Overview

overview

8

Static

static

3

2026-08-01...ar.exe

windows10-2004-x64

8

2026-08-01...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    37s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 01:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_1ac16140b9691596fbfdc13bbd00ed9f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 42.9MB
  • Sample260802-bllyws1th1
  • SHA256 cd3a91c8effd1c71b14b807314739925848c1692beceaa056f5c4d42b734bcd8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_1ac16140b9691596fbfdc13bbd00ed9f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_1ac16140b9691596fbfdc13bbd00ed9f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5032
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_1ac16140b9691596fbfdc13bbd00ed9f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_1ac16140b9691596fbfdc13bbd00ed9f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1924

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 43.2MB
        • SHA256 eec80d77d8d4828a50015bee012b4fabfe8001c16a06d8e4fa8db9c1a1a4b120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 78.2MB
        • SHA256 fde54a3b32b9851eba6befd51f78c98bfe23cea17f11ab3a81484834663a81fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 70.7MB
        • SHA256 5e5ac01b84d2ef5a5c894d2913bf8100a7acc3157eff69bcac7f6113c5170c55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 71.0MB
        • SHA256 358ee07502642ed25bd543fb1cdbb3ec4b0ad8fdaef54e68bd04477b1615c759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 45.0MB
        • SHA256 40e4b521ee272aa9c8b2c0f84cd85f05b9879747a06dae4058656563f0af8d79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 63.6MB
        • SHA256 1c6367b4939c61793bbbd080ff93114fb1776a21c8a5015c0a677d0cf29db9c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ExitResolve.asp
        • Path C:\Program Files\ExitResolve.asp
        • Size 62.1MB
        • SHA256 ccc3294cc7d0a480ef2f544fe3a5b6673e00fbc92e5915097950f76f0d934ede
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ExportRequest.exe
        • Path C:\Program Files\ExportRequest.exe
        • Size 58.4MB
        • SHA256 7aa475d7212f01e0d232733e3c98a4e3984007d3ce3cdd8dbb7b1bfb832803d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 51.1MB
        • SHA256 3615053cbda1a9803db84c2b664188a8d5c35e38eecee9a0118f66ec76a0e55f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 57.4MB
        • SHA256 e2e26ccec4fe5bc8849b91fcd81f7ff18cc4b6a47b1fbe0a8d5111fdbf4f2ab9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 55.4MB
        • SHA256 d791d8992283734e1cb8f3bbdc1085e6f5e873fd1875898065454778c4735057
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 53.1MB
        • SHA256 a2cc209a9ccf062fca919e18d2c6e23f071da2269b069d596e1ee45abff25187
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 50.9MB
        • SHA256 ac594017a3d5e31129f88eb17fc7d1af11ef39b5125ecf038e1fe5c24274613c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 44.5MB
        • SHA256 d4e9c22e64c1eacd8609e53652b548cba1f27a60b247e6978cf3fdf82036071e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 43.3MB
        • SHA256 e53579486a59aab4a16e319fae794f190d6c7c6913a497173d8ed470758c75f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 42.6MB
        • SHA256 8d8f864ef1da8153a69110bb15f073ce917f1729c4ddede5cfe799170c26b61a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 41.9MB
        • SHA256 a20144631eb9b3eeb5794997e6ed66a64f3fae81b631da4fde27252318c32207
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 40.4MB
        • SHA256 7ddea965dac7fd23b7f073bb7e1ee3734edc37350d54755c96d63f6690bd836d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 38.8MB
        • SHA256 19ac6ac92fc0b7cc487fca455e6f88bb18d1ec080fc2224c8dd61c1ed6c598d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 39.5MB
        • SHA256 d19547e63c38147fa01ba4fcbc2ebbe32b343899ff841eb948653219298a7cc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 37.4MB
        • SHA256 576a1ffe75c371487e0717b38c1928d3bdfaa121a9cda3b8d23762f9e2333fae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 35.1MB
        • SHA256 6cff37a1b05b5ca991a68eddf2e47567d4ee94780a55f1548370c79237b0332f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 33.8MB
        • SHA256 0ffcfbe6d02bfc7fdec8eeeab3a458e69c0905932a3507e6674599deb8deffa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 32.0MB
        • SHA256 18efb5331a3c5bb4126140511493255785df1540b3f5e74ae6321462f6b55788
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 31.4MB
        • SHA256 e0be402f6b96593a088e8d376795575dd8c29f019410c89ce99832f00ff7ff72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 29.6MB
        • SHA256 11a6c5483ee5be7cea17a07e64686c483008a58f03eb31e5b12b252899aaeadd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 768KB
        • SHA256 c6e2dd88fb72337d1d62c38eef8541d15b17897962586f78405b1eecaf7a243e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 25.7MB
        • SHA256 2c436e6cae19ab582cef40e3d7b59d2419009c4232d05363318886f70f89adba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 25.3MB
        • SHA256 63d4633898b06c7739fc9278655023d7c42b6e311892cf9a9096f5bb40c3794f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 25.0MB
        • SHA256 01a42e4ac8e9093fc298d22d4891b2a25e1329221ec756a13184048d7f04b2a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.6MB
        • SHA256 775ce2a92d9d3a7fc9e0e3f62810cdf147c7ce7cc79dbbb7ac535f5011753361
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 24.2MB
        • SHA256 0df0db51bd7a1744049b1f5969c50b4272715055fba1a1bc295022ef9c652f01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 24.0MB
        • SHA256 60f7cc70fca63e4d7fa9512767c7cad7d10a2308cd174a3aa3bff56c565da48e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 23.8MB
        • SHA256 7edc3322358ce05fe35289c16a50639f771dcd5280dd3268d29a8927795e1c9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 23.5MB
        • SHA256 835f514c0a6ef79bb55a2856940ff80354028d16eb761ae44493bdcdcf93ecf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 22.8MB
        • SHA256 d02be435b8527d6edf9900161686d08745da0c15aace1e82f24dd70bdf359e11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 22.4MB
        • SHA256 fe0b43eb89e29a07fcdd985ac7c2d8d1b33aee82b66ad91874dee31413fbf11f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 63.6MB
        • SHA256 4c48b21ea2d208ee5bdd45e55757f597e1e159b7532dc6157a2ca0d2d28963dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 61.4MB
        • SHA256 eb2589233290809baeecad7681e79f042e60a37f7f1a9e8e7a59a8bff8234694
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 62.2MB
        • SHA256 25c369ffebd48d18f7a315a0ade9f5485d380e75747b6cedb660c48b3aba48e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 59.9MB
        • SHA256 00f14cc82a303521d35eb4d89a13e6f7bbd1ba3220afb96d34098cb806478697
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download