Overview

overview

8

Static

static

3

2026-08-03...ar.exe

windows10-2004-x64

8

2026-08-03...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    48s
  • max time network
    156s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 09:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_da32cd80e81a00c9ded7c3a92118b28b_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 44.4MB
  • Sample260804-ldrvaastgy
  • SHA256 da36142cb022387e17222a1072a50648f4b93b4906e66bbb0f72f4cca88c87d0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_da32cd80e81a00c9ded7c3a92118b28b_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_da32cd80e81a00c9ded7c3a92118b28b_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4680
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_da32cd80e81a00c9ded7c3a92118b28b_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_da32cd80e81a00c9ded7c3a92118b28b_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4192

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 44.5MB
        • SHA256 6d94d4f8241379f2c352762cb0c20f8ba384e708a48f2b7125985b4b2dc14ba8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 44.4MB
        • SHA256 da36142cb022387e17222a1072a50648f4b93b4906e66bbb0f72f4cca88c87d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 89.2MB
        • SHA256 5ce9db0a19aee8b65d6a74618e9661eb8ffaa37aa176cfafbd1ec6946613d945
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 46.6MB
        • SHA256 b3cd440f057c1110d7e0b0650c52aecab90b80fe58daa1c67478fa94087ae005
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 81.8MB
        • SHA256 f7492197f703df11778631eb7e16fa3a50bebcec7679f5923a5c4098b7825faa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 71.9MB
        • SHA256 ac85245b3c2dd86cf274d48e05bb2c59ecba16f21fd8a9705ff8b808e4513cd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 71.1MB
        • SHA256 70116f7d6cd9935d6fb52c48d21d8e3595ffed9ac0846ebc8aa0e8f6f596d91e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 70.3MB
        • SHA256 c84a109337111c9c786f88de9a7f31cf2d06abd8b5e27a6fb17a65ee364c7b7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 66.1MB
        • SHA256 10adaf3d35a5f692f6fa3621e269fa98edde96d567a142a7cc241de339519639
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 65.4MB
        • SHA256 56b359b6aa09a0b3d67a12add3584224446a5687303bbee82beaf4d4f93d47e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 64.4MB
        • SHA256 063cf5072c9eefa3b65770c2b55e224b7d43d5d40e317542db7ada8091a3d74a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 61.1MB
        • SHA256 d54f9ff8ed40fd49a05f98e62a32398d270e0dbf05e240b6f3bf6ea7a9e4612d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 55.6MB
        • SHA256 32717b4eb79eecb8c3987070d5418bbe6b5e5fd3e0fc47d7fa8b203a6fb1932b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 52.7MB
        • SHA256 ab3f5b2aa19081fe6df7609616f0e1c52790d6674dcc7f9f7310fd040c19e8d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 50.6MB
        • SHA256 450fd8968407a75edeced541a59c44f5336d99b7aad67fbf52cc58bda8ee00ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 48.0MB
        • SHA256 9031038204ee4564df9d72b79b31116466a6085dde741fbed93f61f89d4420cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 47.3MB
        • SHA256 175decd508f7c7ad541c0ebdb6d7df2202adeaf91195c35175041f228673ee11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 46.2MB
        • SHA256 aee65eaec04e5b1f0123a4804522c5be36186561702541286bf85fff5cb4aa19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 45.8MB
        • SHA256 68f9f76e106cf001e9dc61947814eda2c4632caacf8f3e6b97f35f070f6e5e67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 45.1MB
        • SHA256 e9237a58462fd31dd79ecf32c5f9977cec3c19e4666f3774a5b0a5cd3245d740
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 43.8MB
        • SHA256 ba2f14c97491025d2920ef044aed16dfce06f7477efbe9ccb6905d39737962f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 43.2MB
        • SHA256 7acd13324b765b56d0eea5cbc190ab36ab1c9a4365fab6c73e05a59ad51901bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 40.5MB
        • SHA256 8916baddbff3056763ab95f35c4d4917e1d787d6e496b83074e9c767bc4864d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 39.9MB
        • SHA256 e0d4ad8f6b7354ab92a1b3473b0ff8f3ad1ab67ddf5f39fb68a2da8bbbb15324
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 38.8MB
        • SHA256 f2129daf281bf513122247ab473d2bd8bef6e7124c51a3e1c598c917e90674ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 38.4MB
        • SHA256 032e240776b4b7e600060d0a32e319c6671cc2f4e2d70eda138f1145a6d19242
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 36.9MB
        • SHA256 bc10c116f0c446f70344d244f9252368c2be5cb030cfe5964bc3af4f3cc57fd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 36.0MB
        • SHA256 e14f2923ad93ab176afc9a8c6a2546873cdbd8b382ffb4fcc65c9dc563b7bcf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 37.3MB
        • SHA256 6fc9ddac6a44735d79eed941e347b261f424a6b43a5eb06ccae1df0409f433cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 33.5MB
        • SHA256 022032d33122f642429ba9746313ee68e9c4d38da911d1f605216722174589d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.7MB
        • SHA256 a99b86182b569b216fb70d4df40102c2a415761176b68103b5f0b8aeb496b90d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.1MB
        • SHA256 ec2ddd41c2282fec4c6750672d7392d4d30eece14903b6aba776a83a5bd73f29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.4MB
        • SHA256 02eef37c4b1cfc83dc37596b4f45e17738f0c19566dc2a918af7865a190d1a1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.2MB
        • SHA256 2d0b7718fa8afc45d790c3c7693c34834ac1bc3dfd548f3fddf8ab73d3947ac6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.8MB
        • SHA256 dcd05db2277465df4f54d6763aad17c96b22344fc86337d5941075b4066c734f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 29.2MB
        • SHA256 490b9015bc16a51dd7bb965339b4c18a177df4568d30186ed1b8744e402185c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 28.9MB
        • SHA256 485a1e04bafc4061a79cbc15c8678cc31ecc52a3d154a0dc3f912f7b1463f684
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 28.2MB
        • SHA256 a02346ce32cb461c494c4222bb71073843875d949576e71e77e5378fc51e43ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 28.0MB
        • SHA256 8a466babe3336391e7540904851561590476b6dcffb4f109277cb2e349f2e4a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 77.8MB
        • SHA256 6335c18237cb485210f574b46a6de68fbdb3f84e2d795b4f8a0ffa12fc947521
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 77.6MB
        • SHA256 26325ab755fb09621f97c76396b2122f9a34d297bd913cc73e0501135ee6596c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 75.5MB
        • SHA256 cc4e983fb295b63059fe459db1178f7aef557190ce21696bb9cb163c9670961f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 73.3MB
        • SHA256 8a11c8f4ce6692f819be6cd6394bc92a11931ba32f0bfb33ce7e279f8c5323e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download