x64

8

2026-08-01...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    14s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/08/2026, 16:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_9eef8716226a900b3fcdbad9d8e54513_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 14.8MB
  • Sample260801-tpb7zazgnf
  • SHA256 5c9ce17219feadea2c8635daaef5f538a5c5d096d1dac2cc7ae6570fe2d1f391
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 59 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_9eef8716226a900b3fcdbad9d8e54513_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_9eef8716226a900b3fcdbad9d8e54513_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1012
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_9eef8716226a900b3fcdbad9d8e54513_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_9eef8716226a900b3fcdbad9d8e54513_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3536

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.1MB
        • SHA256 c0d518ac9a67a2a3c32fee01d4b3a42e06cfe654f3eeea82bd30a7af648bb4d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 29.7MB
        • SHA256 575cb6332b39efdd89ea6bd81bd9f88b1e95e6674b504f576adc63aaa094d24a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.2MB
        • SHA256 287ddedc0d9bbabc909e292660409825ed70b8add0feac5d0fab605e866462c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.0MB
        • SHA256 f13a00ad2e783b9734fdedf292a27fc8ae855f4aa412407095d6fcde6929c4fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 29.8MB
        • SHA256 45df1d3b8c5d014d40b4e9167a0e6887a0e7f2c48c59593c2b180e5fd3c1a8df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 26.9MB
        • SHA256 305eb1ff2c20ea68daf8bf84cb0a1b1b48f76b22388305a2fea049f577f38c28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 29.2MB
        • SHA256 8b54048ab1a2279c87e4fd2d2eb2ca762bdcc6717fe6adddc76e86a4b6cb2b77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 27.7MB
        • SHA256 acc02d11b9bbbf03834497409828b0e78837b79a5368c076e14ed402060fee7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 30.0MB
        • SHA256 b7bada0852555bef2ed09b6dcba7f8a7d38e9d85a8b1efa0c0c10873f43d78b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 24.4MB
        • SHA256 b647ad8306c9fe04739957607c11226fcbae0891f336eb84df670ad2df0441d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 29.1MB
        • SHA256 f2744ce9cf0d9bc39fec2bfa10bdfb0702ed6257c9b150ff2dbec7e1a3c7973d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 26.6MB
        • SHA256 5475c6624a18e0b4da714efd10445942a9d3e00dc27d83e5b396f6b4215cb12a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 28.9MB
        • SHA256 38824cbacad795cdc4e22affca79ab261e58a3acb4190ace96c8f6936a0bb78b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 28.8MB
        • SHA256 c7b83c2edf8dd49bf618e3a9bc2736a487383ba79bc5bf3ec96039c6747618ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 25.8MB
        • SHA256 cd474383a91a3a63d54b9d530492ee8dcf6c90d11b5c124d6beea0b4a2f8e883
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 25.6MB
        • SHA256 cae240a8e719a48d1b58392b450688a41aafbbf82a8a7640fc5a2f813759f5d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 25.6MB
        • SHA256 5d7059322af2da749b178d59abd0826017a4ffa5157aab15faffd1d3d1955e55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 28.5MB
        • SHA256 80116bcea7410fe23c5c78b9d278d172d0e8d7e65c82b1651568db4b53e39992
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.8MB
        • SHA256 faf530292a3e4ced653449c26090479819c0d707130ad3a399ea0658e5eb2472
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 27.8MB
        • SHA256 9541b7a493dc2d4f0fb5d566d9220706d0a109303a5959116e4cc2de7f8e7968
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.7MB
        • SHA256 6112d11df34ca71f12981525e4c96580bce428a996fcf3c33330d2782d387a3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 25.2MB
        • SHA256 ca90c18d5614fd6f83b6f18743f387092e3d98790f3d68babbaff95fe32befc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 28.4MB
        • SHA256 679cf39d758cea59f1a399a7e4341f3c132d4c41d3396f8c9ee6eb4da77440aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 24.7MB
        • SHA256 65b5c86f264cc19720124da1de9351dc3dd8baeafa62028415e5789ec9524e3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 27.3MB
        • SHA256 ee9ef6c60d921a701b0d7e343a7060258a55c8626bfb5cf42d7e6160811f4921
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.9MB
        • SHA256 7fa36b8a56da94f9ba8f57c1b55b63e652df115b7cda71ec745768715d76a42c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 27.4MB
        • SHA256 b427190d2bff94a09ebbb40bee11463631623e56e7d79111cff3e074d77d9a3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 14.8MB
        • SHA256 5c9ce17219feadea2c8635daaef5f538a5c5d096d1dac2cc7ae6570fe2d1f391
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 14.9MB
        • SHA256 c78bd11d78f20f7a697e3f93954b4444b8ee59da8c6c63ed4bc2cae7355b7bad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 27.1MB
        • SHA256 1a717889d9e18a45517accb6c8da20478a9d54b76829fc9ceeb44d4aec851fc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 21.6MB
        • SHA256 8d8d9753922bafe0e11c074ae8a178ab5787ddb459cc237e27a12015134a20f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 21.4MB
        • SHA256 5a222a2d9b2ee207e0f0c6461598841ac11704c8603325dc67968c47ef30f18b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 24.0MB
        • SHA256 e81096c9469e0c95ae89b097e438071ba2e95654091dfd6a9fec5f519b0f14d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 26.7MB
        • SHA256 e3a0d0d1a00a2f7b7af847aa8a9e65f10b1197a5c339e912b9cdac1ebd0f2387
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 26.8MB
        • SHA256 ac83144a3df15dada3f7218dd8f5f24e148d7632a74d1ccb23a46766d2762c43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 27.0MB
        • SHA256 47c198b3c97cfff5031c8c34e05717818def694911514bfbac98d2138f6004ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 23.8MB
        • SHA256 18b19515455d860d6f55ebe5620ecd3158b9fdf81ccea0450876bdfc7c891e11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 21.2MB
        • SHA256 9e387ec9a3d39e0ab1c7b58035d5ac1757fc5978e0d67cb820de7f51d46699cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.6MB
        • SHA256 2d79bcaf63d7213f4ff06a263a0e5ca43fcb30e130cfcbd03f93984e371c4c1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 20.8MB
        • SHA256 2a5a7371b1cec99b4ea8306bb3d7d003dd88efb3eccc02b594294602c447fc7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 25.8MB
        • SHA256 267092e73924fccf5f9c98b0618768c355a68409e2c17848a21e67b109d2c2f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.0MB
        • SHA256 185ea07722b939c4614fd859bdff6ebd7baebf62349986a2390a5b4929679486
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.8MB
        • SHA256 8fc7290b8569089bdf35ee2eb2e4a65ea6bf5f4c29aab1e34c2664be1b885436
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 25.4MB
        • SHA256 9ff9a990be1e132df5bd96fb866c89cc4a3260d706f90c1264585a75f97c51b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 25.3MB
        • SHA256 6e6c23b1b3fc5b2b7c30e2bfaf9e142de67eac6e66e735e4f0aaf64231f8f66d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 20.2MB
        • SHA256 3882332c1014e9c3308c9cf3e722c7b0cf66ac95bd17023a270dd5af7468e0a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 25.4MB
        • SHA256 4451846c260e24ee6adbb1ec153c46223e25bd75633f27ec622debba46ca76a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 22.2MB
        • SHA256 6d921f893bc73b18f3612279e4aa429576a9d28ce52c11402d1ad3bb42b22a2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 22.4MB
        • SHA256 36bf21aebcb2582f8e3007e62a11381b9c55ec193dfd46ab3bdf4fcc25fac77c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 25.1MB
        • SHA256 b3c452f55d617903744ba27cc3661449062bfc4e352994f21c1d80379fc8c782
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 25.1MB
        • SHA256 5c7f93ee8c827a1d50d90510f42cf939e7f7b1b2a89a7b95616567184e62a613
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 24.9MB
        • SHA256 6398e3647c583520f5791233d43b0c13c16e61d679bce00d79022f848c915507
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 29.8MB
        • SHA256 5a30e8658e2f82d656951cae8bdaadde9256590658c90619243347555978831b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 29.7MB
        • SHA256 e7dccb1fcc9821779eb0adc88f5642f72375d8b098d25fc1dd4fb7d5560732a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 29.7MB
        • SHA256 292d4ed2e0f260c5623e123d1d385272966470deec1fe76f0cf8e01a1a2388c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 29.7MB
        • SHA256 c6d05533a17745c2030dcc5521e8f18706c8953b421be079a6b156ca674e1698
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1012-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1012-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3536-31-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download